fix(self-hosting): grow seaweedfs one volume at a time (#3076 )

fix(api): report final system DM progress (#3074 )
feat(admin): allow system DMs to all users (#3073 )
2026-10-08 03:32:27 +09:00 · 2026-09-30 22:55:12 +02:00 · 2026-09-30 22:11:34 +02:00 · 2026-09-30 21:29:05 +02:00 · 2026-09-30 21:12:13 +02:00 · 2026-09-30 21:03:25 +02:00
4700 changed files with 522290 additions and 547904 deletions
@@ -1,14 +1,14 @@
-FROM chrislusf/seaweedfs:4.31 AS seaweedfs
+FROM chrislusf/seaweedfs:4.47 AS seaweedfs

-FROM erlang:28.5.0.1
+FROM erlang:28.5.0.6

 ARG USERNAME=vscode
 ARG USER_UID=1000
 ARG USER_GID=1000
-ARG NODE_MAJOR=24
-ARG ELP_VERSION=2026-02-27
-ARG PNPM_VERSION=10.29.3
-ARG WASM_BINDGEN_VERSION=0.2.123
+ARG NODE_MAJOR=26
+ARG ELP_VERSION=2026-08-10
+ARG PNPM_VERSION=11.27.0
+ARG WASM_BINDGEN_VERSION=0.2.128

 ENV DEBIAN_FRONTEND=noninteractive

@@ -131,7 +131,8 @@ RUN apt-get update \
 RUN curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL https://deb.nodesource.com/setup_${NODE_MAJOR}.x | bash - \
 	&& apt-get install -y --no-install-recommends nodejs \
 	&& rm -rf /var/lib/apt/lists/* \
-	&& corepack enable
+	&& npm install -g "pnpm@${PNPM_VERSION}" \
+	&& pnpm --version

 RUN python3 -m pip install --break-system-packages --no-cache-dir awscli

@@ -167,7 +168,7 @@ RUN ARCH="$(dpkg --print-architecture)" \
 		arm64) ELP_ARCH="aarch64" ;; \
 		*) echo "Unsupported architecture for ELP: $ARCH" >&2; exit 1 ;; \
 	esac \
-	&& curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL "https://github.com/WhatsApp/erlang-language-platform/releases/download/${ELP_VERSION}/elp-linux-${ELP_ARCH}-unknown-linux-gnu-otp-28.tar.gz" -o /tmp/elp.tgz \
+	&& curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL "https://github.com/WhatsApp/erlang-language-platform/releases/download/${ELP_VERSION}/elp-linux-${ELP_ARCH}-unknown-linux-gnu-otp-28.5.tar.gz" -o /tmp/elp.tgz \
 	&& tar -C /usr/local/bin -xzf /tmp/elp.tgz elp \
 	&& chmod +x /usr/local/bin/elp \
 	&& rm /tmp/elp.tgz
@@ -194,7 +195,4 @@ RUN curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL https://sh.rustup.rs
 	&& cargo install wasm-bindgen-cli --version "${WASM_BINDGEN_VERSION}" --locked \
 	&& rm -rf "/home/${USERNAME}/.cargo/registry" "/home/${USERNAME}/.cargo/git"

-RUN corepack prepare "pnpm@${PNPM_VERSION}" --activate \
-	&& pnpm --version
-
 WORKDIR /workspaces/fluxer
@@ -14,7 +14,7 @@
 		"DOCKER_HOST": "unix:///var/run/docker.sock"
 	},
 	"runServices": ["workspace", "postgres", "valkey", "nats", "livekit", "meilisearch", "mailpit"],
-	"forwardPorts": [3000, 8088, 8080, 8771, 8082, 8773, 3010, 3020, 8333],
+	"forwardPorts": [3000, 8088, 8080, 8771, 8082, 8773, 3020, 8333],
 	"portsAttributes": {
 		"8088": {
 			"label": "Fluxer dev proxy",
@@ -38,7 +38,11 @@
 	"customizations": {
 		"vscode": {
 			"settings": {
-				"editor.defaultFormatter": "biomejs.biome"
+				"editor.defaultFormatter": "biomejs.biome",
+				"erlang.includePaths": ["."],
+				"search.exclude": {
+					"**/_build/default/lib/fluxer_gateway": true
+				}
 			},
 			"extensions": [
 				"biomejs.biome",
@@ -9,7 +9,7 @@ services:
    init: true
    environment:
      DOCKER_HOST: unix:///var/run/docker.sock
-      npm_config_store_dir: /home/vscode/.local/share/pnpm/store
+      pnpm_config_store_dir: /home/vscode/.local/share/pnpm/store
      FLUXER_PUBLIC_PORT: "${FLUXER_DEV_PROXY_PORT:-8088}"
      FLUXER_PUBLIC_URL: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
      FLUXER_API_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/api"
@@ -23,7 +23,6 @@ services:
      FLUXER_S3_PUBLIC_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
      FLUXER_LIVEKIT_URL: "ws://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/livekit"
      FLUXER_LIVEKIT_INTERNAL_URL: "http://livekit:7880"
-      FLUXER_LIVEKIT_WEBHOOK_URL: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/api/webhooks/livekit"
      FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/media"
      FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/media"
      FLUXER_GATEWAY_STATIC_CDN_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
@@ -202,11 +201,6 @@ services:
        target: /workspaces/fluxer/fluxer_api/pkgs/rate_limit/node_modules
        volume:
          nocopy: true
-      - type: volume
-        source: fluxer-api-sms-node-modules
-        target: /workspaces/fluxer/fluxer_api/pkgs/sms/node_modules
-        volume:
-          nocopy: true
      - type: volume
        source: fluxer-api-virus-scan-node-modules
        target: /workspaces/fluxer/fluxer_api/pkgs/virus_scan/node_modules
@@ -256,7 +250,6 @@ services:
      - "127.0.0.1:${FLUXER_DEV_GATEWAY_PORT:-8771}:8771"
      - "127.0.0.1:${FLUXER_DEV_MEDIA_PROXY_PORT:-8082}:8082"
      - "127.0.0.1:${FLUXER_DEV_APP_PROXY_PORT:-8773}:8773"
-      - "127.0.0.1:${FLUXER_DEV_MARKETING_PORT:-3010}:3010"
      - "127.0.0.1:${FLUXER_DEV_ADMIN_PORT:-3020}:3020"
      - "127.0.0.1:${FLUXER_DEV_SEAWEEDFS_S3_PORT:-3900}:8333"
    depends_on:
@@ -293,13 +286,13 @@ services:
      start_period: 5s

  valkey:
-    image: valkey/valkey:8.1.7-alpine
+    image: valkey/valkey:9.1.2-alpine
    command: ["valkey-server", "--save", "", "--appendonly", "no"]
    ports:
      - "127.0.0.1:${FLUXER_DEV_VALKEY_PORT:-6379}:6379"

  nats:
-    image: nats:2.14.2-alpine
+    image: nats:2.14.7-alpine
    command: ["-js", "-sd", "/data", "-m", "8222"]
    volumes:
      - nats-data:/data
@@ -322,9 +315,10 @@ services:
      - "127.0.0.1:${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}:${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}/udp"

  meilisearch:
-    image: getmeili/meilisearch:v1.12
+    image: getmeili/meilisearch:v1.53
    environment:
      MEILI_NO_ANALYTICS: "true"
+      MEILI_UPGRADE_DB: "true"
      MEILI_MASTER_KEY: fluxer-dev-meilisearch
    volumes:
      - meilisearch-data:/meili_data
@@ -338,7 +332,7 @@ services:
      start_period: 5s

  mailpit:
-    image: axllent/mailpit:v1.30
+    image: axllent/mailpit:v1.31
    environment:
      MP_DATABASE: /data/mailpit.db
      MP_MAX_MESSAGES: 5000
@@ -384,7 +378,6 @@ volumes:
  fluxer-api-mime-utils-node-modules:
  fluxer-api-nats-node-modules:
  fluxer-api-rate-limit-node-modules:
-  fluxer-api-sms-node-modules:
  fluxer-api-virus-scan-node-modules:
  fluxer-api-worker-node-modules:
  fluxer-app-list-utils-node-modules:
@@ -9,7 +9,6 @@
 **/.git/**
 /.github/
 /.pnpm-store/
-/fluxer_marketing

 **/.env
 **/.env.*.local
@@ -33,6 +32,7 @@
 /fluxer_docs/.astro/
 /fluxer_app/.devserver-cache.json
 /fluxer_app/pkgs/libfluxcore/
+/fluxer_app/pkgs/libfluxwebp/
 /fluxer_app/src/features/i18n/locales/*/messages.mjs
 /fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
 /fluxer_app/src/features/theme/styles/generated/
@@ -1,7 +1,2 @@
 /.github/CODEOWNERS @fluxerapp/developers
 /.github/workflows/ @fluxerapp/developers
-/fluxer_marketing @fluxerapp/developers
-/.gitmodules @fluxerapp/developers
-/.github/workflows/dispatch-private-marketing-build.yaml @fluxerapp/developers
-/packages/i18n/marketing/ @fluxerapp/developers
-/scripts/setup-private-marketing.sh @fluxerapp/developers
@@ -89,21 +89,3 @@ Submit translations through [Weblate](https://weblate.fluxer.tools), not through
 All repository activity is governed by the [Code of Conduct](https://github.com/fluxerapp/fluxer/blob/main/.github/CODE_OF_CONDUCT.md).

 Fluxer is distributed under the [GNU Affero General Public License, version 3.0 or later](https://github.com/fluxerapp/fluxer/blob/main/LICENSE). By adding a DCO sign-off, you certify that you have the right to submit the contribution under that licence.
-
-## Private marketing project
-
-The marketing implementation is maintained in a private repository at the `fluxer_marketing` submodule path. The public workspace, bootstrap, checks, and development stack work without initializing it.
-
-Authorized maintainers can initialize only that submodule and install its independent dependencies:
-
-```sh
-./scripts/setup-private-marketing.sh
-pnpm --dir fluxer_marketing install --frozen-lockfile
-cargo metadata --locked --manifest-path fluxer_marketing/Cargo.toml
-```
-
-To run the private marketing service in the local development stack and direct application links to it, add this override to the ignored `config/env/local.env` file:
-
-```sh
-FLUXER_MARKETING_ENDPOINT=http://localhost:8088/marketing
-```
@@ -22,17 +22,15 @@ f:docs:
 f:gateway:
  - changed-files:
    - any-glob-to-any-file: fluxer_gateway/**/*
-f:marketing:
-  - changed-files:
-    - any-glob-to-any-file:
-      - fluxer_marketing
-      - packages/i18n/marketing/**/*
 f:media_proxy:
  - changed-files:
    - any-glob-to-any-file: fluxer_media_proxy/**/*
 f:messages:
  - changed-files:
    - any-glob-to-any-file: fluxer_messages/**/*
+f:push:
+  - changed-files:
+    - any-glob-to-any-file: fluxer_push/**/*
 f:snowflakes:
  - changed-files:
    - any-glob-to-any-file: fluxer_snowflakes/**/*
@@ -58,13 +58,13 @@ jobs:
    outputs:
      build_version: ${{ steps.vars.outputs.build_version }}
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: Create token
        id: create-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
@@ -101,19 +101,19 @@ jobs:
          - platform: arm64
            runner: ubuntu-24.04-arm
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: resolve source date
        id: source
        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}
-      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
        with:
          context: ${{ inputs.context }}
          file: ${{ inputs.dockerfile }}
@@ -141,15 +141,15 @@ jobs:
      contents: write
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -43,13 +43,13 @@ jobs:
    outputs:
      build_version: ${{ steps.vars.outputs.build_version }}
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: set variables
        id: vars
        run: >-
@@ -71,20 +71,19 @@ jobs:
      BUILD_VERSION: ${{ needs.meta.outputs.build_version }}
      PUBLIC_ASSET_BASE_URL: ""
      BUNDLE_LOCAL_ASSETS: "true"
-      FLUXER_APP_PROXY_TIME_FREEZE_ENABLED: "false"
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: prepare docker config
        run: >-
          tools/ci/run.sh build-app-proxy
          --step prepare_docker_config
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
      - name: configure ghcr auth
        env:
          GHCR_USERNAME: ${{ github.actor }}
@@ -131,19 +130,19 @@ jobs:
          - platform: arm64
            runner: ubuntu-24.04-arm
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: resolve source date
        id: source
        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
        with:
          context: .
          file: fluxer_app_proxy/Dockerfile
@@ -155,7 +154,6 @@ jobs:
            BUILD_VERSION=${{ needs.meta.outputs.build_version }}
            SOURCE_SHA=${{ github.sha }}
            SOURCE_DATE=${{ steps.source.outputs.date }}
-            FLUXER_APP_PROXY_TIME_FREEZE_ENABLED=false
            APP_ASSETS_REF=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-assets
            APP_ASSETS_PLATFORM=linux/amd64
          cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:buildcache-${{ matrix.platform }}
@@ -173,15 +171,15 @@ jobs:
      contents: write
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -43,13 +43,13 @@ jobs:
    outputs:
      build_version: ${{ steps.vars.outputs.build_version }}
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: set variables
        id: vars
        run: >-
@@ -67,18 +67,18 @@ jobs:
      contents: read
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: prepare docker config
        run: >-
          tools/ci/run.sh build-app-proxy
          --step prepare_docker_config
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
      - name: configure ghcr auth
        env:
          GHCR_USERNAME: ${{ github.actor }}
@@ -131,13 +131,13 @@ jobs:
      contents: read
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: resolve source date
        id: source
        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
@@ -145,7 +145,7 @@ jobs:
        run: >-
          tools/ci/run.sh build-app-proxy
          --step prepare_docker_config
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
      - name: configure ghcr auth
        env:
          GHCR_USERNAME: ${{ github.actor }}
@@ -178,19 +178,19 @@ jobs:
      contents: read
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: resolve source date
        id: source
        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
        with:
          context: .
          file: fluxer_app_proxy/Dockerfile
@@ -219,15 +219,15 @@ jobs:
      contents: write
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -11,11 +11,6 @@ on:
          - stable
          - canary
        default: stable
-      test_build:
-        description: Stash artifacts under desktop-test/ instead of desktop/ (API will not pick these up as a release).
-        required: false
-        default: false
-        type: boolean
      build_version:
        description: Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation.
        required: false
@@ -32,13 +27,12 @@ permissions:
  actions: read

 concurrency:
-  group: desktop-${{ inputs.channel }}-${{ inputs.test_build && 'test' || 'release' }}
+  group: desktop-${{ inputs.channel }}
  cancel-in-progress: true

 env:
  CHANNEL: ${{ inputs.channel }}
  BUILD_CHANNEL: ${{ inputs.channel == 'canary' && 'canary' || 'stable' }}
-  TEST_BUILD: ${{ inputs.test_build && 'true' || 'false' }}

 jobs:
  meta:
@@ -53,19 +47,17 @@ jobs:
      pub_date: ${{ steps.meta.outputs.pub_date }}
      channel: ${{ steps.meta.outputs.channel }}
      build_channel: ${{ steps.meta.outputs.build_channel }}
-      test_build: ${{ steps.meta.outputs.test_build }}
-      s3_prefix: ${{ steps.meta.outputs.s3_prefix }}
      source_sha: ${{ steps.meta.outputs.source_sha }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: main

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Create token
        id: create-token
@@ -85,7 +77,6 @@ jobs:
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
          --step set_metadata
          --channel "${{ inputs.channel }}"
-          --test-build "${{ inputs.test_build }}"

  matrix:
    name: Resolve build matrix
@@ -98,12 +89,12 @@ jobs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Build platform matrix
        id: set-matrix
@@ -113,7 +104,7 @@ jobs:
          --skip-targets "${{ inputs.skip_targets }}"

  build:
-    name: Build ${{ matrix.platform }} (${{ matrix.arch }}, ${{ matrix.desktop_variant }})
+    name: Build ${{ matrix.platform }} (${{ matrix.arch }})
    needs:
      - meta
      - matrix
@@ -137,41 +128,34 @@ jobs:
      PUBLIC_BUILD_VERSION: ${{ needs.meta.outputs.version }}
      PUB_DATE: ${{ needs.meta.outputs.pub_date }}
      SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
-      S3_DESKTOP_PREFIX: ${{ needs.meta.outputs.s3_prefix }}
-      DESKTOP_HANDOFF_PREFIX: _handoff/desktop/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
-      S3_ENDPOINT: ${{ vars.DOWNLOADS_S3_ENDPOINT }}
-      S3_BUCKET: ${{ vars.DOWNLOADS_S3_BUCKET }}
-      AWS_ACCESS_KEY_ID: ${{ secrets.DOWNLOADS_AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.DOWNLOADS_AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
      DESKTOP_PLATFORM: ${{ matrix.platform }}
      DESKTOP_ARCH: ${{ matrix.arch }}
-      DESKTOP_VARIANT: ${{ matrix.desktop_variant }}
      PLATFORM: ${{ matrix.platform }}
      ARCH: ${{ matrix.arch }}
      ELECTRON_ARCH: ${{ matrix.electron_arch }}
    steps:
      - name: Checkout CI helpers
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}
          path: _ci

      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}
          path: source

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Set up Python (Windows)
        if: runner.os == 'Windows'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
-          python-version: "3.13"
+          python-version: "3.14"

      - name: Ensure python3 command (Windows)
        if: runner.os == 'Windows'
@@ -196,14 +180,14 @@ jobs:
          --step set_workdir_unix

      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: 24
+          node-version: 26

-      - name: Set up pnpm via corepack
+      - name: Set up pnpm
        run: >-
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
-          --step setup_pnpm_corepack
+          --step setup_pnpm

      - name: Resolve pnpm store path (Windows)
        if: runner.os == 'Windows'
@@ -247,9 +231,9 @@ jobs:

      - name: Set up Rust toolchain (Unix)
        if: matrix.platform != 'windows'
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: ${{ matrix.platform == 'macos' && 'aarch64-apple-darwin,x86_64-apple-darwin' || (matrix.arch == 'arm64' && 'aarch64-unknown-linux-gnu' || 'x86_64-unknown-linux-gnu') }}

      - name: Install MSVC ARM64 build tools
@@ -260,7 +244,7 @@ jobs:

      - name: Set up MSVC env (Windows)
        if: matrix.platform == 'windows'
-        uses: TheMrMilchmann/setup-msvc-dev@79dac248aac9d0059f86eae9d8b5bfab4e95e97c
+        uses: TheMrMilchmann/setup-msvc-dev@368ef7d1ee4d1171b31d4a7f67f4d954f903f5a9
        with:
          arch: ${{ matrix.arch == 'arm64' && 'amd64_arm64' || 'amd64' }}

@@ -302,9 +286,9 @@ jobs:

      - name: Set up .NET SDK (Windows)
        if: matrix.platform == 'windows'
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
        with:
-          dotnet-version: "8.0.x"
+          dotnet-version: "10.0.x"

      - name: Install Velopack CLI
        if: matrix.platform == 'windows'
@@ -363,7 +347,7 @@ jobs:

      - name: Azure login for Artifact Signing
        if: matrix.platform == 'windows'
-        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -477,6 +461,12 @@ jobs:
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
          --step prepare_artifacts_unix

+      - name: Build AppImage update feed (Linux)
+        if: matrix.platform == 'linux'
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step build_appimage_update_feed
+
      - name: Normalize updater YAML (macOS)
        if: matrix.platform == 'macos'
        run: >-
@@ -495,13 +485,23 @@ jobs:
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
          --step generate_checksums_windows

-      - name: Upload artifacts to S3 handoff
+      - name: Stage build artifacts
+        id: handoff
        run: >-
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
-          --step upload_handoff
+          --step stage_handoff
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: ${{ steps.handoff.outputs.artifact_name }}
+          path: upload_staging
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 0

  upload:
-    name: Upload to S3
+    name: Assemble desktop release assets
    if: ${{ !cancelled() && needs.build.result == 'success' }}
    needs:
      - meta
@@ -520,34 +520,26 @@ jobs:
      BUILD_VERSION: ${{ needs.meta.outputs.version }}
      PUBLIC_BUILD_VERSION: ${{ needs.meta.outputs.version }}
      PUB_DATE: ${{ needs.meta.outputs.pub_date }}
-      TEST_BUILD: ${{ needs.meta.outputs.test_build }}
      SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
-      S3_DESKTOP_PREFIX: ${{ needs.meta.outputs.s3_prefix }}
-      DESKTOP_HANDOFF_PREFIX: _handoff/desktop/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
-      DESKTOP_RELEASE_ASSETS_PREFIX: _handoff/desktop-release-assets/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
-      DESKTOP_METADATA_PREFIX: _handoff/desktop-metadata/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
-      S3_ENDPOINT: ${{ vars.DOWNLOADS_S3_ENDPOINT }}
-      S3_BUCKET: ${{ vars.DOWNLOADS_S3_BUCKET }}
      PUBLIC_DL_BASE: https://api.fluxer.app/dl
-      AWS_ACCESS_KEY_ID: ${{ secrets.DOWNLOADS_AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.DOWNLOADS_AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

-      - name: Download S3 handoff artifacts
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step download_handoff
+      - name: Download build artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          path: artifacts
+          pattern: fluxer-desktop-${{ needs.meta.outputs.build_channel }}-*

-      - name: Build S3 payload layout (+ manifest.json)
+      - name: Build payload layout (+ manifest.json)
        env:
          VERSION: ${{ needs.meta.outputs.version }}
          PUB_DATE: ${{ needs.meta.outputs.pub_date }}
@@ -556,42 +548,27 @@ jobs:
          --step build_payload

      - name: Prepare GitHub release assets
-        if: needs.meta.outputs.test_build != 'true'
        run: >-
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
          --step prepare_release_assets

-      - name: Publish GitHub release descriptor
-        if: needs.meta.outputs.test_build != 'true'
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step publish_release_descriptor
-
-      - name: Upload payload to S3
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step upload_payload
-
-      - name: Upload GitHub release asset handoff
-        if: needs.meta.outputs.test_build != 'true'
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step upload_release_assets
+      - name: Upload GitHub release assets
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: fluxer-desktop-release-assets
+          path: release_assets
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 0

      - name: Build summary
        run: >-
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
          --step build_summary

-      - name: Cleanup S3 handoff
-        if: ${{ success() }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step cleanup_handoff
-
  publish_release:
    name: Publish GitHub desktop release
-    if: ${{ !cancelled() && needs.upload.result == 'success' && needs.meta.outputs.test_build != 'true' }}
+    if: ${{ !cancelled() && needs.upload.result == 'success' }}
    needs:
      - meta
      - upload
@@ -603,28 +580,22 @@ jobs:
    env:
      CHANNEL: ${{ needs.meta.outputs.build_channel }}
      VERSION: ${{ needs.meta.outputs.version }}
-      S3_DESKTOP_PREFIX: ${{ needs.meta.outputs.s3_prefix }}
-      DESKTOP_RELEASE_ASSETS_PREFIX: _handoff/desktop-release-assets/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
-      DESKTOP_METADATA_PREFIX: _handoff/desktop-metadata/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
-      S3_ENDPOINT: ${{ vars.DOWNLOADS_S3_ENDPOINT }}
-      S3_BUCKET: ${{ vars.DOWNLOADS_S3_BUCKET }}
-      AWS_ACCESS_KEY_ID: ${{ secrets.DOWNLOADS_AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.DOWNLOADS_AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Download GitHub release assets
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step download_release_assets
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          name: fluxer-desktop-release-assets
+          path: release_assets

      - name: Create token
        id: create-token
@@ -656,15 +627,3 @@ jobs:
            release_args+=(--prerelease)
          fi
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- "${release_args[@]}"
-
-      - name: Publish GitHub release readiness marker
-        env:
-          SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step publish_release_marker
-
-      - name: Publish payload metadata to S3
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step publish_payload_metadata
@@ -0,0 +1,36 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+name: build push
+
+on:
+  workflow_dispatch:
+    inputs:
+      build-version:
+        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
+        type: string
+        required: false
+        default: ""
+
+permissions:
+  actions: read
+  contents: write
+  packages: write
+
+jobs:
+  approve:
+    name: approve build release
+    permissions: {}
+    runs-on: ubuntu-24.04
+    environment: builds
+    timeout-minutes: 5
+    steps:
+      - name: approved
+        run: echo "Build release approved."
+
+  image:
+    needs: approve
+    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
+    with:
+      image: fluxer-push
+      dockerfile: fluxer_push/Dockerfile
+      build-version: ${{ inputs['build-version'] }}
@@ -19,22 +19,22 @@ jobs:
    timeout-minutes: 15
    steps:
      - name: Checkout fluxer
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -1,230 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-name: Dispatch private marketing build
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - fluxer_marketing
-      - Cargo.toml
-      - fluxer_common/**
-      - packages/fonts/manifest.json
-      - packages/fonts/NOTICE.md
-      - packages/fonts/LICENSE-IBM-PLEX.txt
-      - packages/fonts/css/locale-fallbacks.css
-      - packages/fonts/files/FluxerSans/**
-      - packages/fonts/files/FluxerMono/**
-      - packages/fonts/marketing/**
-      - packages/i18n/marketing/**
-      - fluxer_static/marketing/branding/**
-      - .github/workflows/dispatch-private-marketing-build.yaml
-
-permissions:
-  actions: read
-  contents: read
-
-concurrency:
-  group: private-marketing-dispatch
-  cancel-in-progress: false
-
-jobs:
-  metadata:
-    name: resolve exact private build metadata
-    if: github.repository == 'fluxerapp/fluxer'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    outputs:
-      parent_sha: ${{ steps.inputs.outputs.parent_sha }}
-      gitlink_sha: ${{ steps.inputs.outputs.gitlink_sha }}
-      build_version: ${{ steps.inputs.outputs.build_version }}
-      correlation_id: ${{ steps.inputs.outputs.correlation_id }}
-    steps:
-      - name: Create token
-        id: create-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
-        with:
-          client-id: ${{ vars.FLUXER_CI_APP_ID }}
-          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
-          owner: fluxerapp
-          repositories: fluxer
-          permission-contents: read
-      - name: Resolve trusted build inputs
-        id: inputs
-        env:
-          EVENT_AFTER: ${{ github.event.after }}
-          GH_TOKEN: ${{ steps.create-token.outputs.token }}
-          PARENT_SHA: ${{ github.sha }}
-          PUBLIC_REPOSITORY: ${{ github.repository }}
-          RUN_ID: ${{ github.run_id }}
-          RUN_ATTEMPT: ${{ github.run_attempt }}
-        run: |
-          set -euo pipefail
-          [[ "$GITHUB_EVENT_NAME" == "push" ]]
-          [[ "$GITHUB_REF" == "refs/heads/main" ]]
-          [[ "$PUBLIC_REPOSITORY" == "fluxerapp/fluxer" ]]
-          [[ "$PARENT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$EVENT_AFTER" == "$PARENT_SHA" ]]
-          [[ "$RUN_ID" =~ ^[1-9][0-9]*$ ]]
-          [[ "$RUN_ATTEMPT" =~ ^[1-9][0-9]*$ ]]
-          (( 10#$RUN_ATTEMPT <= 10 ))
-
-          main_sha="$(gh api "repos/$PUBLIC_REPOSITORY/git/ref/heads/main" --jq .object.sha)"
-          [[ "$main_sha" =~ ^[0-9a-f]{40}$ ]]
-          main_comparison="$(gh api "repos/$PUBLIC_REPOSITORY/compare/$PARENT_SHA...$main_sha")"
-          main_status="$(jq -r .status <<<"$main_comparison")"
-          [[ "$main_status" == "identical" || "$main_status" == "ahead" ]]
-          [[ "$(jq -r .merge_base_commit.sha <<<"$main_comparison")" == "$PARENT_SHA" ]]
-
-          commit="$(gh api "repos/$PUBLIC_REPOSITORY/git/commits/$PARENT_SHA")"
-          [[ "$(jq -r .sha <<<"$commit")" == "$PARENT_SHA" ]]
-          tree_sha="$(jq -r .tree.sha <<<"$commit")"
-          [[ "$tree_sha" =~ ^[0-9a-f]{40}$ ]]
-          entry="$(
-            gh api "repos/$PUBLIC_REPOSITORY/git/trees/$tree_sha" |
-              jq -cer '[.tree[] | select(.path == "fluxer_marketing")] | if length == 1 then .[0] else error("expected exactly one marketing gitlink") end'
-          )"
-          mode="$(jq -r .mode <<<"$entry")"
-          type="$(jq -r .type <<<"$entry")"
-          gitlink_sha="$(jq -r .sha <<<"$entry")"
-          path="$(jq -r .path <<<"$entry")"
-          if [[ "$mode" != "160000" || "$type" != "commit" || "$path" != "fluxer_marketing" || ! "$gitlink_sha" =~ ^[0-9a-f]{40}$ ]]; then
-            echo "::error::Public parent does not contain a valid fluxer_marketing gitlink."
-            exit 1
-          fi
-
-          run="$(gh api "repos/$PUBLIC_REPOSITORY/actions/runs/$RUN_ID")"
-          [[ "$(jq -r .id <<<"$run")" == "$RUN_ID" ]]
-          [[ "$(jq -r .run_attempt <<<"$run")" == "$RUN_ATTEMPT" ]]
-          [[ "$(jq -r .event <<<"$run")" == "push" ]]
-          [[ "$(jq -r .head_sha <<<"$run")" == "$PARENT_SHA" ]]
-          run_created_at="$(jq -r .created_at <<<"$run")"
-          [[ "$run_created_at" =~ ^[1-9][0-9]{3}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$ ]]
-          run_created_epoch="$(date -u -d "$run_created_at" +%s)"
-          [[ "$run_created_epoch" =~ ^[1-9][0-9]*$ ]]
-          build_epoch=$((run_created_epoch + 10#$RUN_ATTEMPT - 1))
-          read -r year month day time_segment <<<"$(date -u -d "@$build_epoch" '+%Y %m %d %H%M%S')"
-          month="$((10#$month))"
-          micro="$((10#$time_segment))"
-          build_version="$year.$month$day.$micro"
-          [[ "$build_version" =~ ^[1-9][0-9]{3}\.[1-9][0-9]{2,3}\.([0-9]|[1-9][0-9]{0,5})$ ]]
-          correlation_id="public-${RUN_ID}-${RUN_ATTEMPT}"
-          [[ "$correlation_id" =~ ^[A-Za-z0-9._:-]{1,64}$ ]]
-          {
-            echo "parent_sha=$PARENT_SHA"
-            echo "gitlink_sha=$gitlink_sha"
-            echo "build_version=$build_version"
-            echo "correlation_id=$correlation_id"
-          } >>"$GITHUB_OUTPUT"
-
-  dispatch:
-    name: dispatch exact private build
-    needs: metadata
-    runs-on: ubuntu-24.04
-    timeout-minutes: 65
-    environment: private-marketing-dispatch
-    permissions: {}
-    steps:
-      - name: Validate trusted build inputs
-        env:
-          DISPATCH_ENABLED: ${{ vars.MARKETING_DISPATCH_ENABLED }}
-          EXPECTED_PARENT_SHA: ${{ github.sha }}
-          EXPECTED_CORRELATION_ID: public-${{ github.run_id }}-${{ github.run_attempt }}
-          PARENT_SHA: ${{ needs.metadata.outputs.parent_sha }}
-          GITLINK_SHA: ${{ needs.metadata.outputs.gitlink_sha }}
-          BUILD_VERSION: ${{ needs.metadata.outputs.build_version }}
-          CORRELATION_ID: ${{ needs.metadata.outputs.correlation_id }}
-        run: |
-          set -euo pipefail
-          [[ "$GITHUB_EVENT_NAME" == "push" ]]
-          [[ "$GITHUB_REF" == "refs/heads/main" ]]
-          [[ "$GITHUB_REPOSITORY" == "fluxerapp/fluxer" ]]
-          [[ "$PARENT_SHA" == "$EXPECTED_PARENT_SHA" ]]
-          [[ "$PARENT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$GITLINK_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$BUILD_VERSION" =~ ^[1-9][0-9]{3}\.[1-9][0-9]{2,3}\.([0-9]|[1-9][0-9]{0,5})$ ]]
-          [[ "$CORRELATION_ID" == "$EXPECTED_CORRELATION_ID" ]]
-          [[ "$CORRELATION_ID" =~ ^[A-Za-z0-9._:-]{1,64}$ ]]
-          if [[ "$DISPATCH_ENABLED" != "true" ]]; then
-            echo "::error::Private marketing dispatch is intentionally disabled until the package cutover guard completes."
-            exit 1
-          fi
-
-      - name: Create private dispatch token
-        id: private-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
-        with:
-          client-id: ${{ vars.FLUXER_CI_APP_ID }}
-          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
-          owner: fluxerapp
-          repositories: marketing
-          permission-actions: write
-
-      - name: Dispatch exact private build
-        env:
-          GH_TOKEN: ${{ steps.private-token.outputs.token }}
-          PARENT_SHA: ${{ needs.metadata.outputs.parent_sha }}
-          GITLINK_SHA: ${{ needs.metadata.outputs.gitlink_sha }}
-          BUILD_VERSION: ${{ needs.metadata.outputs.build_version }}
-          CORRELATION_ID: ${{ needs.metadata.outputs.correlation_id }}
-        run: |
-          set -euo pipefail
-          gh api --method POST repos/fluxerapp/marketing/actions/workflows/build-marketing.yaml/dispatches \
-            --field ref=main \
-            --field "inputs[parent_sha]=$PARENT_SHA" \
-            --field "inputs[gitlink_sha]=$GITLINK_SHA" \
-            --field "inputs[build_version]=$BUILD_VERSION" \
-            --field "inputs[correlation_id]=$CORRELATION_ID"
-
-      - name: Wait for private build conclusion
-        env:
-          GH_TOKEN: ${{ steps.private-token.outputs.token }}
-          PARENT_SHA: ${{ needs.metadata.outputs.parent_sha }}
-          GITLINK_SHA: ${{ needs.metadata.outputs.gitlink_sha }}
-          BUILD_VERSION: ${{ needs.metadata.outputs.build_version }}
-          CORRELATION_ID: ${{ needs.metadata.outputs.correlation_id }}
-        run: |
-          set -euo pipefail
-          expected_title="marketing-build correlation=$CORRELATION_ID parent=$PARENT_SHA gitlink=$GITLINK_SHA version=$BUILD_VERSION"
-          deadline=$((SECONDS + 3600))
-          run_id=""
-          while (( SECONDS < deadline )); do
-            runs="$(gh api "repos/fluxerapp/marketing/actions/workflows/build-marketing.yaml/runs?event=workflow_dispatch&per_page=100" --jq '[.workflow_runs[] | {id, event, display_title, status, conclusion}]')"
-            matches="$(jq --arg title "$expected_title" '[.[] | select(.event == "workflow_dispatch" and .display_title == $title)]' <<<"$runs")"
-            count="$(jq 'length' <<<"$matches")"
-            if [[ "$count" == "1" ]]; then
-              run_id="$(jq -r '.[0].id' <<<"$matches")"
-              break
-            fi
-            if [[ "$count" != "0" ]]; then
-              echo "::error::Private build correlation matched multiple workflow runs."
-              exit 1
-            fi
-            sleep 10
-          done
-          if [[ -z "$run_id" ]]; then
-            echo "::error::Timed out waiting for the private build dispatch to appear."
-            exit 1
-          fi
-          while (( SECONDS < deadline )); do
-            runs="$(gh api "repos/fluxerapp/marketing/actions/workflows/build-marketing.yaml/runs?event=workflow_dispatch&per_page=100" --jq '[.workflow_runs[] | {id, event, display_title, status, conclusion}]')"
-            matches="$(jq --arg title "$expected_title" '[.[] | select(.event == "workflow_dispatch" and .display_title == $title)]' <<<"$runs")"
-            if [[ "$(jq 'length' <<<"$matches")" != "1" || "$(jq -r '.[0].id' <<<"$matches")" != "$run_id" ]]; then
-              echo "::error::Private build correlation is missing or ambiguous."
-              exit 1
-            fi
-            run="$(jq '.[0]' <<<"$matches")"
-            status="$(jq -r '.status' <<<"$run")"
-            conclusion="$(jq -r '.conclusion // empty' <<<"$run")"
-            if [[ "$status" == "completed" ]]; then
-              if [[ "$conclusion" != "success" ]]; then
-                echo "::error::Private marketing build concluded with $conclusion."
-                exit 1
-              fi
-              echo "Private marketing build completed successfully."
-              exit 0
-            fi
-            sleep 15
-          done
-          echo "::error::Timed out waiting for the private marketing build."
-          exit 1
@@ -35,24 +35,24 @@ jobs:
          permission-pull-requests: write

      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          token: ${{ steps.create-token.outputs.token }}
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: "24"
+          node-version: "26"
          cache: "pnpm"

      - name: Install dependencies
@@ -40,7 +40,7 @@ jobs:
          permission-pull-requests: write

      - name: Checkout Weblate branch
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          token: ${{ steps.create-token.outputs.token }}
          ref: ${{ env.WEBLATE_BRANCH }}
@@ -48,17 +48,17 @@ jobs:
          persist-credentials: false

      - name: Set up Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: "24"
+          node-version: "26"
          cache: "pnpm"

      - name: Install dependencies
@@ -77,14 +77,14 @@ jobs:
          GH_TOKEN: ${{ steps.create-token.outputs.token }}
        run: |
          set -euo pipefail
-          if [[ -z "$(git status --porcelain -- fluxer_app/src/features/i18n/locales packages/i18n/marketing packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n)" ]]; then
+          if [[ -z "$(git status --porcelain -- fluxer_app/src/features/i18n/locales packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n)" ]]; then
            echo "No generated catalog changes."
            exit 0
          fi

          git config user.name "fluxer-ci[bot]"
          git config user.email "${{ vars.FLUXER_CI_APP_USER_ID }}+fluxer-ci[bot]@users.noreply.github.com"
-          git add fluxer_app/src/features/i18n/locales packages/i18n/marketing packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n
+          git add fluxer_app/src/features/i18n/locales packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n
          git commit -m "i18n: compile Weblate catalogs"
          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
          git push origin "HEAD:$WEBLATE_BRANCH"
@@ -19,7 +19,7 @@ jobs:
          permission-pull-requests: write

      - name: Label pull request
-        uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213
+        uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13
        with:
          repo-token: ${{ steps.create-token.outputs.token }}
          configuration-path: .github/labeller.yaml
@@ -56,15 +56,15 @@ jobs:
      contents: write
      packages: read
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -28,12 +28,12 @@ jobs:
      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

      - name: Restore ci helper
@@ -42,7 +42,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -55,16 +55,16 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -83,12 +83,12 @@ jobs:
      PNPM_TEST_WORKSPACE_CONCURRENCY: '2'
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

      - name: Restore ci helper
@@ -97,7 +97,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -105,12 +105,12 @@ jobs:
        run: cargo build --locked --package fluxer-ci

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -123,12 +123,16 @@ jobs:
        with:
          path: |
            fluxer_app/pkgs/libfluxcore
+            fluxer_app/pkgs/libfluxwebp
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'fluxer_app/rust/libfluxwebp/Cargo.toml', 'fluxer_app/rust/libfluxwebp/Cargo.lock',
+            'fluxer_app/rust/libfluxwebp/src/**', 'fluxer_app/rust/libfluxwebp/shim/**',
+            'fluxer_app/rust/libfluxwebp/simd/**',
            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
            'packages/markdown_parser/rust/src/**') }}

@@ -142,12 +146,16 @@ jobs:
        with:
          path: |
            fluxer_app/pkgs/libfluxcore
+            fluxer_app/pkgs/libfluxwebp
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'fluxer_app/rust/libfluxwebp/Cargo.toml', 'fluxer_app/rust/libfluxwebp/Cargo.lock',
+            'fluxer_app/rust/libfluxwebp/src/**', 'fluxer_app/rust/libfluxwebp/shim/**',
+            'fluxer_app/rust/libfluxwebp/simd/**',
            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
            'packages/markdown_parser/rust/src/**') }}

@@ -156,21 +164,21 @@ jobs:
    timeout-minutes: 45
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          components: clippy, rustfmt

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Cache cargo
@@ -185,11 +193,14 @@ jobs:
            rust-${{ runner.os }}-${{ hashFiles('fluxer_media_proxy/tools/install-native-deps.sh') }}-

      - name: Install cargo-deny
-        run: cargo install cargo-deny --version 0.19.6 --locked
+        run: cargo install cargo-deny --version 0.20.2 --locked

      - name: Check Rust dependencies
        run: cargo deny --locked check -D warnings

+      - name: Check libfluxwebp dependencies
+        run: cargo deny --manifest-path fluxer_app/rust/libfluxwebp/Cargo.toml --config deny.toml --locked check licenses bans sources
+
      - name: Check desktop native dependencies
        run: tools/ci/check-desktop-native-workspaces.sh dependencies

@@ -242,6 +253,9 @@ jobs:
      - name: Check formatting
        run: cargo fmt --all -- --check

+      - name: Check formatting (libfluxwebp)
+        run: cargo fmt --manifest-path fluxer_app/rust/libfluxwebp/Cargo.toml -- --check
+
      - name: Check formatting (desktop native workspaces)
        run: tools/ci/check-desktop-native-workspaces.sh fmt

@@ -273,12 +287,12 @@ jobs:
      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Cache cargo (gateway NIFs)
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
@@ -294,7 +308,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -305,7 +319,7 @@ jobs:
        uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124
        with:
          otp-version: '28'
-          rebar3-version: '3.24.0'
+          rebar3-version: '3.27.0'

      - name: Restore rebar3 dependencies
        id: rebar3-cache
@@ -317,10 +331,13 @@ jobs:
            !fluxer_gateway/_build/default/lib/fluxer_gateway/**
            !fluxer_gateway/_build/test/lib/fluxer_gateway/**
          key: >-
-            rebar3-${{ runner.os }}-otp28-rebar3.24.0-${{ hashFiles('fluxer_gateway/rebar.lock',
+            rebar3-${{ runner.os }}-otp28-rebar3.27.0-${{ hashFiles('fluxer_gateway/rebar.lock',
            'fluxer_gateway/rebar.config') }}
          restore-keys: |
-            rebar3-${{ runner.os }}-otp28-rebar3.24.0-
+            rebar3-${{ runner.os }}-otp28-rebar3.27.0-
+
+      - name: Drop restored gateway build output
+        run: rm -rf fluxer_gateway/_build/default/lib/fluxer_gateway fluxer_gateway/_build/test/lib/fluxer_gateway

      - name: Check formatting
        run: |
@@ -348,7 +365,7 @@ jobs:
            !fluxer_gateway/_build/default/lib/fluxer_gateway/**
            !fluxer_gateway/_build/test/lib/fluxer_gateway/**
          key: >-
-            rebar3-${{ runner.os }}-otp28-rebar3.24.0-${{ hashFiles('fluxer_gateway/rebar.lock',
+            rebar3-${{ runner.os }}-otp28-rebar3.27.0-${{ hashFiles('fluxer_gateway/rebar.lock',
            'fluxer_gateway/rebar.config') }}

  knip:
@@ -358,12 +375,12 @@ jobs:
      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

      - name: Restore ci helper
@@ -372,7 +389,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -380,12 +397,12 @@ jobs:
        run: cargo build --locked --package fluxer-ci

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -398,12 +415,16 @@ jobs:
        with:
          path: |
            fluxer_app/pkgs/libfluxcore
+            fluxer_app/pkgs/libfluxwebp
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'fluxer_app/rust/libfluxwebp/Cargo.toml', 'fluxer_app/rust/libfluxwebp/Cargo.lock',
+            'fluxer_app/rust/libfluxwebp/src/**', 'fluxer_app/rust/libfluxwebp/shim/**',
+            'fluxer_app/rust/libfluxwebp/simd/**',
            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
            'packages/markdown_parser/rust/src/**') }}

@@ -417,12 +438,16 @@ jobs:
        with:
          path: |
            fluxer_app/pkgs/libfluxcore
+            fluxer_app/pkgs/libfluxwebp
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'fluxer_app/rust/libfluxwebp/Cargo.toml', 'fluxer_app/rust/libfluxwebp/Cargo.lock',
+            'fluxer_app/rust/libfluxwebp/src/**', 'fluxer_app/rust/libfluxwebp/shim/**',
+            'fluxer_app/rust/libfluxwebp/simd/**',
            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
            'packages/markdown_parser/rust/src/**') }}

@@ -431,15 +456,15 @@ jobs:
    timeout-minutes: 15
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -456,15 +481,15 @@ jobs:
    timeout-minutes: 25
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -490,15 +515,15 @@ jobs:
    timeout-minutes: 15
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -515,12 +540,12 @@ jobs:
    timeout-minutes: 10
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
-          python-version: "3.13"
+          python-version: "3.14"

      - name: Install font tooling
        run: python3 -m pip install -r tools/fonts/requirements.txt
@@ -10,6 +10,7 @@
 /.direnv/
 /.fluxer/
 /.pnpm-store/
+/.vscode/

 **/*.css.d.ts
 **/*.tsbuildinfo
@@ -25,6 +26,7 @@

 /fluxer_app/.devserver-cache.json
 /fluxer_app/pkgs/libfluxcore/
+/fluxer_app/pkgs/libfluxwebp/
 /fluxer_app/src/features/i18n/locales/*/messages.mjs
 /fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
 /fluxer_app/src/features/theme/styles/generated/
@@ -1,4 +0,0 @@
-[submodule "fluxer_marketing"]
-	path = fluxer_marketing
-	url = https://github.com/fluxerapp/marketing.git
-	update = none
@@ -7,9 +7,9 @@ members = [
 	"fluxer_gifs",
 	"fluxer_svc",
 	"fluxer_messages",
+	"fluxer_push",
 	"fluxer_snowflakes",
 	"tools/ci",
-	"tools/content/update-frozen-snapshot",
 	"tools/dev",
 	"tools/i18n_auto",
 	"fluxer_users",
@@ -17,7 +17,6 @@ members = [
 	"packages/markdown_parser/rust",
 ]
 exclude = [
-	"fluxer_marketing",
 	"packages/markdown_parser/rust/fuzz",
 ]
 resolver = "2"
@@ -6,18 +6,173 @@
 </p>

 <p align="center">
-  <a href="https://fluxer.app/donate">
-    <img src="https://img.shields.io/badge/Donate-fluxer.app%2Fdonate-brightgreen" alt="Donate" /></a>
+  <a href="https://fluxer.app/download">
+    <img src="https://img.shields.io/badge/Download-fluxer.app-4641D9" alt="Download" /></a>
  <a href="https://docs.fluxer.app">
    <img src="https://img.shields.io/badge/Docs-docs.fluxer.app-blue" alt="Documentation" /></a>
+  <a href="https://fluxer.app/donate">
+    <img src="https://img.shields.io/badge/Donate-fluxer.app%2Fdonate-brightgreen" alt="Donate" /></a>
  <a href="./LICENSE">
    <img src="https://img.shields.io/badge/License-AGPLv3-purple" alt="AGPLv3 License" /></a>
 </p>

+<p align="center">
+  <a href="https://flathub.org/apps/app.fluxer.Fluxer">
+    <img src="https://dl.flathub.org/assets/badges/flathub-badge-en.svg" alt="Get it on Flathub" height="60" /></a>
+</p>
+
 # Fluxer

 Fluxer is a free and open source instant messaging and VoIP chat app built for friends, groups, and communities.

 <p align="center">
-  <img src="./fluxer_static/marketing/screenshots/desktop-readme-1920w.png" alt="Fluxer app showcase" width="900">
+  <img src="./fluxer_static/marketing/screenshots/desktop-readme-1920w.png" alt="Fluxer running side by side on a desktop monitor and a phone" width="640">
 </p>
+
+## Download
+
+| Windows | macOS | Linux | Android | iOS |
+| --- | --- | --- | --- | --- |
+| [Installer (x64)][win-setup-x64] | [Disk image][mac-dmg] | [Flathub][flathub] | [Google Play (beta)][android-play] | [TestFlight][ios-testflight] |
+| [Installer (ARM64)][win-setup-arm64] | | [deb (x64)][linux-deb-x64] | [APK (beta)][android-apk] | |
+| [Portable (x64)][win-portable-x64] | | [deb (ARM64)][linux-deb-arm64] | [Obtainium (beta)][obtainium] | |
+| [Portable (ARM64)][win-portable-arm64] | | [rpm (x64)][linux-rpm-x64] | | |
+| | | [rpm (ARM64)][linux-rpm-arm64] | | |
+| | | [AppImage (x64)][linux-appimage-x64] | | |
+| | | [AppImage (ARM64)][linux-appimage-arm64] | | |
+| | | [tar.gz (x64)][linux-targz-x64] | | |
+| | | [tar.gz (ARM64)][linux-targz-arm64] | | |
+
+The macOS disk image runs on both Apple silicon and Intel. Windows and Linux need the build matching your processor.
+
+On Linux, prefer a repository over a single file so Fluxer updates with the rest of your system.
+
+## Linux package repositories
+
+The package is `fluxer` for stable and `fluxer-canary` for canary. apt and dnf subscribe to one channel per entry file. pacman and Flatpak serve both from one repository.
+
+### Flatpak
+
+Stable is on [Flathub][flathub], the easiest route on most desktops:
+
+```sh
+flatpak install flathub app.fluxer.Fluxer
+```
+
+Flathub has stable only. To use Fluxer's own repository, open [the stable][flatpak-ref] or [the canary][flatpak-canary-ref] reference file and your software manager takes over. Some desktops also accept `flatpak+https://pkgs.fluxer.com/flatpak/fluxer.flatpakref` in the address bar.
+
+From a terminal:
+
+```sh
+flatpak install https://pkgs.fluxer.com/flatpak/fluxer.flatpakref
+```
+
+### Debian and Ubuntu
+
+```sh
+sudo install -d -m 0755 /etc/apt/keyrings
+sudo curl -fsSL -o /etc/apt/keyrings/fluxer-archive-keyring.gpg https://pkgs.fluxer.com/keys/fluxer-archive-keyring.gpg
+sudo curl -fsSL -o /etc/apt/sources.list.d/fluxer.sources https://pkgs.fluxer.com/deb/fluxer.sources
+sudo apt update && sudo apt install fluxer
+```
+
+For canary, use the canary entry file and package.
+
+```sh
+sudo curl -fsSL -o /etc/apt/sources.list.d/fluxer-canary.sources https://pkgs.fluxer.com/deb/fluxer-canary.sources
+sudo apt update && sudo apt install fluxer-canary
+```
+
+A `.deb` installed from a download only updates once its channel's entry is added.
+
+### Fedora and RHEL
+
+```sh
+sudo curl -fsSL -o /etc/yum.repos.d/fluxer.repo https://pkgs.fluxer.com/rpm/fluxer.repo
+sudo dnf install fluxer
+```
+
+For canary, use the canary entry file and package.
+
+```sh
+sudo curl -fsSL -o /etc/yum.repos.d/fluxer-canary.repo https://pkgs.fluxer.com/rpm/fluxer-canary.repo
+sudo dnf install fluxer-canary
+```
+
+RHEL, Rocky, Alma and CentOS Stream need `sudo dnf install epel-release` first, because their base repositories lack `libXScrnSaver`. Fedora does not.
+
+### Arch Linux
+
+The repository is signed, so pacman needs the key once:
+
+```sh
+sudo pacman-key --init
+curl -fsSL -o /tmp/fluxer-archive-keyring.asc https://pkgs.fluxer.com/keys/fluxer-archive-keyring.asc
+sudo pacman-key --add /tmp/fluxer-archive-keyring.asc
+sudo pacman-key --lsign-key 09D01339EE128925F75E675C855C5BDE34D205D2
+```
+
+`--lsign-key` is what makes pacman trust it. Then add the repository:
+
+```sh
+sudo tee -a /etc/pacman.conf >/dev/null <<'REPO'
+
+[fluxer]
+SigLevel = Required TrustedOnly
+Server = https://pkgs.fluxer.com/arch/$repo/os/$arch
+REPO
+sudo pacman -Syu fluxer
+```
+
+Write `$repo` and `$arch` literally. Both are pacman variables, not shell ones, hence the quoted heredoc.
+
+Full setup notes, including canary, are in the [Linux repositories documentation][docs-linux].
+
+## Other ways to run it
+
+- [Open Fluxer in a browser](https://web.fluxer.app), no install needed.
+- [Host your own instance][docs-selfhost] from this repository.
+
+## Documentation
+
+- [Documentation home][docs]
+- [Downloads][docs-downloads]
+- [Self-hosting][docs-selfhost]
+
+## License
+
+The source is licensed under the [AGPL-3.0-or-later](./LICENSE) license.
+
+Fluxer branding, icons, default avatars, badge artwork, screenshots and marketing
+imagery are copyright Fluxer, all rights reserved, as set out in
+[fluxer_static/LICENSE](./fluxer_static/LICENSE). Third-party material keeps its own
+terms, listed in
+[fluxer_static/THIRD_PARTY_LICENSES.md](./fluxer_static/THIRD_PARTY_LICENSES.md).
+
+Public availability of this repository does not grant trademark, brand, or
+endorsement rights.
+
+[win-setup-x64]: https://pkgs.fluxer.com/desktop/stable/win32/x64/latest/setup
+[win-setup-arm64]: https://pkgs.fluxer.com/desktop/stable/win32/arm64/latest/setup
+[win-portable-x64]: https://pkgs.fluxer.com/desktop/stable/win32/x64/latest/portable
+[win-portable-arm64]: https://pkgs.fluxer.com/desktop/stable/win32/arm64/latest/portable
+[mac-dmg]: https://pkgs.fluxer.com/desktop/stable/darwin/arm64/latest/dmg
+[linux-deb-x64]: https://pkgs.fluxer.com/desktop/stable/linux/x64/latest/deb
+[linux-deb-arm64]: https://pkgs.fluxer.com/desktop/stable/linux/arm64/latest/deb
+[linux-rpm-x64]: https://pkgs.fluxer.com/desktop/stable/linux/x64/latest/rpm
+[linux-rpm-arm64]: https://pkgs.fluxer.com/desktop/stable/linux/arm64/latest/rpm
+[linux-appimage-x64]: https://pkgs.fluxer.com/desktop/stable/linux/x64/latest/appimage
+[linux-appimage-arm64]: https://pkgs.fluxer.com/desktop/stable/linux/arm64/latest/appimage
+[linux-targz-x64]: https://pkgs.fluxer.com/desktop/stable/linux/x64/latest/tar_gz
+[linux-targz-arm64]: https://pkgs.fluxer.com/desktop/stable/linux/arm64/latest/tar_gz
+[flatpak-ref]: https://pkgs.fluxer.com/flatpak/fluxer.flatpakref
+[flatpak-canary-ref]: https://pkgs.fluxer.com/flatpak/fluxer-canary.flatpakref
+[flathub]: https://flathub.org/apps/app.fluxer.Fluxer
+[android-play]: https://play.google.com/store/apps/details?id=com.fluxer
+[android-apk]: https://github.com/fluxerapp/flutter_client/releases
+[obtainium]: https://obtainium.imranr.dev/
+[ios-testflight]: https://testflight.apple.com/join/PKZR6pK9
+[docs]: https://docs.fluxer.app
+[docs-downloads]: https://docs.fluxer.app/downloads/overview/
+[docs-linux]: https://docs.fluxer.app/downloads/linux-repositories/
+[docs-selfhost]: https://docs.fluxer.app/operator/get-started/
@@ -48,7 +48,7 @@
 	"linter": {
 		"enabled": true,
 		"rules": {
-			"recommended": true,
+			"preset": "recommended",
 			"complexity": {
 				"noForEach": "off",
 				"noImportantStyles": "off",
@@ -83,6 +83,7 @@
 					}
 				},
 				"useConst": "error",
+				"noDescendingSpecificity": "off",
 				"noNonNullAssertion": "off",
 				"noParameterAssign": "off",
 				"noRestrictedImports": {
@@ -98,7 +99,7 @@
 				}
 			},
 			"a11y": {
-				"recommended": true,
+				"preset": "recommended",
 				"useAriaPropsForRole": "error",
 				"useValidAriaRole": "error",
 				"useValidAriaValues": "error",
@@ -34,7 +34,6 @@ FLUXER_KV_URL=redis://valkey:6379/0
 FLUXER_NATS_URL=nats://nats:4222
 FLUXER_NATS_JETSTREAM_URL=nats://nats:4222
 FLUXER_INTERNAL_API_ENDPOINT=http://127.0.0.1:8080
-FLUXER_INTERNAL_GATEWAY_ENDPOINT=http://127.0.0.1:8771
 FLUXER_INTERNAL_MEDIA_PROXY_ENDPOINT=http://127.0.0.1:8082
 FLUXER_MEDIA_PROXY_ENDPOINT=http://127.0.0.1:8082
 FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT=http://localhost:8088/media
@@ -42,7 +41,6 @@ FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT=http://localhost:8088/media
 FLUXER_SVC_NATS_URL=nats://nats:4222
 FLUXER_SVC_SHARD_COUNT=1
 FLUXER_SVC_CACHE_TTL_MS=30000
-FLUXER_SVC_CACHE_HARD_TTL_MS=600000

 FLUXER_S3_ENDPOINT=http://127.0.0.1:8333
 FLUXER_S3_PUBLIC_ENDPOINT=http://localhost:8088
@@ -52,7 +50,6 @@ FLUXER_S3_SECRET_ACCESS_KEY=fluxer-secret
 FLUXER_S3_FORCE_PATH_STYLE=true
 FLUXER_S3_BUCKET_CDN=fluxer
 FLUXER_S3_BUCKET_UPLOADS=fluxer-uploads
-FLUXER_S3_BUCKET_DOWNLOADS=fluxer-downloads
 FLUXER_S3_BUCKET_REPORTS=fluxer-reports
 FLUXER_S3_BUCKET_HARVESTS=fluxer-harvests
 FLUXER_S3_BUCKET_STATIC=fluxer-static
@@ -62,13 +59,11 @@ FLUXER_LIVEKIT_URL=ws://localhost:8088/livekit
 FLUXER_LIVEKIT_INTERNAL_URL=http://localhost:7880
 FLUXER_LIVEKIT_API_KEY=devkey
 FLUXER_LIVEKIT_API_SECRET=fluxer-livekit-development-secret
-FLUXER_LIVEKIT_WEBHOOK_URL=http://localhost:8088/api/webhooks/livekit
 FLUXER_LIVEKIT_DEFAULT_REGION={"id":"local","name":"Local","emoji":"LC","latitude":59.3293,"longitude":18.0686}

 FLUXER_API_PORT=8080
 FLUXER_API_PRESIGNED_ATTACHMENT_UPLOADS_ENABLED=true
 FLUXER_API_WORKER_MODE=all_lanes
-FLUXER_API_WORKER_ENABLE_VOICE_RECONCILIATION=true
 FLUXER_APP_DEV_PORT=3000
 FLUXER_APP_PROXY_PORT=8773
 FLUXER_STATIC_DIR=fluxer_app/dist
@@ -91,10 +86,6 @@ FLUXER_ADMIN_BASE_PATH=/admin
 FLUXER_ADMIN_SECRET_KEY_BASE=dev-admin-secret-key-base
 FLUXER_ADMIN_OAUTH_CLIENT_SECRET=dev-admin-oauth-secret
 FLUXER_ADMIN_OAUTH_REDIRECT_URI=http://localhost:8088/admin/oauth2_callback
-FLUXER_MARKETING_PORT=3010
-FLUXER_MARKETING_HOST=0.0.0.0
-FLUXER_MARKETING_BASE_PATH=/marketing
-FLUXER_MARKETING_SECRET_KEY_BASE=dev-marketing-secret-key-base

 FLUXER_SUDO_MODE_SECRET=dev-sudo-secret
 FLUXER_CONNECTION_INITIATION_SECRET=dev-connection-initiation-secret
@@ -113,9 +104,6 @@ FLUXER_EMAIL_SMTP_PORT=1025
 FLUXER_EMAIL_SMTP_USERNAME=dev
 FLUXER_EMAIL_SMTP_PASSWORD=dev
 FLUXER_EMAIL_SMTP_SECURE=false
-FLUXER_SMS_ENABLED=false
-FLUXER_CAPTCHA_ENABLED=false
-FLUXER_CAPTCHA_PROVIDER=none
 FLUXER_SEARCH_ENGINE=meilisearch
 FLUXER_SEARCH_URL=http://meilisearch:7700
 FLUXER_SEARCH_API_KEY=fluxer-dev-meilisearch
@@ -135,7 +123,5 @@ PUBLIC_RELEASE_CHANNEL=canary
 PUBLIC_BOOTSTRAP_API_ENDPOINT=/api
 PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT=http://localhost:8088/api
 FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64=Zmx1eGVyLWRldi11cGxvYWQtcmVsYXktc2VjcmV0LTAwMDA=
+FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64=Zmx1eGVyLWRldi1hdHRhY2htZW50LXVybC1zZWNyZXQ=
 AWS_EC2_METADATA_DISABLED=true
-AWS_ACCESS_KEY_ID=fluxer
-AWS_SECRET_ACCESS_KEY=fluxer-secret
-AWS_DEFAULT_REGION=us-east-1
@@ -79,34 +79,42 @@ deny = [
    { crate = "fuse-sys", reason = "libfuse2 FFI crate; Fluxer AppImages must not reintroduce libfuse2 through native Rust dependencies" },
 ]
 skip = [
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older crypto API" },
-    { crate = "[email protected].7", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected].6", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
-    { crate = "[email protected]", reason = "transitive dependency requires the older hashbrown API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older hashbrown API" },
-    { crate = "[email protected]", reason = "transitive dependency requires the older hashbrown API" },
-    { crate = "[email protected]", reason = "transitive dependency requires the prior hashbrown API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
    { crate = "[email protected]", reason = "transitive dependency requires the older HTTP API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older HTTP body API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
    { crate = "[email protected]", reason = "transitive dependency requires the older WASI API" },
-    { crate = "[email protected].6", reason = "transitive dependency requires the older randomness API" },
-    { crate = "[email protected].4", reason = "transitive dependency requires the prior randomness API" },
+    { crate = "[email protected].8", reason = "transitive dependency requires the older randomness API" },
+    { crate = "[email protected].5", reason = "transitive dependency requires the prior randomness API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
-    { crate = "[email protected].6", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected].7", reason = "transitive dependency requires the older digest API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
-    { crate = "s[email protected]0", reason = "transitive dependency requires the older socket API" },
+    { crate = "s[email protected].0", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
    { crate = "[email protected]+wasi-snapshot-preview1", reason = "transitive dependency requires the legacy WASI API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
    { crate = "[email protected]", reason = "transitive dependency requires the older Windows API" },
-    { crate = "[email protected]", reason = "transitive dependency requires the prior Windows API" },
-    { crate = "[email protected]", reason = "transitive dependency requires the older WASI binding API" },
 ]
 skip-tree = []

@@ -1,114 +1,66 @@
-# Every variable docker-compose.yml reads from this file is named here:
-# uncommented when it has no default, commented with its default when it has one.
-# A name absent from this file is one Compose does not forward, and it reaches a
-# service only through a Compose override file that adds it to that service's
-# environment. packages/config/src/__tests__/DeployEnvCoverage.test.ts fails when
-# a Compose edit forgets the matching line here. Compose expands this file from
-# top to bottom, so a line written with ${...} has to sit below every name it
-# reads.
+# Every variable docker-compose.yml reads. A value an install must set is
+# uncommented. A commented line shows the default, or an example where its comment
+# says so, and nothing after = means the service decides. An empty value keeps the
+# default too. Compose expands top to bottom, so a line using ${...} must sit below
+# every name it reads.

 FLUXER_DOMAIN=chat.example.com
 FLUXER_PUBLIC_SCHEME=https
 FLUXER_PUBLIC_PORT=443

-# The three lines above are the address browsers use, and every endpoint the
-# services advertise carries the port from FLUXER_PUBLIC_PORT. They do not move
-# what the host publishes. FLUXER_HTTP_PORT and FLUXER_HTTPS_PORT further down
-# do that, and a non-default port needs the matching one set as well. Both
-# complete recipes are written out beside them.
+# The address browsers use. FLUXER_HTTP_PORT and FLUXER_HTTPS_PORT below decide
+# which host ports Fluxer binds.

-# How browsers reach this instance.
-#
-# Default: Fluxer binds 80 and 443 and gets its own Let's Encrypt certificate.
-# Point DNS at this host and there is nothing else to configure.
-#
-# Behind your own reverse proxy (nginx, Traefik, HAProxy, Cloudflare Tunnel,
-# another Caddy): uncomment COMPOSE_FILE below. Fluxer then serves plain HTTP on
-# 127.0.0.1:8080 instead, and your proxy forwards everything to it. Keep
-# FLUXER_PUBLIC_SCHEME and FLUXER_PUBLIC_PORT describing the PUBLIC address your
-# proxy serves, not this local port.
+# By default Fluxer binds 80 and 443 and gets its own certificate. Point DNS here.
+# Behind your own reverse proxy, uncomment this instead: Fluxer then serves plain
+# HTTP on 127.0.0.1:8080. Keep the scheme and port above describing the public
+# address, not this one.
 #COMPOSE_FILE=docker-compose.yml:docker-compose.proxy.yml

-# Where the plain-HTTP port binds when the proxy overlay is in use. Leave it on
-# loopback when the proxy runs on this host. Use 0.0.0.0:8080 only when the proxy
-# is on another machine, and firewall the port to that machine.
+# Where that plain-HTTP port binds. Use 0.0.0.0:8080 only when the proxy is on
+# another machine, and firewall it to that machine.
 #FLUXER_EDGE_BIND=127.0.0.1:8080

-# Which upstream hops may set X-Forwarded-For. Fluxer rewrites the header from
-# this to the real client address, so IP bans, rate limits and abuse detection
-# see the caller rather than the proxy. The default covers proxies on private or
-# loopback addresses, which is every same-host setup. Set it to your proxy's
-# address if it reaches Fluxer from a public IP.
+# Which hops may set X-Forwarded-For. The default covers private and loopback
+# addresses. Set your proxy's address if it reaches Fluxer from a public IP.
 #FLUXER_EDGE_TRUSTED_PROXIES=private_ranges

-# The origin browsers see, without a trailing slash. Leave it unset and each
-# service builds one from the three values at the top of this file. Set it and it
-# wins: every service reads the host, the scheme and the port out of it and
-# ignores those three names. Use it when browsers reach the instance on a host
-# FLUXER_DOMAIN does not name. It has to be a bare origin, a scheme and a host
-# and an optional port and nothing after them, or the services refuse to start.
-# It does not move the edge listener or the published ports either, so set the
-# publish below to the port written here.
+# The origin browsers see, no trailing slash. Set it when browsers reach the
+# instance on a host FLUXER_DOMAIN does not name, and it wins over the three
+# values above. Scheme, host and optional port only. It does not move the
+# published ports.
 #FLUXER_PUBLIC_ORIGIN=https://chat.example.com

-# Overrides the address the edge listens on inside its container. Compose builds
-# it from FLUXER_PUBLIC_SCHEME and FLUXER_DOMAIN with no port, and the edge keeps
-# its container ports at 80 and 443 whatever the public port is. Caddy matches a
-# site by host and ignores the port in the Host header, so a request arriving on
-# a non-default published port still lands on this site. Put a port in this value
-# only if you also publish that same container port below, or nothing will be
-# listening where the publish points. Honoured in the default mode only:
-# docker-compose.proxy.yml sets the literal :8080 and tunnel.compose.yml the
-# literal :80, and Compose lets the last file win, so a value here is discarded
-# under either overlay with no warning. Set it for an unusual default-mode
-# layout, such as serving several hostnames. Write the scheme into it: a bare
-# hostname means automatic HTTPS on 443 whatever FLUXER_PUBLIC_SCHEME says.
+# The address the edge listens on inside its container. Both proxy overlays set
+# this themselves, so a value here is ignored under either. Include the scheme.
 #FLUXER_EDGE_SITE_ADDRESS=https://chat.example.com

-# The old name for the value above. It is read only when
-# FLUXER_EDGE_SITE_ADDRESS is unset, so an existing .env keeps the listener
-# it already had. Rename it to FLUXER_EDGE_SITE_ADDRESS at your convenience.
+# The old name for the line above, read only when it is unset.
 #FLUXER_CADDY_SITE_ADDRESS=

-# Host side of the edge's publishes, and the only two names that decide which
-# host ports Fluxer binds. The container side is fixed. Container 80 carries the
-# HTTP to HTTPS redirect and the Let's Encrypt HTTP challenge under an https
-# scheme, and the site itself under an http one. Container 443 carries the TLS
-# site. FLUXER_HTTPS_PORT moves the TCP and the UDP publish together, because
-# HTTP/3 needs both on the same port. Both take an optional bind address in front
-# of the port, and 127.0.0.1 keeps the publish off every public interface. Give
-# them different host ports: the same host port on both is two publishes of one
-# port and the edge refuses to start.
+# Host ports. Container 80 handles the redirect and the certificate challenge,
+# container 443 the TLS site. FLUXER_HTTPS_PORT moves TCP and UDP together, since
+# HTTP/3 needs both. Both accept a bind address. Give them different host ports.
 #FLUXER_HTTP_PORT=80
 #FLUXER_HTTPS_PORT=443
 #FLUXER_HTTP_PORT=127.0.0.1:80
 #FLUXER_HTTPS_PORT=127.0.0.1:443

-# HTTPS on 8443, complete. Host 80 stays published and still answers the ACME
-# challenge. Let's Encrypt only ever connects to the public 80 or 443, so the
-# certificate is issued if a router in front forwards public 80 to this host and
-# is not issued otherwise. Serve your own certificate from the Caddyfile when it
-# cannot.
+# HTTPS on 8443. Host 80 stays published for the certificate challenge, which
+# only ever arrives on public 80 or 443. Serve your own certificate if nothing
+# forwards those.
 #FLUXER_PUBLIC_PORT=8443
 #FLUXER_HTTPS_PORT=8443

-# Plain HTTP on 19080, complete. The port 80 publish moves to 19080, so nothing
-# binds host 80. Under an http scheme nothing listens on container 443, so the
-# last line parks that publish on loopback for a host that wants 443 for
-# something else. Drop it and 443 is published and idle, which is what earlier
-# releases did.
+# Plain HTTP on 19080. Nothing binds host 80, and the last line parks the idle
+# 443 publish on loopback.
 #FLUXER_PUBLIC_SCHEME=http
 #FLUXER_PUBLIC_PORT=19080
 #FLUXER_HTTP_PORT=19080
 #FLUXER_HTTPS_PORT=127.0.0.1:443

-# A tunnel or another proxy in front of the stack needs no HTTPS publish at all.
-# tunnel.compose.yml ships beside this file and replaces Caddy's published ports
-# with a single loopback HTTP publish, so nothing binds 443, and points the edge
-# at plain HTTP on that publish so it stops redirecting to https. FLUXER_HTTP_PORT
-# still moves that one publish. Set the line below and plain docker compose
-# commands pick the file up, or add it to your own -f flags if you pass any. The
-# file uses the !override tag, which needs Compose 2.24.4 or newer.
+# A tunnel needs no HTTPS publish. tunnel.compose.yml ships beside this file and
+# leaves one loopback HTTP publish. Needs Compose 2.24.4 or newer.
 #COMPOSE_FILE=docker-compose.yml:tunnel.compose.yml

 FLUXER_REGISTRY_OWNER=fluxerapp
@@ -117,11 +69,10 @@ FLUXER_IMAGE_TAG=v1

 POSTGRES_PASSWORD=CHANGE_ME
 MEILI_MASTER_KEY=CHANGE_ME
-# The stack ships its own Postgres and its own object store, and points at both
-# by service name. Set these to run either one outside the stack. Leave them
-# unset and the bundled services are used. Taking a service out of the stack
-# means an upgrade skips the backup step that reaches into it, and backing that
-# store up belongs to whoever runs it.
+# Set these to run Postgres or the object store outside the stack. Backing up a
+# store you moved out is yours to arrange. An upgrade dumps the bundled postgres
+# service and skips the dump only when the stack defines none. The values below
+# are examples.
 #FLUXER_POSTGRES_HOST=db.example.com
 #FLUXER_POSTGRES_PORT=5432
 #FLUXER_POSTGRES_DATABASE=fluxer
@@ -131,45 +82,101 @@ MEILI_MASTER_KEY=CHANGE_ME
 #FLUXER_S3_PUBLIC_ENDPOINT=https://cdn.example.com
 #FLUXER_S3_REGION=eu-central-1
 #FLUXER_S3_FORCE_PATH_STYLE=false
-# Bucket names. The bundled object store creates whichever names these hold, so
-# the two stay in step. An object store outside the stack needs the buckets to
+
+# Bucket names. The bundled store creates these. An outside store needs them to
 # exist already.
 #FLUXER_S3_BUCKET_CDN=fluxer
 #FLUXER_S3_BUCKET_UPLOADS=fluxer-uploads
-#FLUXER_S3_BUCKET_DOWNLOADS=fluxer-downloads
 #FLUXER_S3_BUCKET_REPORTS=fluxer-reports
 #FLUXER_S3_BUCKET_HARVESTS=fluxer-harvests
+# With the object store outside the stack, add this overlay to COMPOSE_FILE and
+# the bundled seaweedfs no longer starts. Put it after any other overlay, such as
+# docker-compose.yml:docker-compose.proxy.yml:external-object-store.compose.yml.
+# Needs Compose 2.24.4 or newer.
+#COMPOSE_FILE=docker-compose.yml:external-object-store.compose.yml

-# The rest of the bundled services, pointed somewhere else the same way. Leave a
-# line unset and the service in the stack is used. Taking a service out of the
-# stack goes in an override file listed in COMPOSE_FILE, because an upgrade
-# replaces docker-compose.yml.
+# A full connection URL wins over the host, port and database above. The URL is an
+# example. The CA is the PEM text of the certificate, with \n for line breaks.
+#FLUXER_POSTGRES_URL=postgres://fluxer:[email protected]:5432/fluxer
+#FLUXER_POSTGRES_SSL_CA=
+# The Postgres table that holds the key-value store.
+#FLUXER_POSTGRES_KV_TABLE=fluxer_kv
+# media-proxy reads through these when the store serves reads from another
+# address or bucket.
+#FLUXER_S3_READ_ENDPOINT=
+#FLUXER_S3_READ_BUCKET=
+#FLUXER_S3_READ_BUCKET_STYLE=
+# A temporary S3 session token, read by media-proxy only.
+#FLUXER_S3_SESSION_TOKEN=
+# The bundled store refuses unsigned reads. Set false only for a public-read bucket.
+#FLUXER_S3_READ_SIGNED=true
+
+# The other bundled services, pointed elsewhere. Removing a service from the
+# stack belongs in an override file, since an upgrade replaces docker-compose.yml.
+# The URLs below are examples.
 #FLUXER_KV_URL=redis://cache.example.com:6379/0
 #FLUXER_NATS_URL=nats://mq.example.com:4222
 #FLUXER_NATS_JETSTREAM_URL=nats://mq.example.com:4222
 #FLUXER_SVC_NATS_URL=nats://mq.example.com:4222
 #FLUXER_SEARCH_URL=https://search.example.com
 #FLUXER_LIVEKIT_INTERNAL_URL=http://livekit.example.com:7880
+# How the stack talks to those services.
+#FLUXER_KV_MODE=standalone
+#FLUXER_SEARCH_ENGINE=meilisearch
+#FLUXER_SEARCH_USERNAME=
+#FLUXER_SEARCH_PASSWORD=
+#FLUXER_SEARCH_TLS_REJECT_UNAUTHORIZED=true

-# Voice off. The livekit service still runs until an override file takes it out.
+# Voice off. The livekit service still runs until an override removes it.
 #FLUXER_LIVEKIT_ENABLED=false

-# Optional systems, each off unless the instance is configured for it.
-#FLUXER_SMS_ENABLED=false
+# Optional systems, each off unless configured.
 #FLUXER_STRIPE_ENABLED=false
-#FLUXER_NCMEC_ENABLED=false
-#FLUXER_CLAMAV_ENABLED=false
+#FLUXER_STRIPE_SECRET_KEY=
+#FLUXER_STRIPE_WEBHOOK_SECRET=
+# Stripe prices as one JSON object. The admin dashboard can set them instead.
+#FLUXER_STRIPE_PRICES={}
+#FLUXER_STRIPE_LEGACY_PRICES={}
+#FLUXER_API_DONATION_PROXY_KEY=
+#FLUXER_VISIONARIES_GUILD_ID=
+#FLUXER_VISIONARIES_GUILD_VISIONARY_ROLE_ID=

-# The client address. Set the header name a proxy in front actually writes, and
-# turn the trust off when nothing sits in front, because a trusted header an
-# attacker can set is a spoofed client address.
-#FLUXER_CLIENT_IP_HEADER_NAME=cf-connecting-ip
+# NCMEC CyberTipline reporting, off by default. All four values are required
+# once it is on. The values below are examples.
+#FLUXER_NCMEC_ENABLED=true
+#FLUXER_NCMEC_BASE_URL=https://report.cybertip.org/ispws
+#FLUXER_NCMEC_USERNAME=
+#FLUXER_NCMEC_PASSWORD=
+#[email protected]
+
+# Upload virus scanning, off by default. No ClamAV container ships, so point
+# this at your own. The values below are examples.
+#FLUXER_CLAMAV_ENABLED=true
+#FLUXER_CLAMAV_HOST=clamav
+#FLUXER_CLAMAV_PORT=3310
+#FLUXER_CLAMAV_FAIL_OPEN=false
+
+# Outside lookups, off unless turned on. The breached password check asks
+# api.pwnedpasswords.com.
+#FLUXER_BREACHED_PASSWORD_CHECK_ENABLED=false
+#FLUXER_BLOCKLIST_FEEDS_ENABLED=false
+# A local path, or an s3:// URL read with the S3 credentials of this file.
+#FLUXER_GEOIP_DB_PATH=
+
+# The client address. The edge sets X-Forwarded-For on every hop, so keep the
+# trust on and the default header. Turning the trust off makes the api refuse
+# every request outside its exempt routes with a 403.
+#FLUXER_CLIENT_IP_HEADER_NAME=x-forwarded-for
 #FLUXER_TRUST_CLIENT_IP_HEADER=true

-# How much the services write. trace, debug, info, warn, error or fatal. Every
-# service names the object storage endpoint and its addressing at info on start,
-# so a bucket that answers 404 is visible without raising this.
-#LOG_LEVEL=debug
+# How much the services write. LOG_LEVEL covers the api and worker and takes trace,
+# debug, info, warn, error or fatal. RUST_LOG covers the Rust services and takes
+# an EnvFilter such as debug. The gateway takes an Erlang level such as notice,
+# and LOGGER_LEVEL beats FLUXER_GATEWAY_LOGGER_LEVEL.
+#LOG_LEVEL=info
+#RUST_LOG=info
+#FLUXER_GATEWAY_LOGGER_LEVEL=info
+#LOGGER_LEVEL=

 FLUXER_S3_ACCESS_KEY=fluxer
 FLUXER_S3_SECRET_KEY=CHANGE_ME
@@ -183,32 +190,73 @@ FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64=CHANGE_ME
 FLUXER_ADMIN_SECRET_KEY_BASE=CHANGE_ME
 FLUXER_ADMIN_OAUTH_CLIENT_SECRET=CHANGE_ME

-# The token every service sends to NATS. The bundled NATS runs without
-# authentication, so this stays empty unless a Compose override points the stack
-# at an external NATS that requires a token. Compose forwards the name to every
-# container that connects.
+# The token every service sends to NATS. The bundled NATS needs none, so this
+# stays empty unless an override points at an external one.
 #FLUXER_NATS_AUTH_TOKEN=

 FLUXER_VAPID_PUBLIC_KEY=CHANGE_ME
 FLUXER_VAPID_PRIVATE_KEY=CHANGE_ME

-# The VAPID contact address defaults to admin@ followed by FLUXER_DOMAIN. Set it
-# only if that mailbox does not exist.
+# Defaults to admin@ followed by FLUXER_DOMAIN. Set it if that mailbox does not
+# exist.
 #[email protected]

-# Passkeys follow FLUXER_DOMAIN by default. Set these only if browsers reach the
-# instance on a different host, and note that changing FLUXER_PASSKEY_RP_ID
-# invalidates every passkey already registered against the old value.
+# The passkey RP ID defaults to FLUXER_DOMAIN, whatever FLUXER_PUBLIC_ORIGIN says.
+# Changing the RP ID invalidates every passkey registered against the old value.
 #FLUXER_PASSKEY_RP_ID=chat.example.com
 #FLUXER_PASSKEY_RP_NAME=Fluxer
 #FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS=https://chat.example.com
 #FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS=http://chat.example.com:19080

-# Extra Content-Security-Policy sources, appended to the built-in ones. Set these
-# only when a browser must reach an origin the defaults do not cover, such as a
-# voice server hosted on a domain other than FLUXER_DOMAIN. Separate several
-# sources with spaces or commas. Every one of them is empty by default, and the
-# three carrying a value below are illustrations, not defaults.
+# Notification jobs the push container holds at once, 1 to 1000000.
+#FLUXER_PUSH_SERVICE_QUEUE_CAPACITY=10000
+# Provider requests the push container sends at once, 1 to 65536.
+#FLUXER_PUSH_SERVICE_SEND_CONCURRENCY=256
+# The push container's provider addresses and relay hosts.
+#FLUXER_PUSH_SERVICE_APNS_BASE_URL=
+#FLUXER_PUSH_SERVICE_FCM_BASE_URL=https://fcm.googleapis.com
+#FLUXER_PUSH_SERVICE_MANAGED_RELAY_HOSTS=push.fluxer.com
+#FLUXER_PUSH_SERVICE_OWN_RELAY_HOSTS=
+#FLUXER_PUSH_SERVICE_RELAY_CONSENT_ACCEPTED=false
+
+# Direct mobile push through your own APNs and FCM credentials, off by default.
+#FLUXER_PUSH_APNS_ENABLED=false
+#FLUXER_PUSH_APNS_TEAM_ID=
+#FLUXER_PUSH_APNS_KEY_ID=
+#FLUXER_PUSH_APNS_PRIVATE_KEY=
+#FLUXER_PUSH_APNS_PRIVATE_KEY_PATH=
+#FLUXER_PUSH_APNS_APPS=
+#FLUXER_PUSH_APNS_DEFAULT_ENVIRONMENT=production
+#FLUXER_PUSH_FCM_ENABLED=false
+#FLUXER_PUSH_FCM_PROJECT_ID=
+#FLUXER_PUSH_FCM_CLIENT_EMAIL=
+#FLUXER_PUSH_FCM_PRIVATE_KEY=
+#FLUXER_PUSH_FCM_PRIVATE_KEY_PATH=
+#FLUXER_PUSH_FCM_SERVICE_ACCOUNT_JSON_PATH=
+#FLUXER_PUSH_FCM_TOKEN_URI=https://oauth2.googleapis.com/token
+#FLUXER_PUSH_FCM_APPS=
+
+
+# Optional media policies, both off by default. See the operator docs.
+#
+# CORS limits which web origins may read media. A request with no Origin is
+# always served. Add https://web.fluxer.app if people use the hosted client.
+#
+# Signatures make an attachment read need a signed URL, so a copied link stops
+# working. Needs a secret from openssl rand -base64 32, first entry signs and
+# every entry verifies.
+#
+# Each mode is off, report or enforce, and off is the default. Start at report.
+# media-proxy reads these at start, so apply with docker compose up -d
+# media-proxy. The values below are examples.
+#FLUXER_MEDIA_PROXY_CORS_MODE=enforce
+#FLUXER_MEDIA_PROXY_CORS_ALLOWED_ORIGINS=https://chat.example.com,https://web.fluxer.app
+#FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64=
+#FLUXER_MEDIA_PROXY_ATTACHMENT_SIGNATURE_MODE=enforce
+
+# Extra Content-Security-Policy sources, appended to the built-in ones. Set one
+# only when a browser must reach an origin the defaults do not cover. Separate
+# several with spaces or commas. The three values below are illustrations.
 #FLUXER_CSP_EXTRA_DEFAULT_SRC=
 #FLUXER_CSP_EXTRA_CONNECT_SRC=wss://livekit.example.com:7881
 #FLUXER_CSP_EXTRA_IMG_SRC=https://cdn.example.com
@@ -220,45 +268,42 @@ FLUXER_VAPID_PRIVATE_KEY=CHANGE_ME
 #FLUXER_CSP_EXTRA_WORKER_SRC=
 #FLUXER_CSP_EXTRA_MANIFEST_SRC=

-# One report-uri for Content-Security-Policy violation reports. Empty leaves the
-# directive off the header.
+# One report-uri for CSP violation reports. Empty leaves the directive off.
 #FLUXER_CSP_REPORT_URI=

-# Allow the SSO identity provider to resolve to a private or internal address.
-# Off by default: the API refuses to call non-public addresses so a misconfigured
-# provider URL cannot be used to reach internal services. Turn it on only when the
-# provider genuinely lives on your own network, such as split-horizon DNS or a LAN
-# identity provider, and only when you trust everyone who can configure SSO.
+# Let the SSO provider resolve to a private address. Off by default, so a
+# misconfigured provider URL cannot reach internal services. Turn it on only for
+# a provider on your own network. The value below is an example.
 #FLUXER_SSO_ALLOW_PRIVATE_ADDRESSES=true

-# Both reach LiveKit as LIVEKIT_KEYS and the webhook signing key, and the API as
-# FLUXER_LIVEKIT_API_KEY and FLUXER_LIVEKIT_API_SECRET. Change them together.
+# These reach both LiveKit and the api. Change them together.
 LIVEKIT_API_KEY=fluxer
 LIVEKIT_API_SECRET=CHANGE_ME

-# The URL browsers use for voice signalling. Compose builds it from
-# FLUXER_PUBLIC_ORIGIN, or from FLUXER_PUBLIC_SCHEME, FLUXER_DOMAIN and
-# FLUXER_PUBLIC_PORT, as that origin followed by /livekit. The client rewrites a
-# leading http to ws itself. Set it only when LiveKit is served from another
-# host.
+# The URL browsers use for voice signalling. Built from the public origin plus
+# /livekit. Set it only when LiveKit is served from another host.
 #FLUXER_LIVEKIT_URL=

-# Media ports. LiveKit advertises these in ICE candidates, so the host must
-# forward the same numbers.
+# Media ports. LiveKit advertises these, so forward the same numbers.
 #FLUXER_LIVEKIT_TCP_PORT=7881
 #FLUXER_LIVEKIT_UDP_PORT=7882

-# LiveKit finds the address browsers dial by asking a STUN server. A host that
-# cannot reach one over UDP stops with "could not resolve external IP", and the
-# address is then set by hand: put it in FLUXER_LIVEKIT_NODE_IP and set
-# FLUXER_LIVEKIT_USE_EXTERNAL_IP to false. Point the two STUN entries at another
-# server to keep the lookup and leave Google out of it.
+# LiveKit finds its public address over STUN. A host that cannot reach one stops
+# with "could not resolve external IP", so set the address by hand instead, or
+# point STUN elsewhere. The values below are examples.
 #FLUXER_LIVEKIT_USE_EXTERNAL_IP=false
 #FLUXER_LIVEKIT_NODE_IP=203.0.113.10
 #FLUXER_LIVEKIT_STUN_PRIMARY=stun.l.google.com:19302
 #FLUXER_LIVEKIT_STUN_SECONDARY=stun1.l.google.com:19302

+# The voice region users see, and how much LiveKit logs.
+#FLUXER_LIVEKIT_DEFAULT_REGION={"id":"default","name":"Default","emoji":"🌍","latitude":0,"longitude":0}
+#FLUXER_LIVEKIT_LOG_LEVEL=info
+
 FLUXER_KLIPY_API_KEY=
+#FLUXER_YOUTUBE_API_KEY=
+# Hosts the api never unfurls, comma separated.
+#FLUXER_API_UNFURL_IGNORED_HOSTS=

 FLUXER_EMAIL_ENABLED=false
 FLUXER_EMAIL_PROVIDER=none
@@ -270,20 +315,97 @@ FLUXER_EMAIL_SMTP_PORT=587
 FLUXER_EMAIL_SMTP_USERNAME=
 FLUXER_EMAIL_SMTP_PASSWORD=
 FLUXER_EMAIL_SMTP_SECURE=true
+#FLUXER_EMAIL_WEBHOOK_SECRET=

-FLUXER_CAPTCHA_ENABLED=false
-FLUXER_CAPTCHA_PROVIDER=none
-FLUXER_CAPTCHA_HCAPTCHA_SITE_KEY=
-FLUXER_CAPTCHA_HCAPTCHA_SECRET_KEY=
-FLUXER_CAPTCHA_TURNSTILE_SITE_KEY=
-FLUXER_CAPTCHA_TURNSTILE_SECRET_KEY=
 FLUXER_DISCOVERY_ENABLED=true
+#FLUXER_DISCOVERY_MIN_MEMBER_COUNT=1

-# Container memory. The 25 limits sum to 18.25 GiB, which is a sum of ceilings and
-# not an allocation, so the defaults fit a host with 8 GB and are sized for 16 GB.
-# The four reservations are cgroup memory.low, which biases the kernel away from
-# reclaiming from the services whose death takes the whole instance down. They do
-# not reserve anything. Lower the limits on a smaller host.
+# Instance identity and account policy.
+#FLUXER_APP_PRODUCT_NAME=Fluxer
+#FLUXER_APP_ICON_URL=
+#FLUXER_APP_SYMBOL_URL=
+#FLUXER_APP_LOGO_URL=
+#FLUXER_APP_WORDMARK_URL=
+#FLUXER_APP_FAVICON_URL=
+#FLUXER_APP_THEME_COLOR=
+#FLUXER_APP_STATUS_PAGE_URL=
+#FLUXER_APP_STATUS_PAGE_INCIDENT_HISTORY_URL=
+#FLUXER_INSTANCE_SETUP_CONFIGURED=false
+#FLUXER_AUTO_JOIN_INVITE_CODE=
+#FLUXER_DELETION_GRACE_PERIOD_HOURS=336
+
+# Sign in with Bluesky, off unless turned on.
+#FLUXER_AUTH_BLUESKY_ENABLED=false
+#FLUXER_AUTH_BLUESKY_CLIENT_NAME=Fluxer
+#FLUXER_AUTH_BLUESKY_CLIENT_URI=
+#FLUXER_AUTH_BLUESKY_LOGO_URI=
+#FLUXER_AUTH_BLUESKY_TOS_URI=
+#FLUXER_AUTH_BLUESKY_POLICY_URI=
+#FLUXER_AUTH_BLUESKY_KEYS=
+
+# Public addresses. Each follows the public origin unless set here.
+#FLUXER_API_ENDPOINT=
+#FLUXER_API_CLIENT_ENDPOINT=
+#FLUXER_APP_ENDPOINT=
+#FLUXER_GATEWAY_ENDPOINT=
+#FLUXER_MEDIA_ENDPOINT=
+#FLUXER_STATIC_CDN_ENDPOINT=
+#FLUXER_ADMIN_ENDPOINT=
+#FLUXER_MARKETING_ENDPOINT=
+#FLUXER_INVITE_ENDPOINT=
+#FLUXER_GIFT_ENDPOINT=
+#FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT=
+#PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT=
+# These follow FLUXER_STATIC_CDN_ENDPOINT first, then the public origin.
+#FLUXER_GATEWAY_STATIC_CDN_ENDPOINT=
+#FLUXER_UNFURL_STATIC_CDN_ENDPOINT=
+# These follow FLUXER_MEDIA_ENDPOINT first, then the public origin.
+#FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT=
+#FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT=
+
+# Extra hosts for static assets, invites, gifts and the web app. Empty by default.
+#FLUXER_STATIC_CDN_DOMAIN=
+#FLUXER_INVITE_DOMAIN=
+#FLUXER_GIFT_DOMAIN=
+#FLUXER_APP_ORIGIN_ALIASES=
+
+# The path the admin panel is served under. The edge and the admin service read
+# it. The api follows it through the default FLUXER_ADMIN_ENDPOINT, and not when
+# FLUXER_ADMIN_ENDPOINT is set. Write it with a leading slash and no trailing
+# slash.
+#FLUXER_ADMIN_BASE_PATH=/admin
+
+# The compression the edge offers, as Caddy encode arguments.
+#FLUXER_EDGE_ENCODE=zstd gzip
+
+# Images of the bundled services, for a mirror or another tag. A new Postgres
+# major needs a dump and restore, as the upgrade guide describes.
+#FLUXER_CADDY_IMAGE=caddy:2.11-alpine
+#FLUXER_POSTGRES_IMAGE=postgres:16-alpine
+#FLUXER_VALKEY_IMAGE=valkey/valkey:9.1-alpine
+#FLUXER_NATS_IMAGE=nats:2.14-alpine
+#FLUXER_MEILISEARCH_IMAGE=getmeili/meilisearch:v1.53
+#FLUXER_SEAWEEDFS_IMAGE=chrislusf/seaweedfs:4.47
+#FLUXER_LIVEKIT_IMAGE=livekit/livekit-server:v1.12.0
+
+# Restart policy for every long-running service.
+#FLUXER_RESTART_POLICY=unless-stopped
+
+# Health checks. Raise the retries or start periods on a slow host.
+#FLUXER_HEALTHCHECK_INTERVAL=10s
+#FLUXER_HEALTHCHECK_TIMEOUT=5s
+#FLUXER_HEALTHCHECK_RETRIES=10
+#FLUXER_APP_HEALTHCHECK_RETRIES=30
+#FLUXER_APP_HEALTHCHECK_START_PERIOD=90s
+#FLUXER_SVC_HEALTHCHECK_START_PERIOD=60s
+#FLUXER_WORKER_HEALTHCHECK_RETRIES=3
+#FLUXER_SEAWEEDFS_HEALTHCHECK_RETRIES=20
+#FLUXER_SEAWEEDFS_HEALTHCHECK_START_PERIOD=60s
+#FLUXER_SEAWEEDFS_INIT_ATTEMPTS=60
+
+# Container memory. These are ceilings, not allocations, and the defaults suit a
+# 16 GB host. The reservations bias the kernel away from reclaiming from services
+# whose death takes the instance down. Lower the limits on a smaller host.
 #FLUXER_CADDY_MEMORY_LIMIT=256mb
 #FLUXER_POSTGRES_MEMORY_LIMIT=5gb
 #FLUXER_POSTGRES_MEMORY_RESERVATION=3gb
@@ -300,6 +422,7 @@ FLUXER_DISCOVERY_ENABLED=true
 #FLUXER_GATEWAY_MEMORY_LIMIT=1gb
 #FLUXER_GATEWAY_MEMORY_RESERVATION=384mb
 #FLUXER_MEDIA_PROXY_MEMORY_LIMIT=512mb
+#FLUXER_PUSH_MEMORY_LIMIT=256mb
 #FLUXER_STATIC_PROXY_MEMORY_LIMIT=256mb
 #FLUXER_APP_PROXY_MEMORY_LIMIT=256mb
 #FLUXER_SNOWFLAKES_MEMORY_LIMIT=128mb
@@ -314,81 +437,178 @@ FLUXER_DISCOVERY_ENABLED=true
 #FLUXER_UNFURL_SHARD_MEMORY_LIMIT=256mb
 #FLUXER_ADMIN_MEMORY_LIMIT=256mb

-# Meilisearch indexing memory. Keep it well under FLUXER_MEILISEARCH_MEMORY_LIMIT,
-# which is the container ceiling the indexer shares with the search process.
+# Meilisearch indexing memory. Keep it well under the container limit above.
 #FLUXER_MEILISEARCH_MAX_INDEXING_MEMORY=384mb
+#FLUXER_MEILISEARCH_ENV=production
+#FLUXER_MEILISEARCH_NO_ANALYTICS=true

-# SeaweedFS heap ceiling. Go collects against this value instead of against the
-# container limit, which it cannot see, so without it an upload burst grows the
-# heap past FLUXER_SEAWEEDFS_MEMORY_LIMIT and the kernel OOM-kills the container
-# mid-upload (exit 137). Keep it near three quarters of that limit, and raise both
-# together: the peak is the parts of one upload in flight at once, which is 25 MB
-# times 20 for a 500 MB attachment.
+# SeaweedFS heap ceiling. Go cannot see the container limit, so without this an
+# upload burst gets the container OOM-killed. Keep it near three quarters of
+# FLUXER_SEAWEEDFS_MEMORY_LIMIT and raise both together.
 #FLUXER_SEAWEEDFS_GOMEMLIMIT=1536MiB
+#FLUXER_SEAWEEDFS_TELEMETRY=false

-# Node sizes its own heap from the container memory limit by default, at roughly
-# 55 percent of it, which always leaves room for the buffers and stacks that live
-# outside the heap. Leave these unset unless you have a reason to pin the value.
-# Any value set here must stay well below the container limit above: a heap ceiling
-# above the container limit makes the kernel OOM-kill the container (exit 137, no
-# diagnostics) instead of Node reporting a JavaScript heap out of memory error.
+# Volumes SeaweedFS creates at once when a bucket needs space. Each reserves 1 GB
+# of free disk from the start, and SeaweedFS's own default of 7 fills a small
+# disk before every bucket has one, so uploads fail with no free volumes left.
+#FLUXER_SEAWEEDFS_VOLUME_GROWTH=1
+
+# Node sizes its heap from the container limit by default. Leave these unset
+# unless you need to pin it. A heap ceiling above the container limit gets the
+# container OOM-killed instead of reporting a heap error. The values below are
+# examples.
 #FLUXER_API_NODE_HEAP_MB=1792
 #FLUXER_WORKER_NODE_HEAP_MB=1792

-# Bundled Postgres tuning. Keep these consistent with FLUXER_POSTGRES_MEMORY_LIMIT:
-# budget roughly shared_buffers + (server max_connections x 12 MB) +
-# (3 x autovacuum_work_mem) + 300 MB for page cache and WAL. Note this is the
-# server setting, distinct from the per-service FLUXER_POSTGRES_MAX_CONNECTIONS
-# pool sizes used by the api, worker and shards.
+# Extra Node flags for api and worker, appended to NODE_OPTIONS. Empty by
+# default. The value below is an example.
+#FLUXER_API_NODE_OPTIONS=--heapsnapshot-near-heap-limit=1
+#FLUXER_WORKER_NODE_OPTIONS=--heapsnapshot-near-heap-limit=1
+
+# Extra CA certificates api and worker trust, as a PEM bundle path inside the
+# container. The default is the image's system bundle.
+#FLUXER_NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt
+
+# Bundled Postgres tuning. Keep it consistent with the memory limit above. This
+# is the server setting, not the per-service pool sizes.
 #FLUXER_POSTGRES_SERVER_MAX_CONNECTIONS=150
 #FLUXER_POSTGRES_SHARED_BUFFERS=512MB
 #FLUXER_POSTGRES_EFFECTIVE_CACHE_SIZE=2GB
 #FLUXER_POSTGRES_WORK_MEM=8MB
 #FLUXER_POSTGRES_MAINTENANCE_WORK_MEM=256MB
 #FLUXER_POSTGRES_AUTOVACUUM_WORK_MEM=128MB
+#FLUXER_POSTGRES_SHM_SIZE=1gb
+#FLUXER_POSTGRES_RANDOM_PAGE_COST=1.1
+#FLUXER_POSTGRES_EFFECTIVE_IO_CONCURRENCY=200
+#FLUXER_POSTGRES_DEFAULT_STATISTICS_TARGET=200
+#FLUXER_POSTGRES_JIT=off
+#FLUXER_POSTGRES_MIN_WAL_SIZE=512MB
+#FLUXER_POSTGRES_MAX_WAL_SIZE=2GB
+#FLUXER_POSTGRES_CHECKPOINT_COMPLETION_TARGET=0.9
+#FLUXER_POSTGRES_WAL_BUFFERS=16MB
+#FLUXER_POSTGRES_WAL_COMPRESSION=zstd
+#FLUXER_POSTGRES_BGWRITER_DELAY=50ms
+#FLUXER_POSTGRES_BGWRITER_LRU_MAXPAGES=1000
+#FLUXER_POSTGRES_AUTOVACUUM_VACUUM_SCALE_FACTOR=0.05
+#FLUXER_POSTGRES_AUTOVACUUM_ANALYZE_SCALE_FACTOR=0.02
+#FLUXER_POSTGRES_AUTOVACUUM_VACUUM_COST_LIMIT=2000
+#FLUXER_POSTGRES_TRACK_IO_TIMING=on
+#FLUXER_POSTGRES_SHARED_PRELOAD_LIBRARIES=pg_stat_statements

-# The bundled Valkey holds durable state as well as cache. The bulk message
-# deletion queue and the account deletion queue are sorted sets with no expiry,
-# and nothing else stores the first of the two. It therefore runs with an
-# append-only file on a named volume and with noeviction, so an over-limit write
-# fails loudly instead of silently deleting queued work. Distributed locks all
-# carry a TTL and are not what the durability is for. Only change the policy if
-# you have moved that durable state elsewhere.
+# Postgres pool size of each service that opens a pool.
+#FLUXER_API_POSTGRES_MAX_CONNECTIONS=25
+#FLUXER_WORKER_POSTGRES_MAX_CONNECTIONS=25
+#FLUXER_USERS_SHARD_POSTGRES_MAX_CONNECTIONS=20
+#FLUXER_MESSAGES_SHARD_POSTGRES_MAX_CONNECTIONS=20
+
+# The bundled Valkey holds durable state as well as cache, so it runs with an
+# append-only file and with noeviction, which fails an over-limit write instead
+# of dropping queued work. Change the policy only if that state lives elsewhere.
 #FLUXER_VALKEY_MAXMEMORY=192mb
 #FLUXER_VALKEY_MAXMEMORY_POLICY=noeviction
+#FLUXER_VALKEY_APPENDFSYNC=everysec

-# The gateway derives its BEAM scheduler count from the container CPU quota,
-# clamped to this range. The floor matters: a single scheduler lets one blocking
-# operation stall every websocket on the node. The ceiling stops a large host
-# from starting far more schedulers than the container can actually use.
+# The gateway derives its scheduler count from the CPU quota, clamped here. One
+# scheduler lets a single blocking operation stall every websocket on the node.
 #FLUXER_ERLANG_SCHEDULERS_MIN=2
 #FLUXER_ERLANG_SCHEDULERS_MAX=16
+# A fixed scheduler count skips the clamp. Dirty CPU schedulers default to two
+# thirds of it.
+#FLUXER_ERLANG_SCHEDULERS=
+#FLUXER_ERLANG_DIRTY_CPU_SCHEDULERS=

-# In-flight request ceiling for the four services Compose forwards it to: the
-# users and messages routers and their shards. Leave it unset and each service
-# uses its own built-in default, which is what the numbers below describe. Set it
-# and the one value replaces the built-in default on all four, so size it for the
-# busiest of them rather than for the smallest. The built-in defaults are 192 for
-# messages, 320 for snowflakes and 64 elsewhere, and they govern every service
-# Compose does not forward this to. A router holds a slot for the whole round
-# trip to its shard, so this is a ceiling on requests in flight at once and not a
-# rate: too low a value does not slow requests down, it rejects them, and the api
-# turns that rejection into a 503.
-#FLUXER_SVC_MAX_CONCURRENT_REQUESTS=192
+# Gateway push and RPC tuning.
+#FLUXER_GATEWAY_PUSH_ENABLED=true
+#FLUXER_GATEWAY_PUSH_ENROLLED_CLEAR_NOTIFICATIONS_ENABLED=true
+#FLUXER_GATEWAY_PUSH_OUTBOX_REQUEST_TIMEOUT_MS=100000
+#FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_ENTRIES=128
+#FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_BYTES=1048576
+#FLUXER_GATEWAY_HTTP_RPC_MAX_CONCURRENCY=512
+#FLUXER_GATEWAY_NATS_RPC_MAX_HANDLERS=512
+#FLUXER_GATEWAY_HTTP_FAILURE_THRESHOLD=6
+#FLUXER_GATEWAY_HTTP_RECOVERY_TIMEOUT_MS=15000

-# The api and the Rust services name their fixed Postgres statement shapes so the
-# server can reuse their plans. Named prepared statements require a session that
-# outlives the transaction, so set this to false if you put a transaction-pooling
-# connection pooler such as PgBouncer in front of Postgres. One setting governs
-# every service. The bundled compose talks to Postgres directly, where naming is
-# a win and the default is correct.
+# In-flight request ceiling for every svc router and shard. Unset, each keeps its
+# own default: 192 for messages, 320 for snowflakes and 64 for the rest. One value
+# replaces all of them, so size it for the busiest. Too low a value rejects
+# requests rather than slowing them, and the api turns that into a 503. The value
+# below is an example.
+#FLUXER_SVC_MAX_CONCURRENT_REQUESTS=320
+
+# svc caches, and how the api calls the svc services over NATS.
+#FLUXER_SVC_CACHE_MAX_ENTRIES=100000
+#FLUXER_SVC_CACHE_TTL_MS=30000
+#FLUXER_GIFS_SHARD_CACHE_MAX_BYTES=536870912
+#FLUXER_GIF_SERVICE_NATS_CLIENT_NAME=fluxer-api-gifs
+#FLUXER_GIF_SERVICE_TIMEOUT_MS=12000
+#FLUXER_GIF_SERVICE_REGISTER_SHARE_TIMEOUT_MS=3000
+#FLUXER_USERS_SERVICE_NATS_CLIENT_NAME=fluxer-api-users
+#FLUXER_USERS_SERVICE_TIMEOUT_MS=6000
+#FLUXER_USERS_SERVICE_INFLIGHT_MAX_ENTRIES=10000
+#FLUXER_SNOWFLAKE_SERVICE_NATS_CLIENT_NAME=fluxer-api-snowflakes
+#FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE=128
+#FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK=
+#FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS=5000
+#FLUXER_SNOWFLAKE_SERVICE_REQUEST_TIMEOUT_MS=6000
+
+# Worker concurrency per lane, as a JSON object keyed by lane.
+#FLUXER_API_WORKER_LANE_CONCURRENCY_OVERRIDES=
+
+# Named prepared statements need a session that outlives the transaction, so set
+# this to false behind a transaction-pooling connection pooler. The bundled
+# compose talks to Postgres directly, where the default is correct.
 #FLUXER_POSTGRES_PREPARED_STATEMENTS=true

-# The api bounds how long a client may take to send a request. The header timeout
-# covers the request line and headers only, while the request timeout covers the
-# whole exchange, so a slow uploader is bounded by the second value and not by
-# the first. Raise both if you front large uploads or serve clients on high
-# latency links. The header timeout is clamped down to the request timeout, so
-# raising it alone does nothing. Both are milliseconds, between 1000 and 3600000.
+# How long a client may take to send a request. The header timeout covers the
+# request line and headers, the request timeout the whole exchange, and the first
+# is clamped down to the second. Milliseconds, 1000 to 3600000.
 #FLUXER_API_HEADERS_TIMEOUT_MS=30000
 #FLUXER_API_REQUEST_TIMEOUT_MS=120000
+
+# api request limits and IP bans. A refresh interval of 0 stops the periodic
+# ban reload.
+#FLUXER_API_MAX_INFLIGHT_REQUESTS=512
+#FLUXER_API_IP_BAN_EXEMPT_IPS=
+#FLUXER_IP_BAN_REFRESH_INTERVAL_MS=300000
+
+# Uploads and data exports. Presigned exports link to FLUXER_S3_PUBLIC_ENDPOINT,
+# so turn them on only once browsers can reach it.
+#FLUXER_API_PRESIGNED_ATTACHMENT_UPLOADS_ENABLED=true
+#FLUXER_API_PRESIGNED_HARVEST_DOWNLOADS_ENABLED=false
+#FLUXER_MEDIA_PROXY_UPLOAD_RELAY_MAX_BODY_BYTES=524288000
+#FLUXER_MEDIA_PROXY_UPLOAD_RELAY_TOKEN_TTL_SECS=900
+#FLUXER_MEDIA_PROXY_UPLOAD_RELAY_KEEP_DIRECT_COUNTRIES=
+#FLUXER_API_STORAGE_CHANGE_FEED_ENABLED=false
+#FLUXER_API_STORAGE_CHANGE_FEED_STREAM=STORAGE_CHANGES
+#FLUXER_API_STORAGE_CHANGE_FEED_SKIP_BUCKETS=
+#FLUXER_CACHE_PURGE_ADAPTER=none
+#FLUXER_CACHE_PURGE_HTTP_ENDPOINT=
+#FLUXER_CACHE_PURGE_HTTP_TOKEN=
+#FLUXER_CACHE_PURGE_HTTP_TIMEOUT_MS=10000
+
+# media-proxy limits and timeouts.
+#FLUXER_MEDIA_PROXY_READ_ONLY=false
+#FLUXER_MEDIA_PROXY_NSFW_THRESHOLD=0.85
+#FLUXER_NSFW_SERVICE_ENDPOINT=
+#FLUXER_MEDIA_PROXY_MAX_NATIVE_TRANSFORMS=
+#FLUXER_MEDIA_PROXY_WORKER_QUEUE_CAPACITY=
+#FLUXER_MEDIA_PROXY_MAX_ENCODE_DURATION_MS=30000
+#FLUXER_MEDIA_PROXY_MAX_ENCODE_FRAMES=20000
+#FLUXER_MEDIA_PROXY_TRANSFORM_TIMEOUT_MS=15000
+#FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_BYTES=268435456
+#FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_MAX_ENTRY_BYTES=67108864
+#FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_TTL_MS=120000
+#FLUXER_MEDIA_PROXY_SOCKET_IO_TIMEOUT_MS=30000
+#FLUXER_MEDIA_PROXY_SHUTDOWN_GRACE_MS=30000
+#FLUXER_MEDIA_PROXY_UPLOAD_RELAY_S3_TIMEOUT_MS=900000
+#FLUXER_MEDIA_PROXY_UPLOAD_RELAY_BUFFERED_RETRY_BYTES=33554432
+#FLUXER_MEDIA_PROXY_UPLOAD_RELAY_BUFFERED_RETRY_TOTAL_BYTES=536870912
+#FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SPOOL_DIR=
+#FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SPOOL_CHUNK_BYTES=1048576
+#FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SPOOL_MAX_TOTAL_BYTES=8589934592
+
+# app-proxy discovery refresh, index upstream and manifest scope.
+#DISCOVERY_REFRESH_INTERVAL_MS=60000
+#FLUXER_APP_PROXY_INDEX_UPSTREAM_URL=
+#FLUXER_APP_PROXY_SAME_ORIGIN_HOSTS=
+#FLUXER_APP_PROXY_MANIFEST_SCOPE_EXTENSIONS=
@@ -6,7 +6,7 @@
 }

 {$FLUXER_EDGE_SITE_ADDRESS} {
-	encode zstd gzip
+	encode {$FLUXER_EDGE_ENCODE:zstd gzip}

 	handle /_health {
 		respond "OK" 200
@@ -33,12 +33,12 @@
 		reverse_proxy livekit:7880
 	}

-	handle /admin {
+	handle {$FLUXER_ADMIN_BASE_PATH:/admin} {
 		rewrite * /
 		reverse_proxy admin:8080
 	}

-	handle_path /admin/* {
+	handle_path {$FLUXER_ADMIN_BASE_PATH:/admin}/* {
 		reverse_proxy admin:8080
 	}

@@ -3,38 +3,81 @@ name: fluxer
 x-fluxer-postgres-env: &fluxer-postgres-env
  FLUXER_DATABASE_BACKEND: postgres
  FLUXER_POSTGRES_HOST: ${FLUXER_POSTGRES_HOST:-postgres}
-  FLUXER_POSTGRES_PORT: "${FLUXER_POSTGRES_PORT:-5432}"
-  FLUXER_POSTGRES_DATABASE: ${FLUXER_POSTGRES_DATABASE:-fluxer}
-  FLUXER_POSTGRES_USERNAME: ${FLUXER_POSTGRES_USERNAME:-fluxer}
+  FLUXER_POSTGRES_PORT: ${FLUXER_POSTGRES_PORT:-}
+  FLUXER_POSTGRES_DATABASE: ${FLUXER_POSTGRES_DATABASE:-}
+  FLUXER_POSTGRES_USERNAME: ${FLUXER_POSTGRES_USERNAME:-}
  FLUXER_POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
-  FLUXER_POSTGRES_SSL: "${FLUXER_POSTGRES_SSL:-false}"
-  FLUXER_POSTGRES_PREPARED_STATEMENTS: ${FLUXER_POSTGRES_PREPARED_STATEMENTS:-true}
+  FLUXER_POSTGRES_URL: ${FLUXER_POSTGRES_URL:-}
+  FLUXER_POSTGRES_SSL: ${FLUXER_POSTGRES_SSL:-}
+  FLUXER_POSTGRES_SSL_CA: ${FLUXER_POSTGRES_SSL_CA:-}
+  FLUXER_POSTGRES_PREPARED_STATEMENTS: ${FLUXER_POSTGRES_PREPARED_STATEMENTS:-}
+  FLUXER_POSTGRES_KV_TABLE: ${FLUXER_POSTGRES_KV_TABLE:-}

 x-fluxer-env: &fluxer-env
  <<: *fluxer-postgres-env
  FLUXER_ENV: production
-  NODE_ENV: production
-  LOG_LEVEL: ${LOG_LEVEL:-info}
+  LOG_LEVEL: ${LOG_LEVEL:-}
+  RUST_LOG: ${RUST_LOG:-}
  FLUXER_SELF_HOSTED: "true"
  FLUXER_BASE_DOMAIN: ${FLUXER_DOMAIN:?set FLUXER_DOMAIN in .env}
  FLUXER_PUBLIC_SCHEME: ${FLUXER_PUBLIC_SCHEME:-https}
  FLUXER_PUBLIC_PORT: ${FLUXER_PUBLIC_PORT:-443}
  FLUXER_PUBLIC_ORIGIN: ${FLUXER_PUBLIC_ORIGIN:-}
  FLUXER_TRUST_CLIENT_IP_HEADER: "${FLUXER_TRUST_CLIENT_IP_HEADER:-true}"
-  FLUXER_CLIENT_IP_HEADER_NAME: ${FLUXER_CLIENT_IP_HEADER_NAME:-x-forwarded-for}
-  FLUXER_API_HEADERS_TIMEOUT_MS: ${FLUXER_API_HEADERS_TIMEOUT_MS:-30000}
-  FLUXER_API_REQUEST_TIMEOUT_MS: ${FLUXER_API_REQUEST_TIMEOUT_MS:-120000}
+  FLUXER_CLIENT_IP_HEADER_NAME: ${FLUXER_CLIENT_IP_HEADER_NAME:-}
+  FLUXER_API_HEADERS_TIMEOUT_MS: ${FLUXER_API_HEADERS_TIMEOUT_MS:-}
+  FLUXER_API_REQUEST_TIMEOUT_MS: ${FLUXER_API_REQUEST_TIMEOUT_MS:-}
+  FLUXER_API_MAX_INFLIGHT_REQUESTS: ${FLUXER_API_MAX_INFLIGHT_REQUESTS:-}
+  FLUXER_API_IP_BAN_EXEMPT_IPS: ${FLUXER_API_IP_BAN_EXEMPT_IPS:-}
+  FLUXER_IP_BAN_REFRESH_INTERVAL_MS: ${FLUXER_IP_BAN_REFRESH_INTERVAL_MS:-}
+  FLUXER_APP_ORIGIN_ALIASES: ${FLUXER_APP_ORIGIN_ALIASES:-}
+  FLUXER_BREACHED_PASSWORD_CHECK_ENABLED: ${FLUXER_BREACHED_PASSWORD_CHECK_ENABLED:-}
+  FLUXER_BLOCKLIST_FEEDS_ENABLED: ${FLUXER_BLOCKLIST_FEEDS_ENABLED:-}
+  FLUXER_GEOIP_DB_PATH: ${FLUXER_GEOIP_DB_PATH:-}
+
+  FLUXER_API_ENDPOINT: ${FLUXER_API_ENDPOINT:-}
+  FLUXER_API_CLIENT_ENDPOINT: ${FLUXER_API_CLIENT_ENDPOINT:-}
+  FLUXER_APP_ENDPOINT: ${FLUXER_APP_ENDPOINT:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}}
+  FLUXER_GATEWAY_ENDPOINT: ${FLUXER_GATEWAY_ENDPOINT:-}
+  FLUXER_MEDIA_ENDPOINT: ${FLUXER_MEDIA_ENDPOINT:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media}
+  FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT:-${FLUXER_MEDIA_ENDPOINT:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media}}
+  FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_STATIC_CDN_ENDPOINT:-}
+  FLUXER_ADMIN_ENDPOINT: ${FLUXER_ADMIN_ENDPOINT:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}${FLUXER_ADMIN_BASE_PATH:-/admin}}
+  FLUXER_MARKETING_ENDPOINT: ${FLUXER_MARKETING_ENDPOINT:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}}
+  FLUXER_INVITE_ENDPOINT: ${FLUXER_INVITE_ENDPOINT:-}
+  FLUXER_GIFT_ENDPOINT: ${FLUXER_GIFT_ENDPOINT:-}
+  FLUXER_STATIC_CDN_DOMAIN: ${FLUXER_STATIC_CDN_DOMAIN:-}
+  FLUXER_INVITE_DOMAIN: ${FLUXER_INVITE_DOMAIN:-}
+  FLUXER_GIFT_DOMAIN: ${FLUXER_GIFT_DOMAIN:-}

  FLUXER_KV_URL: ${FLUXER_KV_URL:-redis://valkey:6379/0}
+  FLUXER_KV_MODE: ${FLUXER_KV_MODE:-}
  FLUXER_NATS_URL: ${FLUXER_NATS_URL:-nats://nats:4222}
  FLUXER_NATS_JETSTREAM_URL: ${FLUXER_NATS_JETSTREAM_URL:-${FLUXER_NATS_URL:-nats://nats:4222}}
  FLUXER_NATS_AUTH_TOKEN: ${FLUXER_NATS_AUTH_TOKEN:-}
  FLUXER_SVC_NATS_URL: ${FLUXER_SVC_NATS_URL:-${FLUXER_NATS_URL:-nats://nats:4222}}
  FLUXER_SVC_SHARD_COUNT: "1"
+  FLUXER_SVC_MAX_CONCURRENT_REQUESTS: ${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-}
+  FLUXER_SVC_CACHE_MAX_ENTRIES: ${FLUXER_SVC_CACHE_MAX_ENTRIES:-}
+  FLUXER_SVC_CACHE_TTL_MS: ${FLUXER_SVC_CACHE_TTL_MS:-}
+  FLUXER_GIF_SERVICE_NATS_CLIENT_NAME: ${FLUXER_GIF_SERVICE_NATS_CLIENT_NAME:-}
+  FLUXER_GIF_SERVICE_TIMEOUT_MS: ${FLUXER_GIF_SERVICE_TIMEOUT_MS:-}
+  FLUXER_GIF_SERVICE_REGISTER_SHARE_TIMEOUT_MS: ${FLUXER_GIF_SERVICE_REGISTER_SHARE_TIMEOUT_MS:-}
+  FLUXER_USERS_SERVICE_NATS_CLIENT_NAME: ${FLUXER_USERS_SERVICE_NATS_CLIENT_NAME:-}
+  FLUXER_USERS_SERVICE_TIMEOUT_MS: ${FLUXER_USERS_SERVICE_TIMEOUT_MS:-}
+  FLUXER_USERS_SERVICE_INFLIGHT_MAX_ENTRIES: ${FLUXER_USERS_SERVICE_INFLIGHT_MAX_ENTRIES:-}
+  FLUXER_SNOWFLAKE_SERVICE_NATS_CLIENT_NAME: ${FLUXER_SNOWFLAKE_SERVICE_NATS_CLIENT_NAME:-}
+  FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE: ${FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE:-}
+  FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK: ${FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK:-}
+  FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS: ${FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS:-}
+  FLUXER_SNOWFLAKE_SERVICE_REQUEST_TIMEOUT_MS: ${FLUXER_SNOWFLAKE_SERVICE_REQUEST_TIMEOUT_MS:-}

-  FLUXER_SEARCH_ENGINE: meilisearch
+  FLUXER_SEARCH_ENGINE: ${FLUXER_SEARCH_ENGINE:-meilisearch}
  FLUXER_SEARCH_URL: ${FLUXER_SEARCH_URL:-http://meilisearch:7700}
  FLUXER_SEARCH_API_KEY: ${MEILI_MASTER_KEY:?set MEILI_MASTER_KEY in .env}
+  FLUXER_SEARCH_USERNAME: ${FLUXER_SEARCH_USERNAME:-}
+  FLUXER_SEARCH_PASSWORD: ${FLUXER_SEARCH_PASSWORD:-}
+  FLUXER_SEARCH_TLS_REJECT_UNAUTHORIZED: ${FLUXER_SEARCH_TLS_REJECT_UNAUTHORIZED:-}

  FLUXER_S3_ENDPOINT: ${FLUXER_S3_ENDPOINT:-http://seaweedfs:8333}
  FLUXER_S3_PUBLIC_ENDPOINT: ${FLUXER_S3_PUBLIC_ENDPOINT:-${FLUXER_S3_ENDPOINT:-http://seaweedfs:8333}}
@@ -44,91 +87,137 @@ x-fluxer-env: &fluxer-env
  FLUXER_S3_FORCE_PATH_STYLE: "${FLUXER_S3_FORCE_PATH_STYLE:-true}"
  FLUXER_S3_BUCKET_CDN: ${FLUXER_S3_BUCKET_CDN:-fluxer}
  FLUXER_S3_BUCKET_UPLOADS: ${FLUXER_S3_BUCKET_UPLOADS:-fluxer-uploads}
-  FLUXER_S3_BUCKET_DOWNLOADS: ${FLUXER_S3_BUCKET_DOWNLOADS:-fluxer-downloads}
  FLUXER_S3_BUCKET_REPORTS: ${FLUXER_S3_BUCKET_REPORTS:-fluxer-reports}
  FLUXER_S3_BUCKET_HARVESTS: ${FLUXER_S3_BUCKET_HARVESTS:-fluxer-harvests}
-  AWS_ACCESS_KEY_ID: ${FLUXER_S3_ACCESS_KEY:?set FLUXER_S3_ACCESS_KEY in .env}
-  AWS_SECRET_ACCESS_KEY: ${FLUXER_S3_SECRET_KEY:?set FLUXER_S3_SECRET_KEY in .env}
-  AWS_DEFAULT_REGION: ${FLUXER_S3_REGION:-us-east-1}
-  AWS_EC2_METADATA_DISABLED: "true"
+  FLUXER_API_PRESIGNED_HARVEST_DOWNLOADS_ENABLED: "${FLUXER_API_PRESIGNED_HARVEST_DOWNLOADS_ENABLED:-false}"
+  FLUXER_API_STORAGE_CHANGE_FEED_ENABLED: ${FLUXER_API_STORAGE_CHANGE_FEED_ENABLED:-}
+  FLUXER_API_STORAGE_CHANGE_FEED_STREAM: ${FLUXER_API_STORAGE_CHANGE_FEED_STREAM:-}
+  FLUXER_API_STORAGE_CHANGE_FEED_SKIP_BUCKETS: ${FLUXER_API_STORAGE_CHANGE_FEED_SKIP_BUCKETS:-}
+  FLUXER_CACHE_PURGE_ADAPTER: ${FLUXER_CACHE_PURGE_ADAPTER:-}
+  FLUXER_CACHE_PURGE_HTTP_ENDPOINT: ${FLUXER_CACHE_PURGE_HTTP_ENDPOINT:-}
+  FLUXER_CACHE_PURGE_HTTP_TOKEN: ${FLUXER_CACHE_PURGE_HTTP_TOKEN:-}
+  FLUXER_CACHE_PURGE_HTTP_TIMEOUT_MS: ${FLUXER_CACHE_PURGE_HTTP_TIMEOUT_MS:-}

  FLUXER_LIVEKIT_ENABLED: "${FLUXER_LIVEKIT_ENABLED:-true}"
  FLUXER_LIVEKIT_API_KEY: ${LIVEKIT_API_KEY:?set LIVEKIT_API_KEY in .env}
  FLUXER_LIVEKIT_API_SECRET: ${LIVEKIT_API_SECRET:?set LIVEKIT_API_SECRET in .env}
  FLUXER_LIVEKIT_INTERNAL_URL: ${FLUXER_LIVEKIT_INTERNAL_URL:-http://livekit:7880}
-  FLUXER_LIVEKIT_WEBHOOK_URL: http://api:8080/webhooks/livekit
-  FLUXER_LIVEKIT_DEFAULT_REGION: '{"id":"default","name":"Default","emoji":"🌍","latitude":0,"longitude":0}'
+  FLUXER_LIVEKIT_DEFAULT_REGION: '${FLUXER_LIVEKIT_DEFAULT_REGION:-{"id":"default","name":"Default","emoji":"🌍","latitude":0,"longitude":0}}'
  FLUXER_LIVEKIT_URL: ${FLUXER_LIVEKIT_URL:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}:${FLUXER_PUBLIC_PORT:-443}}/livekit}

  FLUXER_KLIPY_API_KEY: ${FLUXER_KLIPY_API_KEY:-}
+  FLUXER_YOUTUBE_API_KEY: ${FLUXER_YOUTUBE_API_KEY:-}
+  FLUXER_API_UNFURL_IGNORED_HOSTS: ${FLUXER_API_UNFURL_IGNORED_HOSTS:-}

-  FLUXER_EMAIL_ENABLED: ${FLUXER_EMAIL_ENABLED:-false}
-  FLUXER_EMAIL_PROVIDER: ${FLUXER_EMAIL_PROVIDER:-none}
+  FLUXER_EMAIL_ENABLED: ${FLUXER_EMAIL_ENABLED:-}
+  FLUXER_EMAIL_PROVIDER: ${FLUXER_EMAIL_PROVIDER:-}
  FLUXER_EMAIL_FROM_EMAIL: ${FLUXER_EMAIL_FROM_EMAIL:-noreply@localhost}
-  FLUXER_EMAIL_FROM_NAME: ${FLUXER_EMAIL_FROM_NAME:-Fluxer}
+  FLUXER_EMAIL_FROM_NAME: ${FLUXER_EMAIL_FROM_NAME:-}
  FLUXER_EMAIL_APP_BASE_URL: ${FLUXER_EMAIL_APP_BASE_URL:-}
+  FLUXER_EMAIL_WEBHOOK_SECRET: ${FLUXER_EMAIL_WEBHOOK_SECRET:-}
  FLUXER_EMAIL_SMTP_HOST: ${FLUXER_EMAIL_SMTP_HOST:-}
-  FLUXER_EMAIL_SMTP_PORT: ${FLUXER_EMAIL_SMTP_PORT:-587}
+  FLUXER_EMAIL_SMTP_PORT: ${FLUXER_EMAIL_SMTP_PORT:-}
  FLUXER_EMAIL_SMTP_USERNAME: ${FLUXER_EMAIL_SMTP_USERNAME:-}
  FLUXER_EMAIL_SMTP_PASSWORD: ${FLUXER_EMAIL_SMTP_PASSWORD:-}
-  FLUXER_EMAIL_SMTP_SECURE: ${FLUXER_EMAIL_SMTP_SECURE:-true}
+  FLUXER_EMAIL_SMTP_SECURE: ${FLUXER_EMAIL_SMTP_SECURE:-}

-  FLUXER_SMS_ENABLED: "${FLUXER_SMS_ENABLED:-false}"
-  FLUXER_CAPTCHA_ENABLED: ${FLUXER_CAPTCHA_ENABLED:-false}
-  FLUXER_CAPTCHA_PROVIDER: ${FLUXER_CAPTCHA_PROVIDER:-none}
-  FLUXER_CAPTCHA_HCAPTCHA_SITE_KEY: ${FLUXER_CAPTCHA_HCAPTCHA_SITE_KEY:-}
-  FLUXER_CAPTCHA_HCAPTCHA_SECRET_KEY: ${FLUXER_CAPTCHA_HCAPTCHA_SECRET_KEY:-}
-  FLUXER_CAPTCHA_TURNSTILE_SITE_KEY: ${FLUXER_CAPTCHA_TURNSTILE_SITE_KEY:-}
-  FLUXER_CAPTCHA_TURNSTILE_SECRET_KEY: ${FLUXER_CAPTCHA_TURNSTILE_SECRET_KEY:-}
-  FLUXER_STRIPE_ENABLED: "${FLUXER_STRIPE_ENABLED:-false}"
-  FLUXER_NCMEC_ENABLED: "${FLUXER_NCMEC_ENABLED:-false}"
-  FLUXER_CLAMAV_ENABLED: "${FLUXER_CLAMAV_ENABLED:-false}"
-  FLUXER_DISCOVERY_ENABLED: ${FLUXER_DISCOVERY_ENABLED:-true}
+  FLUXER_STRIPE_ENABLED: ${FLUXER_STRIPE_ENABLED:-}
+  FLUXER_STRIPE_SECRET_KEY: ${FLUXER_STRIPE_SECRET_KEY:-}
+  FLUXER_STRIPE_WEBHOOK_SECRET: ${FLUXER_STRIPE_WEBHOOK_SECRET:-}
+  FLUXER_STRIPE_PRICES: ${FLUXER_STRIPE_PRICES:-}
+  FLUXER_STRIPE_LEGACY_PRICES: ${FLUXER_STRIPE_LEGACY_PRICES:-}
+  FLUXER_API_DONATION_PROXY_KEY: ${FLUXER_API_DONATION_PROXY_KEY:-}
+  FLUXER_VISIONARIES_GUILD_ID: ${FLUXER_VISIONARIES_GUILD_ID:-}
+  FLUXER_VISIONARIES_GUILD_VISIONARY_ROLE_ID: ${FLUXER_VISIONARIES_GUILD_VISIONARY_ROLE_ID:-}
+
+  FLUXER_NCMEC_ENABLED: ${FLUXER_NCMEC_ENABLED:-}
+  FLUXER_NCMEC_BASE_URL: ${FLUXER_NCMEC_BASE_URL:-}
+  FLUXER_NCMEC_USERNAME: ${FLUXER_NCMEC_USERNAME:-}
+  FLUXER_NCMEC_PASSWORD: ${FLUXER_NCMEC_PASSWORD:-}
+  FLUXER_NCMEC_REPORTER_EMAIL: ${FLUXER_NCMEC_REPORTER_EMAIL:-}
+  FLUXER_CLAMAV_ENABLED: ${FLUXER_CLAMAV_ENABLED:-}
+  FLUXER_CLAMAV_HOST: ${FLUXER_CLAMAV_HOST:-}
+  FLUXER_CLAMAV_PORT: ${FLUXER_CLAMAV_PORT:-}
+  FLUXER_CLAMAV_FAIL_OPEN: ${FLUXER_CLAMAV_FAIL_OPEN:-}
+
+  FLUXER_APP_PRODUCT_NAME: ${FLUXER_APP_PRODUCT_NAME:-}
+  FLUXER_APP_ICON_URL: ${FLUXER_APP_ICON_URL:-}
+  FLUXER_APP_SYMBOL_URL: ${FLUXER_APP_SYMBOL_URL:-}
+  FLUXER_APP_LOGO_URL: ${FLUXER_APP_LOGO_URL:-}
+  FLUXER_APP_WORDMARK_URL: ${FLUXER_APP_WORDMARK_URL:-}
+  FLUXER_APP_FAVICON_URL: ${FLUXER_APP_FAVICON_URL:-}
+  FLUXER_APP_THEME_COLOR: ${FLUXER_APP_THEME_COLOR:-}
+  FLUXER_APP_STATUS_PAGE_URL: ${FLUXER_APP_STATUS_PAGE_URL:-}
+  FLUXER_APP_STATUS_PAGE_INCIDENT_HISTORY_URL: ${FLUXER_APP_STATUS_PAGE_INCIDENT_HISTORY_URL:-}
+  FLUXER_INSTANCE_SETUP_CONFIGURED: ${FLUXER_INSTANCE_SETUP_CONFIGURED:-}
+  FLUXER_AUTO_JOIN_INVITE_CODE: ${FLUXER_AUTO_JOIN_INVITE_CODE:-}
+  FLUXER_DISCOVERY_ENABLED: ${FLUXER_DISCOVERY_ENABLED:-}
+  FLUXER_DISCOVERY_MIN_MEMBER_COUNT: ${FLUXER_DISCOVERY_MIN_MEMBER_COUNT:-}
+  FLUXER_DELETION_GRACE_PERIOD_HOURS: ${FLUXER_DELETION_GRACE_PERIOD_HOURS:-}
+  FLUXER_API_WORKER_LANE_CONCURRENCY_OVERRIDES: ${FLUXER_API_WORKER_LANE_CONCURRENCY_OVERRIDES:-}
+
+  FLUXER_AUTH_BLUESKY_ENABLED: ${FLUXER_AUTH_BLUESKY_ENABLED:-}
+  FLUXER_AUTH_BLUESKY_CLIENT_NAME: ${FLUXER_AUTH_BLUESKY_CLIENT_NAME:-}
+  FLUXER_AUTH_BLUESKY_CLIENT_URI: ${FLUXER_AUTH_BLUESKY_CLIENT_URI:-}
+  FLUXER_AUTH_BLUESKY_LOGO_URI: ${FLUXER_AUTH_BLUESKY_LOGO_URI:-}
+  FLUXER_AUTH_BLUESKY_TOS_URI: ${FLUXER_AUTH_BLUESKY_TOS_URI:-}
+  FLUXER_AUTH_BLUESKY_POLICY_URI: ${FLUXER_AUTH_BLUESKY_POLICY_URI:-}
+  FLUXER_AUTH_BLUESKY_KEYS: ${FLUXER_AUTH_BLUESKY_KEYS:-}
+
+  FLUXER_PUSH_APNS_ENABLED: ${FLUXER_PUSH_APNS_ENABLED:-}
+  FLUXER_PUSH_APNS_TEAM_ID: ${FLUXER_PUSH_APNS_TEAM_ID:-}
+  FLUXER_PUSH_APNS_KEY_ID: ${FLUXER_PUSH_APNS_KEY_ID:-}
+  FLUXER_PUSH_APNS_PRIVATE_KEY: ${FLUXER_PUSH_APNS_PRIVATE_KEY:-}
+  FLUXER_PUSH_APNS_PRIVATE_KEY_PATH: ${FLUXER_PUSH_APNS_PRIVATE_KEY_PATH:-}
+  FLUXER_PUSH_APNS_APPS: ${FLUXER_PUSH_APNS_APPS:-}

  FLUXER_SUDO_MODE_SECRET: ${FLUXER_SUDO_MODE_SECRET:?set FLUXER_SUDO_MODE_SECRET in .env}
  FLUXER_CONNECTION_INITIATION_SECRET: ${FLUXER_CONNECTION_INITIATION_SECRET:?set FLUXER_CONNECTION_INITIATION_SECRET in .env}
-  FLUXER_SSO_ALLOW_PRIVATE_ADDRESSES: ${FLUXER_SSO_ALLOW_PRIVATE_ADDRESSES:-false}
+  FLUXER_SSO_ALLOW_PRIVATE_ADDRESSES: ${FLUXER_SSO_ALLOW_PRIVATE_ADDRESSES:-}
  FLUXER_VAPID_PUBLIC_KEY: ${FLUXER_VAPID_PUBLIC_KEY:?set FLUXER_VAPID_PUBLIC_KEY in .env}
  FLUXER_VAPID_PRIVATE_KEY: ${FLUXER_VAPID_PRIVATE_KEY:?set FLUXER_VAPID_PRIVATE_KEY in .env}
  FLUXER_VAPID_EMAIL: ${FLUXER_VAPID_EMAIL:-admin@${FLUXER_DOMAIN}}
  FLUXER_PASSKEY_RP_ID: ${FLUXER_PASSKEY_RP_ID:-${FLUXER_DOMAIN}}
-  FLUXER_PASSKEY_RP_NAME: ${FLUXER_PASSKEY_RP_NAME:-Fluxer}
+  FLUXER_PASSKEY_RP_NAME: ${FLUXER_PASSKEY_RP_NAME:-}
  FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS: ${FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}}
  FLUXER_GATEWAY_RPC_AUTH_TOKEN: ${FLUXER_GATEWAY_RPC_AUTH_TOKEN:?set FLUXER_GATEWAY_RPC_AUTH_TOKEN in .env}
  FLUXER_MEDIA_PROXY_SECRET_KEY: ${FLUXER_MEDIA_PROXY_SECRET_KEY:?set FLUXER_MEDIA_PROXY_SECRET_KEY in .env}
  FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64:?set FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64 in .env}
+  FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64: ${FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64:-}
  FLUXER_ADMIN_SECRET_KEY_BASE: ${FLUXER_ADMIN_SECRET_KEY_BASE:?set FLUXER_ADMIN_SECRET_KEY_BASE in .env}
  FLUXER_ADMIN_OAUTH_CLIENT_SECRET: ${FLUXER_ADMIN_OAUTH_CLIENT_SECRET:?set FLUXER_ADMIN_OAUTH_CLIENT_SECRET in .env}

  FLUXER_INTERNAL_API_ENDPOINT: http://api:8080
-  FLUXER_INTERNAL_GATEWAY_ENDPOINT: http://gateway:8080
  FLUXER_INTERNAL_MEDIA_PROXY_ENDPOINT: http://media-proxy:8080
-  FLUXER_MARKETING_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
-  FLUXER_MEDIA_PROXY_ENDPOINT: http://media-proxy:8080
-  FLUXER_MEDIA_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
-  FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+  FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media}
+  FLUXER_MEDIA_PROXY_UPLOAD_RELAY_MAX_BODY_BYTES: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_MAX_BODY_BYTES:-}
+  FLUXER_MEDIA_PROXY_UPLOAD_RELAY_TOKEN_TTL_SECS: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_TOKEN_TTL_SECS:-}
+  FLUXER_MEDIA_PROXY_UPLOAD_RELAY_KEEP_DIRECT_COUNTRIES: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_KEEP_DIRECT_COUNTRIES:-}

 x-fluxer-service: &fluxer-service
-  restart: unless-stopped
+  restart: ${FLUXER_RESTART_POLICY:-unless-stopped}
  networks: [fluxer]

-x-fluxer-svc-healthcheck: &fluxer-svc-healthcheck
-  test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/127.0.0.1/8090 && printf 'GET /_health HTTP/1.0\\r\\n\\r\\n' >&3 && head -n 1 <&3 | grep -q ' 200 '"]
-  interval: 10s
-  timeout: 5s
-  retries: 30
-  start_period: 60s
+x-fluxer-app-healthcheck: &fluxer-app-healthcheck
+  interval: ${FLUXER_HEALTHCHECK_INTERVAL:-10s}
+  timeout: ${FLUXER_HEALTHCHECK_TIMEOUT:-5s}
+  retries: ${FLUXER_APP_HEALTHCHECK_RETRIES:-30}
+  start_period: ${FLUXER_APP_HEALTHCHECK_START_PERIOD:-90s}
  start_interval: 1s

+x-fluxer-svc-healthcheck: &fluxer-svc-healthcheck
+  <<: *fluxer-app-healthcheck
+  start_period: ${FLUXER_SVC_HEALTHCHECK_START_PERIOD:-60s}
+  test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/127.0.0.1/8090 && printf 'GET /_health HTTP/1.0\\r\\n\\r\\n' >&3 && head -n 1 <&3 | grep -q ' 200 '"]
+
 services:
  edge:
-    image: caddy:2.10-alpine
+    <<: *fluxer-service
+    image: ${FLUXER_CADDY_IMAGE:-caddy:2.11-alpine}
    deploy:
      resources:
        limits:
          memory: ${FLUXER_CADDY_MEMORY_LIMIT:-256mb}
-    restart: unless-stopped
-    networks: [fluxer]
    ports:
      - "${FLUXER_HTTP_PORT:-80}:80"
      - "${FLUXER_HTTPS_PORT:-443}:443"
@@ -136,15 +225,17 @@ services:
    environment:
      FLUXER_EDGE_SITE_ADDRESS: ${FLUXER_EDGE_SITE_ADDRESS:-${FLUXER_CADDY_SITE_ADDRESS:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN:?set FLUXER_DOMAIN in .env}}}
      FLUXER_EDGE_TRUSTED_PROXIES: ${FLUXER_EDGE_TRUSTED_PROXIES:-private_ranges}
+      FLUXER_EDGE_ENCODE: ${FLUXER_EDGE_ENCODE:-zstd gzip}
+      FLUXER_ADMIN_BASE_PATH: ${FLUXER_ADMIN_BASE_PATH:-/admin}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - edge-data:/data
      - edge-config:/config
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:2019/config/"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
+      interval: ${FLUXER_HEALTHCHECK_INTERVAL:-10s}
+      timeout: ${FLUXER_HEALTHCHECK_TIMEOUT:-5s}
+      retries: ${FLUXER_HEALTHCHECK_RETRIES:-10}
    depends_on:
      api: {condition: service_started}
      gateway: {condition: service_healthy}
@@ -153,15 +244,14 @@ services:
      admin: {condition: service_started}

  postgres:
-    image: postgres:16-alpine
+    <<: *fluxer-service
+    image: ${FLUXER_POSTGRES_IMAGE:-postgres:16-alpine}
    deploy:
      resources:
        limits:
          memory: ${FLUXER_POSTGRES_MEMORY_LIMIT:-5gb}
        reservations:
          memory: ${FLUXER_POSTGRES_MEMORY_RESERVATION:-3gb}
-    restart: unless-stopped
-    networks: [fluxer]
    command: >
      postgres
      -c max_connections=${FLUXER_POSTGRES_SERVER_MAX_CONNECTIONS:-150}
@@ -170,114 +260,112 @@ services:
      -c work_mem=${FLUXER_POSTGRES_WORK_MEM:-8MB}
      -c maintenance_work_mem=${FLUXER_POSTGRES_MAINTENANCE_WORK_MEM:-256MB}
      -c autovacuum_work_mem=${FLUXER_POSTGRES_AUTOVACUUM_WORK_MEM:-128MB}
-      -c random_page_cost=1.1
-      -c effective_io_concurrency=200
-      -c default_statistics_target=200
-      -c jit=off
-      -c min_wal_size=512MB
-      -c max_wal_size=2GB
-      -c checkpoint_completion_target=0.9
-      -c wal_buffers=16MB
-      -c wal_compression=zstd
-      -c bgwriter_delay=50ms
-      -c bgwriter_lru_maxpages=1000
-      -c autovacuum_vacuum_scale_factor=0.05
-      -c autovacuum_analyze_scale_factor=0.02
-      -c autovacuum_vacuum_cost_limit=2000
-      -c track_io_timing=on
-      -c shared_preload_libraries=pg_stat_statements
-    shm_size: 256mb
+      -c random_page_cost=${FLUXER_POSTGRES_RANDOM_PAGE_COST:-1.1}
+      -c effective_io_concurrency=${FLUXER_POSTGRES_EFFECTIVE_IO_CONCURRENCY:-200}
+      -c default_statistics_target=${FLUXER_POSTGRES_DEFAULT_STATISTICS_TARGET:-200}
+      -c jit=${FLUXER_POSTGRES_JIT:-off}
+      -c min_wal_size=${FLUXER_POSTGRES_MIN_WAL_SIZE:-512MB}
+      -c max_wal_size=${FLUXER_POSTGRES_MAX_WAL_SIZE:-2GB}
+      -c checkpoint_completion_target=${FLUXER_POSTGRES_CHECKPOINT_COMPLETION_TARGET:-0.9}
+      -c wal_buffers=${FLUXER_POSTGRES_WAL_BUFFERS:-16MB}
+      -c wal_compression=${FLUXER_POSTGRES_WAL_COMPRESSION:-zstd}
+      -c bgwriter_delay=${FLUXER_POSTGRES_BGWRITER_DELAY:-50ms}
+      -c bgwriter_lru_maxpages=${FLUXER_POSTGRES_BGWRITER_LRU_MAXPAGES:-1000}
+      -c autovacuum_vacuum_scale_factor=${FLUXER_POSTGRES_AUTOVACUUM_VACUUM_SCALE_FACTOR:-0.05}
+      -c autovacuum_analyze_scale_factor=${FLUXER_POSTGRES_AUTOVACUUM_ANALYZE_SCALE_FACTOR:-0.02}
+      -c autovacuum_vacuum_cost_limit=${FLUXER_POSTGRES_AUTOVACUUM_VACUUM_COST_LIMIT:-2000}
+      -c track_io_timing=${FLUXER_POSTGRES_TRACK_IO_TIMING:-on}
+      -c shared_preload_libraries=${FLUXER_POSTGRES_SHARED_PRELOAD_LIBRARIES:-pg_stat_statements}
+    shm_size: ${FLUXER_POSTGRES_SHM_SIZE:-1gb}
    environment:
-      POSTGRES_DB: fluxer
-      POSTGRES_USER: fluxer
+      POSTGRES_DB: ${FLUXER_POSTGRES_DATABASE:-fluxer}
+      POSTGRES_USER: ${FLUXER_POSTGRES_USERNAME:-fluxer}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U fluxer -d fluxer"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
+      test: ["CMD-SHELL", "pg_isready -U \"$$POSTGRES_USER\" -d \"$$POSTGRES_DB\""]
+      interval: ${FLUXER_HEALTHCHECK_INTERVAL:-10s}
+      timeout: ${FLUXER_HEALTHCHECK_TIMEOUT:-5s}
+      retries: ${FLUXER_HEALTHCHECK_RETRIES:-10}

  valkey:
-    image: valkey/valkey:8.1-alpine
+    <<: *fluxer-service
+    image: ${FLUXER_VALKEY_IMAGE:-valkey/valkey:9.1-alpine}
    deploy:
      resources:
        limits:
          memory: ${FLUXER_VALKEY_MEMORY_LIMIT:-256mb}
-    restart: unless-stopped
-    networks: [fluxer]
-    command: ["valkey-server", "--appendonly", "yes", "--appendfsync", "everysec", "--dir", "/data",
+    command: ["valkey-server", "--appendonly", "yes", "--appendfsync", "${FLUXER_VALKEY_APPENDFSYNC:-everysec}", "--dir", "/data",
              "--maxmemory", "${FLUXER_VALKEY_MAXMEMORY:-192mb}",
              "--maxmemory-policy", "${FLUXER_VALKEY_MAXMEMORY_POLICY:-noeviction}"]
    volumes:
      - valkey-data:/data
    healthcheck:
      test: ["CMD", "valkey-cli", "ping"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
+      interval: ${FLUXER_HEALTHCHECK_INTERVAL:-10s}
+      timeout: ${FLUXER_HEALTHCHECK_TIMEOUT:-5s}
+      retries: ${FLUXER_HEALTHCHECK_RETRIES:-10}

  nats:
-    image: nats:2.14-alpine
+    <<: *fluxer-service
+    image: ${FLUXER_NATS_IMAGE:-nats:2.14-alpine}
    deploy:
      resources:
        limits:
          memory: ${FLUXER_NATS_MEMORY_LIMIT:-256mb}
-    restart: unless-stopped
-    networks: [fluxer]
    command: ["-js", "-sd", "/data", "-m", "8222"]
    volumes:
      - nats-data:/data
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8222/healthz"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
+      interval: ${FLUXER_HEALTHCHECK_INTERVAL:-10s}
+      timeout: ${FLUXER_HEALTHCHECK_TIMEOUT:-5s}
+      retries: ${FLUXER_HEALTHCHECK_RETRIES:-10}

  meilisearch:
-    image: getmeili/meilisearch:v1.12
+    <<: *fluxer-service
+    image: ${FLUXER_MEILISEARCH_IMAGE:-getmeili/meilisearch:v1.53}
    deploy:
      resources:
        limits:
          memory: ${FLUXER_MEILISEARCH_MEMORY_LIMIT:-768mb}
-    restart: unless-stopped
-    networks: [fluxer]
    environment:
-      MEILI_ENV: production
-      MEILI_NO_ANALYTICS: "true"
+      MEILI_ENV: ${FLUXER_MEILISEARCH_ENV:-production}
+      MEILI_NO_ANALYTICS: "${FLUXER_MEILISEARCH_NO_ANALYTICS:-true}"
+      MEILI_UPGRADE_DB: "true"
      MEILI_MAX_INDEXING_MEMORY: ${FLUXER_MEILISEARCH_MAX_INDEXING_MEMORY:-384mb}
      MEILI_MASTER_KEY: ${MEILI_MASTER_KEY:?set MEILI_MASTER_KEY in .env}
    volumes:
      - meilisearch-data:/meili_data
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:7700/health"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
+      interval: ${FLUXER_HEALTHCHECK_INTERVAL:-10s}
+      timeout: ${FLUXER_HEALTHCHECK_TIMEOUT:-5s}
+      retries: ${FLUXER_HEALTHCHECK_RETRIES:-10}

  seaweedfs:
-    image: chrislusf/seaweedfs:4.34
+    <<: *fluxer-service
+    image: ${FLUXER_SEAWEEDFS_IMAGE:-chrislusf/seaweedfs:4.47}
    deploy:
      resources:
        limits:
          memory: ${FLUXER_SEAWEEDFS_MEMORY_LIMIT:-2gb}
-    restart: unless-stopped
-    networks: [fluxer]
    environment:
      GOMEMLIMIT: ${FLUXER_SEAWEEDFS_GOMEMLIMIT:-1536MiB}
-    command: ["server", "-s3", "-dir=/data"]
+      WEED_MASTER_VOLUME_GROWTH_COPY_1: ${FLUXER_SEAWEEDFS_VOLUME_GROWTH:-1}
+    command: ["server", "-s3", "-dir=/data", "-master.telemetry=${FLUXER_SEAWEEDFS_TELEMETRY:-false}"]
    volumes:
      - seaweedfs-data:/data
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8333/healthz"]
-      interval: 10s
-      timeout: 5s
-      retries: 20
-      start_period: 60s
+      interval: ${FLUXER_HEALTHCHECK_INTERVAL:-10s}
+      timeout: ${FLUXER_HEALTHCHECK_TIMEOUT:-5s}
+      retries: ${FLUXER_SEAWEEDFS_HEALTHCHECK_RETRIES:-20}
+      start_period: ${FLUXER_SEAWEEDFS_HEALTHCHECK_START_PERIOD:-60s}

  seaweedfs-init:
-    image: chrislusf/seaweedfs:4.34
+    image: ${FLUXER_SEAWEEDFS_IMAGE:-chrislusf/seaweedfs:4.47}
    deploy:
      resources:
        limits:
@@ -291,16 +379,16 @@ services:
      FLUXER_S3_SECRET_KEY: ${FLUXER_S3_SECRET_KEY:?set FLUXER_S3_SECRET_KEY in .env}
      FLUXER_S3_BUCKET_CDN: ${FLUXER_S3_BUCKET_CDN:-fluxer}
      FLUXER_S3_BUCKET_UPLOADS: ${FLUXER_S3_BUCKET_UPLOADS:-fluxer-uploads}
-      FLUXER_S3_BUCKET_DOWNLOADS: ${FLUXER_S3_BUCKET_DOWNLOADS:-fluxer-downloads}
      FLUXER_S3_BUCKET_REPORTS: ${FLUXER_S3_BUCKET_REPORTS:-fluxer-reports}
      FLUXER_S3_BUCKET_HARVESTS: ${FLUXER_S3_BUCKET_HARVESTS:-fluxer-harvests}
+      FLUXER_SEAWEEDFS_INIT_ATTEMPTS: ${FLUXER_SEAWEEDFS_INIT_ATTEMPTS:-60}
    entrypoint:
      - /bin/sh
      - -c
      - >
-        buckets="$$FLUXER_S3_BUCKET_CDN $$FLUXER_S3_BUCKET_UPLOADS $$FLUXER_S3_BUCKET_DOWNLOADS $$FLUXER_S3_BUCKET_REPORTS $$FLUXER_S3_BUCKET_HARVESTS";
+        buckets="$$FLUXER_S3_BUCKET_CDN $$FLUXER_S3_BUCKET_UPLOADS $$FLUXER_S3_BUCKET_REPORTS $$FLUXER_S3_BUCKET_HARVESTS";
        missing="$$buckets";
-        for attempt in $$(seq 1 60); do
+        for attempt in $$(seq 1 $$FLUXER_SEAWEEDFS_INIT_ATTEMPTS); do
          if ! nc -z seaweedfs 9333 2>/dev/null; then
            sleep 2;
            continue;
@@ -327,18 +415,17 @@ services:
        exit 1;

  livekit:
-    image: livekit/livekit-server:v1.12.0
+    <<: *fluxer-service
+    image: ${FLUXER_LIVEKIT_IMAGE:-livekit/livekit-server:v1.12.0}
    deploy:
      resources:
        limits:
          memory: ${FLUXER_LIVEKIT_MEMORY_LIMIT:-512mb}
-    restart: unless-stopped
-    networks: [fluxer]
    environment:
      LIVEKIT_KEYS: "${LIVEKIT_API_KEY:?set LIVEKIT_API_KEY in .env}: ${LIVEKIT_API_SECRET:?set LIVEKIT_API_SECRET in .env}"
      LIVEKIT_CONFIG: |
        port: 7880
-        log_level: info
+        log_level: ${FLUXER_LIVEKIT_LOG_LEVEL:-info}
        rtc:
          tcp_port: ${FLUXER_LIVEKIT_TCP_PORT:-7881}
          udp_port: ${FLUXER_LIVEKIT_UDP_PORT:-7882}
@@ -356,9 +443,9 @@ services:
      - "${FLUXER_LIVEKIT_UDP_PORT:-7882}:${FLUXER_LIVEKIT_UDP_PORT:-7882}/udp"
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:7880/"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
+      interval: ${FLUXER_HEALTHCHECK_INTERVAL:-10s}
+      timeout: ${FLUXER_HEALTHCHECK_TIMEOUT:-5s}
+      retries: ${FLUXER_HEALTHCHECK_RETRIES:-10}

  api:
    <<: *fluxer-service
@@ -372,16 +459,13 @@ services:
    environment:
      <<: *fluxer-env
      FLUXER_API_PORT: "8080"
-      NODE_OPTIONS: --enable-source-maps${FLUXER_API_NODE_HEAP_MB:+ --max-old-space-size=$FLUXER_API_NODE_HEAP_MB}
-      FLUXER_API_PRESIGNED_ATTACHMENT_UPLOADS_ENABLED: "true"
-      FLUXER_POSTGRES_MAX_CONNECTIONS: "25"
+      NODE_OPTIONS: --enable-source-maps${FLUXER_API_NODE_HEAP_MB:+ --max-old-space-size=$FLUXER_API_NODE_HEAP_MB}${FLUXER_API_NODE_OPTIONS:+ $FLUXER_API_NODE_OPTIONS}
+      NODE_EXTRA_CA_CERTS: ${FLUXER_NODE_EXTRA_CA_CERTS:-/etc/ssl/certs/ca-certificates.crt}
+      FLUXER_POSTGRES_MAX_CONNECTIONS: "${FLUXER_API_POSTGRES_MAX_CONNECTIONS:-25}"
+      FLUXER_API_PRESIGNED_ATTACHMENT_UPLOADS_ENABLED: "${FLUXER_API_PRESIGNED_ATTACHMENT_UPLOADS_ENABLED:-true}"
    healthcheck:
      test: ["CMD-SHELL", "node -e \"fetch('http://127.0.0.1:8080/_health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]
-      interval: 10s
-      timeout: 5s
-      retries: 30
-      start_period: 90s
-      start_interval: 1s
+      <<: *fluxer-app-healthcheck
    depends_on:
      postgres: {condition: service_healthy}
      valkey: {condition: service_healthy}
@@ -406,22 +490,18 @@ services:
          memory: ${FLUXER_WORKER_MEMORY_LIMIT:-2560mb}
        reservations:
          memory: ${FLUXER_WORKER_MEMORY_RESERVATION:-1gb}
-    working_dir: /usr/src/app/fluxer_api
-    command: ["sh", "-c", "if [ -f dist/WorkerEntrypoint.js ]; then exec node dist/WorkerEntrypoint.js; else exec ./node_modules/.bin/tsx src/WorkerEntrypoint.ts; fi"]
+    command: ["node", "dist/WorkerEntrypoint.js"]
    environment:
      <<: *fluxer-env
-      NODE_OPTIONS: --enable-source-maps${FLUXER_WORKER_NODE_HEAP_MB:+ --max-old-space-size=$FLUXER_WORKER_NODE_HEAP_MB}
+      NODE_OPTIONS: --enable-source-maps${FLUXER_WORKER_NODE_HEAP_MB:+ --max-old-space-size=$FLUXER_WORKER_NODE_HEAP_MB}${FLUXER_WORKER_NODE_OPTIONS:+ $FLUXER_WORKER_NODE_OPTIONS}
+      NODE_EXTRA_CA_CERTS: ${FLUXER_NODE_EXTRA_CA_CERTS:-/etc/ssl/certs/ca-certificates.crt}
      FLUXER_API_WORKER_MODE: all_lanes
      FLUXER_API_WORKER_ENABLE_CRON_SCHEDULER: "true"
-      FLUXER_API_WORKER_ENABLE_VOICE_RECONCILIATION: "true"
-      FLUXER_POSTGRES_MAX_CONNECTIONS: "25"
+      FLUXER_POSTGRES_MAX_CONNECTIONS: "${FLUXER_WORKER_POSTGRES_MAX_CONNECTIONS:-25}"
    healthcheck:
      test: ["CMD", "node", "-e", "const age=Date.now()-require('node:fs').statSync('/tmp/fluxer-worker-heartbeat').mtimeMs;if(age>30000){console.error('worker heartbeat is '+Math.round(age)+'ms old');process.exit(1)}"]
-      interval: 10s
-      timeout: 5s
-      retries: 3
-      start_period: 90s
-      start_interval: 1s
+      <<: *fluxer-app-healthcheck
+      retries: ${FLUXER_WORKER_HEALTHCHECK_RETRIES:-3}
    depends_on:
      postgres: {condition: service_healthy}
      valkey: {condition: service_healthy}
@@ -443,18 +523,30 @@ services:
    environment:
      <<: *fluxer-env
      FLUXER_GATEWAY_PORT: "8080"
-      FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
-      FLUXER_GATEWAY_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
-      FLUXER_GATEWAY_LOGGER_LEVEL: info
+      FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT: ${FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT:-${FLUXER_MEDIA_ENDPOINT:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media}}
+      FLUXER_GATEWAY_STATIC_CDN_ENDPOINT: ${FLUXER_GATEWAY_STATIC_CDN_ENDPOINT:-${FLUXER_STATIC_CDN_ENDPOINT:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}}}
+      FLUXER_GATEWAY_LOGGER_LEVEL: ${FLUXER_GATEWAY_LOGGER_LEVEL:-}
+      LOGGER_LEVEL: ${LOGGER_LEVEL:-}
+      FLUXER_GATEWAY_PUSH_ENABLED: ${FLUXER_GATEWAY_PUSH_ENABLED:-}
+      FLUXER_GATEWAY_PUSH_ENROLLED_CLEAR_NOTIFICATIONS_ENABLED: ${FLUXER_GATEWAY_PUSH_ENROLLED_CLEAR_NOTIFICATIONS_ENABLED:-}
+      FLUXER_GATEWAY_PUSH_OUTBOX_REQUEST_TIMEOUT_MS: ${FLUXER_GATEWAY_PUSH_OUTBOX_REQUEST_TIMEOUT_MS:-}
+      FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_ENTRIES: ${FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_ENTRIES:-}
+      FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_BYTES: ${FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_BYTES:-}
+      FLUXER_GATEWAY_HTTP_RPC_MAX_CONCURRENCY: ${FLUXER_GATEWAY_HTTP_RPC_MAX_CONCURRENCY:-}
+      FLUXER_GATEWAY_NATS_RPC_MAX_HANDLERS: ${FLUXER_GATEWAY_NATS_RPC_MAX_HANDLERS:-}
+      FLUXER_GATEWAY_HTTP_FAILURE_THRESHOLD: ${FLUXER_GATEWAY_HTTP_FAILURE_THRESHOLD:-}
+      FLUXER_GATEWAY_HTTP_RECOVERY_TIMEOUT_MS: ${FLUXER_GATEWAY_HTTP_RECOVERY_TIMEOUT_MS:-}
      FLUXER_ERLANG_COOKIE: ${FLUXER_ERLANG_COOKIE:?set FLUXER_ERLANG_COOKIE in .env}
-      FLUXER_ERLANG_SCHEDULERS_MIN: "${FLUXER_ERLANG_SCHEDULERS_MIN:-2}"
-      FLUXER_ERLANG_SCHEDULERS_MAX: "${FLUXER_ERLANG_SCHEDULERS_MAX:-16}"
+      FLUXER_ERLANG_SCHEDULERS: ${FLUXER_ERLANG_SCHEDULERS:-}
+      FLUXER_ERLANG_SCHEDULERS_MIN: ${FLUXER_ERLANG_SCHEDULERS_MIN:-}
+      FLUXER_ERLANG_SCHEDULERS_MAX: ${FLUXER_ERLANG_SCHEDULERS_MAX:-}
+      FLUXER_ERLANG_DIRTY_CPU_SCHEDULERS: ${FLUXER_ERLANG_DIRTY_CPU_SCHEDULERS:-}
    healthcheck:
      test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:8080/_health/ready"]
-      interval: 10s
-      timeout: 5s
-      retries: 30
-      start_period: 90s
+      interval: ${FLUXER_HEALTHCHECK_INTERVAL:-10s}
+      timeout: ${FLUXER_HEALTHCHECK_TIMEOUT:-5s}
+      retries: ${FLUXER_APP_HEALTHCHECK_RETRIES:-30}
+      start_period: ${FLUXER_APP_HEALTHCHECK_START_PERIOD:-90s}
    depends_on:
      nats: {condition: service_healthy}
      valkey: {condition: service_healthy}
@@ -468,16 +560,73 @@ services:
          memory: ${FLUXER_MEDIA_PROXY_MEMORY_LIMIT:-512mb}
    environment:
      <<: *fluxer-env
-      FLUXER_MEDIA_PROXY_HOST: 0.0.0.0
      FLUXER_MEDIA_PROXY_PORT: "8080"
      FLUXER_MEDIA_PROXY_MODE: upload
      FLUXER_MEDIA_PROXY_STORAGE_BACKEND: s3
-      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
-      FLUXER_S3_READ_SIGNED: "true"
+      FLUXER_MEDIA_PROXY_CORS_MODE: ${FLUXER_MEDIA_PROXY_CORS_MODE:-}
+      FLUXER_MEDIA_PROXY_CORS_ALLOWED_ORIGINS: ${FLUXER_MEDIA_PROXY_CORS_ALLOWED_ORIGINS:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}:${FLUXER_PUBLIC_PORT:-443}}}
+      FLUXER_MEDIA_PROXY_ATTACHMENT_SIGNATURE_MODE: ${FLUXER_MEDIA_PROXY_ATTACHMENT_SIGNATURE_MODE:-}
+      FLUXER_MEDIA_PROXY_READ_ONLY: ${FLUXER_MEDIA_PROXY_READ_ONLY:-}
+      FLUXER_MEDIA_PROXY_NSFW_THRESHOLD: ${FLUXER_MEDIA_PROXY_NSFW_THRESHOLD:-}
+      FLUXER_NSFW_SERVICE_ENDPOINT: ${FLUXER_NSFW_SERVICE_ENDPOINT:-}
+      FLUXER_MEDIA_PROXY_MAX_NATIVE_TRANSFORMS: ${FLUXER_MEDIA_PROXY_MAX_NATIVE_TRANSFORMS:-}
+      FLUXER_MEDIA_PROXY_WORKER_QUEUE_CAPACITY: ${FLUXER_MEDIA_PROXY_WORKER_QUEUE_CAPACITY:-}
+      FLUXER_MEDIA_PROXY_MAX_ENCODE_DURATION_MS: ${FLUXER_MEDIA_PROXY_MAX_ENCODE_DURATION_MS:-}
+      FLUXER_MEDIA_PROXY_MAX_ENCODE_FRAMES: ${FLUXER_MEDIA_PROXY_MAX_ENCODE_FRAMES:-}
+      FLUXER_MEDIA_PROXY_TRANSFORM_TIMEOUT_MS: ${FLUXER_MEDIA_PROXY_TRANSFORM_TIMEOUT_MS:-}
+      FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_BYTES: ${FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_BYTES:-}
+      FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_MAX_ENTRY_BYTES: ${FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_MAX_ENTRY_BYTES:-}
+      FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_TTL_MS: ${FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_TTL_MS:-}
+      FLUXER_MEDIA_PROXY_SOCKET_IO_TIMEOUT_MS: ${FLUXER_MEDIA_PROXY_SOCKET_IO_TIMEOUT_MS:-}
+      FLUXER_MEDIA_PROXY_SHUTDOWN_GRACE_MS: ${FLUXER_MEDIA_PROXY_SHUTDOWN_GRACE_MS:-}
+      FLUXER_MEDIA_PROXY_UPLOAD_RELAY_S3_TIMEOUT_MS: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_S3_TIMEOUT_MS:-}
+      FLUXER_MEDIA_PROXY_UPLOAD_RELAY_BUFFERED_RETRY_BYTES: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_BUFFERED_RETRY_BYTES:-}
+      FLUXER_MEDIA_PROXY_UPLOAD_RELAY_BUFFERED_RETRY_TOTAL_BYTES: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_BUFFERED_RETRY_TOTAL_BYTES:-}
+      FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SPOOL_DIR: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SPOOL_DIR:-}
+      FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SPOOL_CHUNK_BYTES: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SPOOL_CHUNK_BYTES:-}
+      FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SPOOL_MAX_TOTAL_BYTES: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SPOOL_MAX_TOTAL_BYTES:-}
+      FLUXER_S3_SESSION_TOKEN: ${FLUXER_S3_SESSION_TOKEN:-}
+      FLUXER_S3_READ_ENDPOINT: ${FLUXER_S3_READ_ENDPOINT:-}
+      FLUXER_S3_READ_BUCKET: ${FLUXER_S3_READ_BUCKET:-}
+      FLUXER_S3_READ_BUCKET_STYLE: ${FLUXER_S3_READ_BUCKET_STYLE:-}
+      FLUXER_S3_READ_SIGNED: "${FLUXER_S3_READ_SIGNED:-true}"
    depends_on:
      seaweedfs-init: {condition: service_completed_successfully}
      nats: {condition: service_healthy}

+  push:
+    <<: *fluxer-service
+    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-push:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_PUSH_MEMORY_LIMIT:-256mb}
+    environment:
+      <<: *fluxer-env
+      FLUXER_PUSH_SERVICE_QUEUE_CAPACITY: ${FLUXER_PUSH_SERVICE_QUEUE_CAPACITY:-}
+      FLUXER_PUSH_SERVICE_SEND_CONCURRENCY: ${FLUXER_PUSH_SERVICE_SEND_CONCURRENCY:-}
+      FLUXER_PUSH_SERVICE_APNS_BASE_URL: ${FLUXER_PUSH_SERVICE_APNS_BASE_URL:-}
+      FLUXER_PUSH_SERVICE_FCM_BASE_URL: ${FLUXER_PUSH_SERVICE_FCM_BASE_URL:-}
+      FLUXER_PUSH_SERVICE_MANAGED_RELAY_HOSTS: ${FLUXER_PUSH_SERVICE_MANAGED_RELAY_HOSTS:-}
+      FLUXER_PUSH_SERVICE_OWN_RELAY_HOSTS: ${FLUXER_PUSH_SERVICE_OWN_RELAY_HOSTS:-}
+      FLUXER_PUSH_SERVICE_RELAY_CONSENT_ACCEPTED: ${FLUXER_PUSH_SERVICE_RELAY_CONSENT_ACCEPTED:-}
+      FLUXER_PUSH_APNS_DEFAULT_ENVIRONMENT: ${FLUXER_PUSH_APNS_DEFAULT_ENVIRONMENT:-}
+      FLUXER_PUSH_FCM_ENABLED: ${FLUXER_PUSH_FCM_ENABLED:-}
+      FLUXER_PUSH_FCM_PROJECT_ID: ${FLUXER_PUSH_FCM_PROJECT_ID:-}
+      FLUXER_PUSH_FCM_CLIENT_EMAIL: ${FLUXER_PUSH_FCM_CLIENT_EMAIL:-}
+      FLUXER_PUSH_FCM_PRIVATE_KEY: ${FLUXER_PUSH_FCM_PRIVATE_KEY:-}
+      FLUXER_PUSH_FCM_PRIVATE_KEY_PATH: ${FLUXER_PUSH_FCM_PRIVATE_KEY_PATH:-}
+      FLUXER_PUSH_FCM_SERVICE_ACCOUNT_JSON_PATH: ${FLUXER_PUSH_FCM_SERVICE_ACCOUNT_JSON_PATH:-}
+      FLUXER_PUSH_FCM_TOKEN_URI: ${FLUXER_PUSH_FCM_TOKEN_URI:-}
+      FLUXER_PUSH_FCM_APPS: ${FLUXER_PUSH_FCM_APPS:-}
+    healthcheck:
+      test: ["CMD", "/usr/local/bin/fluxer-push", "healthcheck"]
+      <<: *fluxer-app-healthcheck
+      start_period: ${FLUXER_SVC_HEALTHCHECK_START_PERIOD:-60s}
+    depends_on:
+      nats: {condition: service_healthy}
+      api: {condition: service_healthy}
+
  static-proxy:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-static:${FLUXER_IMAGE_TAG:-v1}
@@ -487,9 +636,9 @@ services:
          memory: ${FLUXER_STATIC_PROXY_MEMORY_LIMIT:-256mb}
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8080/avatars/0.png"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
+      interval: ${FLUXER_HEALTHCHECK_INTERVAL:-10s}
+      timeout: ${FLUXER_HEALTHCHECK_TIMEOUT:-5s}
+      retries: ${FLUXER_HEALTHCHECK_RETRIES:-10}

  app-proxy:
    <<: *fluxer-service
@@ -499,15 +648,29 @@ services:
        limits:
          memory: ${FLUXER_APP_PROXY_MEMORY_LIMIT:-256mb}
    environment:
-      FLUXER_APP_PROXY_HOST: 0.0.0.0
+      RUST_LOG: ${RUST_LOG:-}
      FLUXER_APP_PROXY_PORT: "8080"
      FLUXER_BASE_DOMAIN: ${FLUXER_DOMAIN:?set FLUXER_DOMAIN in .env}
      FLUXER_PUBLIC_SCHEME: ${FLUXER_PUBLIC_SCHEME:-https}
      FLUXER_PUBLIC_PORT: ${FLUXER_PUBLIC_PORT:-443}
      FLUXER_PUBLIC_ORIGIN: ${FLUXER_PUBLIC_ORIGIN:-}
+      FLUXER_TRUST_CLIENT_IP_HEADER: "${FLUXER_TRUST_CLIENT_IP_HEADER:-true}"
+      FLUXER_CLIENT_IP_HEADER_NAME: ${FLUXER_CLIENT_IP_HEADER_NAME:-}
+      FLUXER_GEOIP_DB_PATH: ${FLUXER_GEOIP_DB_PATH:-}
+      FLUXER_S3_ENDPOINT: ${FLUXER_S3_ENDPOINT:-http://seaweedfs:8333}
+      FLUXER_S3_PUBLIC_ENDPOINT: ${FLUXER_S3_PUBLIC_ENDPOINT:-}
+      FLUXER_S3_REGION: ${FLUXER_S3_REGION:-us-east-1}
+      FLUXER_S3_ACCESS_KEY_ID: ${FLUXER_S3_ACCESS_KEY:?set FLUXER_S3_ACCESS_KEY in .env}
+      FLUXER_S3_SECRET_ACCESS_KEY: ${FLUXER_S3_SECRET_KEY:?set FLUXER_S3_SECRET_KEY in .env}
+      FLUXER_S3_BUCKET_UPLOADS: ${FLUXER_S3_BUCKET_UPLOADS:-}
+      FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_STATIC_CDN_ENDPOINT:-}
      DISCOVERY_UPSTREAM_URL: http://edge:8088/.well-known/fluxer
+      DISCOVERY_REFRESH_INTERVAL_MS: ${DISCOVERY_REFRESH_INTERVAL_MS:-}
      PUBLIC_BOOTSTRAP_API_ENDPOINT: /api
-      PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/api
+      PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT: ${PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/api}
+      FLUXER_APP_PROXY_INDEX_UPSTREAM_URL: ${FLUXER_APP_PROXY_INDEX_UPSTREAM_URL:-}
+      FLUXER_APP_PROXY_SAME_ORIGIN_HOSTS: ${FLUXER_APP_PROXY_SAME_ORIGIN_HOSTS:-}
+      FLUXER_APP_PROXY_MANIFEST_SCOPE_EXTENSIONS: ${FLUXER_APP_PROXY_MANIFEST_SCOPE_EXTENSIONS:-}
      FLUXER_CSP_EXTRA_DEFAULT_SRC: ${FLUXER_CSP_EXTRA_DEFAULT_SRC:-}
      FLUXER_CSP_EXTRA_CONNECT_SRC: ${FLUXER_CSP_EXTRA_CONNECT_SRC:-}
      FLUXER_CSP_EXTRA_IMG_SRC: ${FLUXER_CSP_EXTRA_IMG_SRC:-}
@@ -565,7 +728,6 @@ services:
      <<: *fluxer-env
      FLUXER_SVC_NAME: users
      FLUXER_SVC_MODE: router
-      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-}"
    healthcheck: *fluxer-svc-healthcheck
    depends_on:
      nats: {condition: service_healthy}
@@ -582,8 +744,7 @@ services:
      FLUXER_SVC_NAME: users
      FLUXER_SVC_MODE: shard
      FLUXER_SVC_SHARD_ID: "0"
-      FLUXER_POSTGRES_MAX_CONNECTIONS: "20"
-      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-}"
+      FLUXER_POSTGRES_MAX_CONNECTIONS: "${FLUXER_USERS_SHARD_POSTGRES_MAX_CONNECTIONS:-20}"
    healthcheck: *fluxer-svc-healthcheck
    depends_on:
      nats: {condition: service_healthy}
@@ -600,7 +761,6 @@ services:
      <<: *fluxer-env
      FLUXER_SVC_NAME: gifs
      FLUXER_SVC_MODE: router
-      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
    healthcheck: *fluxer-svc-healthcheck
    depends_on:
      nats: {condition: service_healthy}
@@ -617,7 +777,7 @@ services:
      FLUXER_SVC_NAME: gifs
      FLUXER_SVC_MODE: shard
      FLUXER_SVC_SHARD_ID: "0"
-      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+      FLUXER_GIFS_SHARD_CACHE_MAX_BYTES: ${FLUXER_GIFS_SHARD_CACHE_MAX_BYTES:-}
    healthcheck: *fluxer-svc-healthcheck
    depends_on:
      nats: {condition: service_healthy}
@@ -633,7 +793,6 @@ services:
      <<: *fluxer-env
      FLUXER_SVC_NAME: messages
      FLUXER_SVC_MODE: router
-      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-}"
    healthcheck: *fluxer-svc-healthcheck
    depends_on:
      nats: {condition: service_healthy}
@@ -650,8 +809,7 @@ services:
      FLUXER_SVC_NAME: messages
      FLUXER_SVC_MODE: shard
      FLUXER_SVC_SHARD_ID: "0"
-      FLUXER_POSTGRES_MAX_CONNECTIONS: "20"
-      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-}"
+      FLUXER_POSTGRES_MAX_CONNECTIONS: "${FLUXER_MESSAGES_SHARD_POSTGRES_MAX_CONNECTIONS:-20}"
    healthcheck: *fluxer-svc-healthcheck
    depends_on:
      nats: {condition: service_healthy}
@@ -668,8 +826,6 @@ services:
      <<: *fluxer-env
      FLUXER_SVC_NAME: unfurl
      FLUXER_SVC_MODE: router
-      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
-      FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
    healthcheck: *fluxer-svc-healthcheck
    depends_on:
      nats: {condition: service_healthy}
@@ -686,8 +842,9 @@ services:
      FLUXER_SVC_NAME: unfurl
      FLUXER_SVC_MODE: shard
      FLUXER_SVC_SHARD_ID: "0"
-      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
-      FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
+      FLUXER_MEDIA_PROXY_ENDPOINT: http://media-proxy:8080
+      FLUXER_UNFURL_STATIC_CDN_ENDPOINT: ${FLUXER_UNFURL_STATIC_CDN_ENDPOINT:-}
+      FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_STATIC_CDN_ENDPOINT:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}}
    healthcheck: *fluxer-svc-healthcheck
    depends_on:
      nats: {condition: service_healthy}
@@ -701,22 +858,14 @@ services:
          memory: ${FLUXER_ADMIN_MEMORY_LIMIT:-256mb}
    environment:
      <<: *fluxer-env
-      FLUXER_ADMIN_HOST: 0.0.0.0
      FLUXER_ADMIN_PORT: "8080"
-      FLUXER_ADMIN_BASE_PATH: /admin
+      FLUXER_ADMIN_BASE_PATH: ${FLUXER_ADMIN_BASE_PATH:-/admin}
      FLUXER_API_ENDPOINT: http://api:8080
-      FLUXER_ADMIN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/admin
-      FLUXER_APP_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
-      FLUXER_MEDIA_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
-      FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
-      FLUXER_ADMIN_OAUTH_REDIRECT_URI: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/admin/oauth2_callback
+      FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_STATIC_CDN_ENDPOINT:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}}
    healthcheck:
      test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/127.0.0.1/8080 && printf 'GET /_health HTTP/1.0\\r\\n\\r\\n' >&3 && head -n 1 <&3 | grep -q ' 200 '"]
-      interval: 10s
-      timeout: 5s
-      retries: 30
-      start_period: 60s
-      start_interval: 1s
+      <<: *fluxer-app-healthcheck
+      start_period: ${FLUXER_SVC_HEALTHCHECK_START_PERIOD:-60s}
    depends_on:
      api: {condition: service_healthy}

@@ -0,0 +1,14 @@
+services:
+  seaweedfs:
+    profiles: [bundled-object-store]
+  seaweedfs-init:
+    profiles: [bundled-object-store]
+  api:
+    depends_on:
+      seaweedfs-init: !reset null
+  worker:
+    depends_on:
+      seaweedfs-init: !reset null
+  media-proxy:
+    depends_on:
+      seaweedfs-init: !reset null
@@ -9,32 +9,32 @@ build = "build.rs"
 [dependencies]
 anyhow = "1.0.104"
 axum = { version = "0.8.9", features = ["macros"] }
-base64 = "0.22.1"
+base64 = "0.23.1"
 chrono = { version = "0.4", default-features = false, features = ["serde"] }
-cookie = "0.18.1"
+cookie = "0.18.2"
 fluxer_common = { path = "../fluxer_common" }
 hmac = "0.13.0"
 maud = { version = "0.27.0", features = ["axum"] }
 rand = "0.10"
-regress = "0.11"
-reqwest = { version = "0.13.4", default-features = false, features = ["json", "rustls"] }
-serde = { version = "1.0.228", features = ["derive"] }
-serde_json = "1.0.150"
+regress = "0.12"
+reqwest = { version = "0.13.5", default-features = false, features = ["json", "rustls"] }
+serde = { version = "1.0.229", features = ["derive"] }
+serde_json = "1.0.151"
 sha2 = "0.11.0"
-time = { version = "0.3.47", features = ["formatting", "parsing"] }
-tokio = { version = "1.52.3", features = ["macros", "net", "rt-multi-thread", "signal"] }
+time = { version = "0.3.55", features = ["formatting", "parsing"] }
+tokio = { version = "1.53.1", features = ["macros", "net", "rt-multi-thread", "signal"] }
 tower = { version = "0.5.3", features = ["util"] }
-tower-http = { version = "0.6.11", features = ["compression-gzip", "trace"] }
+tower-http = { version = "0.7.1", features = ["compression-gzip", "trace"] }
 tracing = "0.1.44"
-tracing-subscriber = { version = "0.3.23", features = ["env-filter"] }
+tracing-subscriber = "0.3.23"
 url = "2.5"
 urlencoding = "2.1.3"
-progenitor-client = { version = "0.14.0", default-features = false }
+progenitor-client = { version = "0.15.0", default-features = false }

 [build-dependencies]
 openapiv3 = "2.2.0"
-prettyplease = "0.2"
-progenitor = { version = "0.14.0", default-features = false }
+prettyplease = "0.3"
+progenitor = { version = "0.15.0", default-features = false }
 serde_json = "1"
 sha2 = "0.11.0"
-syn = "2"
+syn = "3"
@@ -1,15 +1,14 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later

-FROM rust:1-bookworm AS builder
+FROM rust:1-trixie AS builder

-ARG BUILD_VERSION=""
 ARG TARGETARCH

 WORKDIR /usr/src/app

 RUN apt-get update \
 	&& apt-get install -y --no-install-recommends ca-certificates nodejs npm pkg-config \
-	&& npm install -g pnpm@10.29.3 \
+	&& npm install -g pnpm@11.27.0 \
 	&& rm -rf /var/lib/apt/lists/*

 RUN npm install --no-audit --no-fund @tailwindcss/[email protected] [email protected]
@@ -45,8 +44,6 @@ RUN printf '%s\n' \
 	'strip = "symbols"' \
 	> Cargo.toml

-ENV FLUXER_BUILD_VERSION="${BUILD_VERSION}"
-
 RUN cargo build --release -p fluxer_admin \
 	&& cp target/release/fluxer_admin /usr/local/bin/fluxer-admin

@@ -57,7 +54,7 @@ RUN test "$(ls target/release/build/fluxer_admin-*/out/static/fonts/*.woff2 | wc
 	&& ls target/release/build/fluxer_admin-*/out/static/fonts/fonts.*.css \
 	&& echo "Latin-core fonts bundled successfully"

-FROM debian:bookworm-slim AS runtime
+FROM debian:trixie-slim AS runtime

 ARG BUILD_VERSION=""
 ARG SOURCE_SHA=""
@@ -35,25 +35,423 @@ fn generate_admin_api(manifest_dir: &Path, out_dir: &Path) {
    }

    let json_str = fs::read_to_string(&spec_path).expect("failed to read openapi-admin.json");
-    let spec: openapiv3::OpenAPI =
+    let mut spec: openapiv3::OpenAPI =
        serde_json::from_str(&json_str).expect("failed to parse openapi-admin.json");
+    adapt_progenitor_throttled_errors(&mut spec);
+    relax_guild_audit_log_schemas(&mut spec);
+    relax_progenitor_schema_strictness(&mut spec);

    let mut settings = progenitor::GenerationSettings::new();
    settings.with_interface(progenitor::InterfaceStyle::Positional);
+    settings.with_inner_type(
+        "reqwest::header::HeaderMap"
+            .parse()
+            .expect("valid generated client header type"),
+    );

    let mut generator = progenitor::Generator::new(&settings);
    let tokens = generator
        .generate_tokens(&spec)
        .expect("failed to generate admin API client");

-    let content = prettyplease::unparse(
+    let content = relax_required_nullable_fields(&prettyplease::unparse(
        &syn::parse2::<syn::File>(tokens).expect("failed to parse generated tokens"),
-    );
+    ));

    let output_path = out_dir.join("admin_api_generated.rs");
    fs::write(&output_path, content).expect("failed to write generated API code");
 }

+fn adapt_progenitor_throttled_errors(spec: &mut openapiv3::OpenAPI) {
+    let schemas = &spec
+        .components
+        .as_ref()
+        .expect("missing API components")
+        .schemas;
+    let error = serde_json::to_value(schemas.get("Error").expect("missing Error schema"))
+        .expect("failed to inspect Error schema");
+    let mut throttled = serde_json::to_value(
+        schemas
+            .get("ThrottledError")
+            .expect("missing ThrottledError schema"),
+    )
+    .expect("failed to inspect ThrottledError schema");
+    assert_eq!(
+        error["additionalProperties"],
+        serde_json::json!({}),
+        "Progenitor error adaptation requires Error to retain all additional fields"
+    );
+    let properties = throttled["properties"]
+        .as_object_mut()
+        .expect("ThrottledError must be an object schema");
+    assert_eq!(
+        properties
+            .remove("retry_after")
+            .expect("missing retry_after")["type"],
+        "number"
+    );
+    assert_eq!(
+        properties.remove("global").expect("missing global")["type"],
+        "boolean"
+    );
+    assert_eq!(
+        throttled, error,
+        "ThrottledError must extend the common Error schema"
+    );
+
+    for path in spec.paths.paths.values_mut() {
+        let openapiv3::ReferenceOr::Item(path) = path else {
+            panic!("Progenitor error adaptation requires inline API paths");
+        };
+        for operation in [
+            &mut path.get,
+            &mut path.put,
+            &mut path.post,
+            &mut path.delete,
+            &mut path.options,
+            &mut path.head,
+            &mut path.patch,
+            &mut path.trace,
+        ]
+        .into_iter()
+        .flatten()
+        {
+            let Some(response) = operation
+                .responses
+                .responses
+                .get_mut(&openapiv3::StatusCode::Code(429))
+            else {
+                continue;
+            };
+            let openapiv3::ReferenceOr::Item(response) = response else {
+                panic!("Progenitor error adaptation requires inline 429 responses");
+            };
+            let schema = &mut response
+                .content
+                .get_mut("application/json")
+                .expect("429 responses must return JSON")
+                .schema;
+            assert_eq!(
+                schema,
+                &Some(openapiv3::ReferenceOr::ref_(
+                    "#/components/schemas/ThrottledError"
+                )),
+                "Progenitor only supports one error type per operation"
+            );
+            *schema = Some(openapiv3::ReferenceOr::ref_("#/components/schemas/Error"));
+        }
+    }
+}
+
+fn relax_guild_audit_log_schemas(spec: &mut openapiv3::OpenAPI) {
+    let components = spec.components.as_mut().expect("missing API components");
+
+    let entry = object_schema_mut(components, "GuildAuditLogEntryResponse");
+    entry.additional_properties = None;
+    let openapiv3::ReferenceOr::Item(options) = entry
+        .properties
+        .get_mut("options")
+        .expect("GuildAuditLogEntryResponse has no options property")
+    else {
+        panic!("GuildAuditLogEntryResponse options must be an inline schema");
+    };
+    let openapiv3::SchemaKind::Type(openapiv3::Type::Object(options)) = &mut options.schema_kind
+    else {
+        panic!("GuildAuditLogEntryResponse options must be an object schema");
+    };
+    options.additional_properties = None;
+
+    let change = object_schema_mut(components, "AuditLogChangeSchema");
+    change.additional_properties = None;
+    for property in ["old_value", "new_value"] {
+        change.properties.insert(
+            property.to_string(),
+            openapiv3::ReferenceOr::Item(Box::new(openapiv3::Schema {
+                schema_data: openapiv3::SchemaData::default(),
+                schema_kind: openapiv3::SchemaKind::Any(openapiv3::AnySchema::default()),
+            })),
+        );
+    }
+}
+
+fn object_schema_mut<'a>(
+    components: &'a mut openapiv3::Components,
+    name: &str,
+) -> &'a mut openapiv3::ObjectType {
+    let Some(openapiv3::ReferenceOr::Item(schema)) = components.schemas.get_mut(name) else {
+        panic!("missing inline {name} schema");
+    };
+    let openapiv3::SchemaKind::Type(openapiv3::Type::Object(object)) = &mut schema.schema_kind
+    else {
+        panic!("{name} must be an object schema");
+    };
+    object
+}
+
+const MAX_SCHEMA_REFERENCE_DEPTH: usize = 32;
+
+fn relax_required_nullable_fields(generated: &str) -> String {
+    const PRESENCE_CHECK: &str =
+        "#[serde(deserialize_with = \"::std::option::Option::deserialize\")]";
+    generated
+        .lines()
+        .filter(|line| line.trim() != PRESENCE_CHECK)
+        .flat_map(|line| [line, "\n"])
+        .collect()
+}
+
+fn relax_progenitor_schema_strictness(spec: &mut openapiv3::OpenAPI) {
+    let registry = spec.components.clone().unwrap_or_default();
+
+    if let Some(components) = spec.components.as_mut() {
+        for schema in components.schemas.values_mut() {
+            relax_schema_reference(schema, &registry);
+        }
+        for response in components.responses.values_mut() {
+            if let openapiv3::ReferenceOr::Item(response) = response {
+                relax_response(response, &registry);
+            }
+        }
+        for parameter in components.parameters.values_mut() {
+            if let openapiv3::ReferenceOr::Item(parameter) = parameter {
+                relax_parameter(parameter, &registry);
+            }
+        }
+        for request_body in components.request_bodies.values_mut() {
+            if let openapiv3::ReferenceOr::Item(request_body) = request_body {
+                relax_content(&mut request_body.content, &registry);
+            }
+        }
+        for header in components.headers.values_mut() {
+            if let openapiv3::ReferenceOr::Item(header) = header {
+                relax_parameter_format(&mut header.format, &registry);
+            }
+        }
+    }
+
+    for path in spec.paths.paths.values_mut() {
+        let openapiv3::ReferenceOr::Item(path) = path else {
+            continue;
+        };
+        for parameter in &mut path.parameters {
+            if let openapiv3::ReferenceOr::Item(parameter) = parameter {
+                relax_parameter(parameter, &registry);
+            }
+        }
+        for operation in [
+            &mut path.get,
+            &mut path.put,
+            &mut path.post,
+            &mut path.delete,
+            &mut path.options,
+            &mut path.head,
+            &mut path.patch,
+            &mut path.trace,
+        ]
+        .into_iter()
+        .flatten()
+        {
+            for parameter in &mut operation.parameters {
+                if let openapiv3::ReferenceOr::Item(parameter) = parameter {
+                    relax_parameter(parameter, &registry);
+                }
+            }
+            if let Some(openapiv3::ReferenceOr::Item(request_body)) =
+                operation.request_body.as_mut()
+            {
+                relax_content(&mut request_body.content, &registry);
+            }
+            for response in operation
+                .responses
+                .responses
+                .values_mut()
+                .chain(operation.responses.default.iter_mut())
+            {
+                if let openapiv3::ReferenceOr::Item(response) = response {
+                    relax_response(response, &registry);
+                }
+            }
+        }
+    }
+}
+
+fn relax_response(response: &mut openapiv3::Response, registry: &openapiv3::Components) {
+    relax_content(&mut response.content, registry);
+    for header in response.headers.values_mut() {
+        if let openapiv3::ReferenceOr::Item(header) = header {
+            relax_parameter_format(&mut header.format, registry);
+        }
+    }
+}
+
+fn relax_content(content: &mut openapiv3::Content, registry: &openapiv3::Components) {
+    for media_type in content.values_mut() {
+        if let Some(schema) = media_type.schema.as_mut() {
+            relax_schema_reference(schema, registry);
+        }
+    }
+}
+
+fn relax_parameter(parameter: &mut openapiv3::Parameter, registry: &openapiv3::Components) {
+    let format = match parameter {
+        openapiv3::Parameter::Query { parameter_data, .. }
+        | openapiv3::Parameter::Header { parameter_data, .. }
+        | openapiv3::Parameter::Path { parameter_data, .. }
+        | openapiv3::Parameter::Cookie { parameter_data, .. } => &mut parameter_data.format,
+    };
+    relax_parameter_format(format, registry);
+}
+
+fn relax_parameter_format(
+    format: &mut openapiv3::ParameterSchemaOrContent,
+    registry: &openapiv3::Components,
+) {
+    match format {
+        openapiv3::ParameterSchemaOrContent::Schema(schema) => {
+            relax_schema_reference(schema, registry)
+        }
+        openapiv3::ParameterSchemaOrContent::Content(content) => relax_content(content, registry),
+    }
+}
+
+fn relax_schema_reference(
+    schema: &mut openapiv3::ReferenceOr<openapiv3::Schema>,
+    registry: &openapiv3::Components,
+) {
+    if let openapiv3::ReferenceOr::Item(schema) = schema {
+        relax_schema(schema, registry);
+    }
+}
+
+fn relax_boxed_schema_reference(
+    schema: &mut openapiv3::ReferenceOr<Box<openapiv3::Schema>>,
+    registry: &openapiv3::Components,
+) {
+    if let openapiv3::ReferenceOr::Item(schema) = schema {
+        relax_schema(schema, registry);
+    }
+}
+
+fn relax_schema(schema: &mut openapiv3::Schema, registry: &openapiv3::Components) {
+    if flattens_objects_beside_scalars(&schema.schema_kind, registry) {
+        schema.schema_kind = openapiv3::SchemaKind::Any(openapiv3::AnySchema::default());
+        return;
+    }
+    match &mut schema.schema_kind {
+        openapiv3::SchemaKind::Type(openapiv3::Type::Object(object)) => {
+            relax_additional_properties(&mut object.additional_properties, registry);
+            for property in object.properties.values_mut() {
+                relax_boxed_schema_reference(property, registry);
+            }
+        }
+        openapiv3::SchemaKind::Type(openapiv3::Type::Array(array)) => {
+            if let Some(items) = array.items.as_mut() {
+                relax_boxed_schema_reference(items, registry);
+            }
+        }
+        openapiv3::SchemaKind::Type(_) => {}
+        openapiv3::SchemaKind::OneOf { one_of: subschemas }
+        | openapiv3::SchemaKind::AllOf { all_of: subschemas }
+        | openapiv3::SchemaKind::AnyOf { any_of: subschemas } => {
+            for subschema in subschemas {
+                relax_schema_reference(subschema, registry);
+            }
+        }
+        openapiv3::SchemaKind::Not { not } => relax_schema_reference(not, registry),
+        openapiv3::SchemaKind::Any(any) => {
+            relax_additional_properties(&mut any.additional_properties, registry);
+            for property in any.properties.values_mut() {
+                relax_boxed_schema_reference(property, registry);
+            }
+            if let Some(items) = any.items.as_mut() {
+                relax_boxed_schema_reference(items, registry);
+            }
+            for subschema in any
+                .one_of
+                .iter_mut()
+                .chain(any.all_of.iter_mut())
+                .chain(any.any_of.iter_mut())
+            {
+                relax_schema_reference(subschema, registry);
+            }
+            if let Some(not) = any.not.as_mut() {
+                relax_schema_reference(not, registry);
+            }
+        }
+    }
+}
+
+fn relax_additional_properties(
+    additional_properties: &mut Option<openapiv3::AdditionalProperties>,
+    registry: &openapiv3::Components,
+) {
+    match additional_properties {
+        Some(openapiv3::AdditionalProperties::Any(false)) => *additional_properties = None,
+        Some(openapiv3::AdditionalProperties::Schema(schema)) => {
+            relax_schema_reference(schema, registry)
+        }
+        _ => {}
+    }
+}
+
+fn flattens_objects_beside_scalars(
+    schema_kind: &openapiv3::SchemaKind,
+    registry: &openapiv3::Components,
+) -> bool {
+    let subschemas = match schema_kind {
+        openapiv3::SchemaKind::OneOf { one_of } => one_of,
+        openapiv3::SchemaKind::AnyOf { any_of } => any_of,
+        _ => return false,
+    };
+    let mut objects = false;
+    let mut scalars = false;
+    for subschema in subschemas {
+        if resolves_to_object(subschema, registry, MAX_SCHEMA_REFERENCE_DEPTH) {
+            objects = true;
+        } else {
+            scalars = true;
+        }
+    }
+    objects && scalars
+}
+
+fn resolves_to_object(
+    schema: &openapiv3::ReferenceOr<openapiv3::Schema>,
+    registry: &openapiv3::Components,
+    depth: usize,
+) -> bool {
+    let Some(depth) = depth.checked_sub(1) else {
+        return false;
+    };
+    let schema = match schema {
+        openapiv3::ReferenceOr::Reference { reference } => {
+            let Some(target) = reference
+                .strip_prefix("#/components/schemas/")
+                .and_then(|name| registry.schemas.get(name))
+            else {
+                return false;
+            };
+            return resolves_to_object(target, registry, depth);
+        }
+        openapiv3::ReferenceOr::Item(schema) => schema,
+    };
+    match &schema.schema_kind {
+        openapiv3::SchemaKind::Type(openapiv3::Type::Object(_)) => true,
+        openapiv3::SchemaKind::Type(_) => false,
+        openapiv3::SchemaKind::OneOf { one_of: subschemas }
+        | openapiv3::SchemaKind::AllOf { all_of: subschemas }
+        | openapiv3::SchemaKind::AnyOf { any_of: subschemas } => subschemas
+            .iter()
+            .any(|subschema| resolves_to_object(subschema, registry, depth)),
+        openapiv3::SchemaKind::Not { .. } => false,
+        openapiv3::SchemaKind::Any(any) => {
+            any.typ.as_deref() == Some("object")
+                || !any.properties.is_empty()
+                || any.additional_properties.is_some()
+        }
+    }
+}
+
 struct Face {
    css_family: String,
    weight: u64,
@@ -17,9 +17,6 @@ pub const JOBS_CANCEL: &str = "jobs:cancel";
 pub const BAN_EMAIL_ADD: &str = "ban:email:add";
 pub const BAN_EMAIL_CHECK: &str = "ban:email:check";
 pub const BAN_EMAIL_REMOVE: &str = "ban:email:remove";
-pub const SUSPICIOUS_EMAIL_DOMAIN_ADD: &str = "suspicious_email_domain:add";
-pub const SUSPICIOUS_EMAIL_DOMAIN_CHECK: &str = "suspicious_email_domain:check";
-pub const SUSPICIOUS_EMAIL_DOMAIN_REMOVE: &str = "suspicious_email_domain:remove";
 pub const BAN_PHRASE_ADD: &str = "ban:phrase:add";
 pub const BAN_PHRASE_CHECK: &str = "ban:phrase:check";
 pub const BAN_PHRASE_REMOVE: &str = "ban:phrase:remove";
@@ -79,7 +76,6 @@ pub const REPORT_RESOLVE: &str = "report:resolve";
 pub const REPORT_VIEW: &str = "report:view";
 pub const REPORT_VIEW_REPORTER_PII: &str = "report:view:reporter_pii";
 pub const SYSTEM_DM_SEND: &str = "system_dm:send";
-pub const SYSTEM_HEAP_SNAPSHOT: &str = "system:heap_snapshot";
 pub const USER_CANCEL_BULK_MESSAGE_DELETION: &str = "user:cancel:bulk_message_deletion";
 pub const USER_DELETE: &str = "user:delete";
 pub const USER_DISABLE_SUSPICIOUS: &str = "user:disable:suspicious";
@@ -130,9 +126,6 @@ pub const ALL_ACLS: &[&str] = &[
    BAN_EMAIL_ADD,
    BAN_EMAIL_CHECK,
    BAN_EMAIL_REMOVE,
-    SUSPICIOUS_EMAIL_DOMAIN_ADD,
-    SUSPICIOUS_EMAIL_DOMAIN_CHECK,
-    SUSPICIOUS_EMAIL_DOMAIN_REMOVE,
    BAN_PHRASE_ADD,
    BAN_PHRASE_CHECK,
    BAN_PHRASE_REMOVE,
@@ -192,7 +185,6 @@ pub const ALL_ACLS: &[&str] = &[
    REPORT_VIEW,
    REPORT_VIEW_REPORTER_PII,
    SYSTEM_DM_SEND,
-    SYSTEM_HEAP_SNAPSHOT,
    USER_CANCEL_BULK_MESSAGE_DELETION,
    USER_DELETE,
    USER_DISABLE_SUSPICIOUS,
@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+use crate::templates::components::tooltip::{Hint, HintLink};
+
+pub fn limit_key_hint(key: &str) -> Option<Hint<'static>> {
+    match key {
+        "feature_guild_create" => Some(Hint {
+            name: Some("Community Creation Access"),
+            body: "Admins with the wildcard ACL can always create communities.",
+            link: Some(HintLink::new(
+                "/instance-config#community-creation",
+                "Community creation policy",
+            )),
+        }),
+        _ => None,
+    }
+}
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{CreateAdminApiKeyResponse, ListAdminApiKeyEntry};
@@ -35,7 +35,7 @@ impl AdminApiClient {
    }

    pub async fn revoke_api_key(&self, key_id: &str) -> ApiResult<()> {
-        let key_id = generated_types::SnowflakeType::from(key_id.to_owned());
+        let key_id = snowflake(key_id);
        self.generated()
            .delete_admin_api_key(&key_id)
            .await
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{Archive, ArchiveDownloadUrlResponse, ListArchivesResponse};
@@ -12,7 +12,7 @@ impl AdminApiClient {
        include_attachments: bool,
    ) -> ApiResult<Archive> {
        let body = generated_types::AdminArchiveCreateRequest {
-            include_attachments: include_attachments.then_some(true),
+            include_attachments,
        };
        let response = self
            .generated()
@@ -28,7 +28,7 @@ impl AdminApiClient {
        include_attachments: bool,
    ) -> ApiResult<Archive> {
        let body = generated_types::AdminArchiveCreateRequest {
-            include_attachments: include_attachments.then_some(true),
+            include_attachments,
        };
        let response = self
            .generated()
@@ -78,15 +78,17 @@ impl AdminApiClient {
        subject_id: &str,
        archive_id: &str,
    ) -> ApiResult<ArchiveDownloadUrlResponse> {
+        let subject_type = generated_types::ArchiveSubjectTypeSchema::try_from(subject_type)
+            .map_err(|e| ApiError::Parse(e.to_string()))?;
        let response = self
            .generated()
-            .get_admin_archive_download(subject_type, subject_id, archive_id)
+            .get_admin_archive_download(
+                subject_type,
+                &snowflake(subject_id),
+                &snowflake(archive_id),
+            )
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }
 }
-
-fn snowflake(value: &str) -> generated_types::SnowflakeType {
-    generated_types::SnowflakeType::from(value.to_owned())
-}
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiResult};

@@ -13,10 +13,7 @@ impl AdminApiClient {
        let body = generated_types::PurgeGuildAssetsRequest { ids: ids.to_vec() };
        let response = self
            .generated()
-            .purge_admin_guild_assets(
-                &generated_types::SnowflakeType::from(guild_id.to_owned()),
-                &body,
-            )
+            .purge_admin_guild_assets(&snowflake(guild_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -3,8 +3,6 @@
 use crate::api::generated::types as generated_types;

 use super::client::{AdminApiClient, ApiError, ApiResult};
-#[cfg(test)]
-use super::types::AuditLogEntry;
 use super::types::AuditLogsListResponse;

 pub struct SearchAuditLogsParams {
@@ -12,10 +10,11 @@ pub struct SearchAuditLogsParams {
    pub admin_user_id: Option<String>,
    pub target_id: Option<String>,
    pub target_type: Option<String>,
+    pub access: Option<String>,
    pub sort_by: Option<String>,
    pub sort_order: Option<String>,
    pub limit: u32,
-    pub offset: u32,
+    pub offset: u64,
 }

 impl AdminApiClient {
@@ -23,6 +22,12 @@ impl AdminApiClient {
        &self,
        params: &SearchAuditLogsParams,
    ) -> ApiResult<AuditLogsListResponse> {
+        let access = params
+            .access
+            .as_deref()
+            .map(audit_access)
+            .transpose()?
+            .map(|value| value.to_string());
        let sort_by = params
            .sort_by
            .as_deref()
@@ -38,65 +43,29 @@ impl AdminApiClient {
        let limit = params.limit.to_string();
        let offset = params.offset.to_string();
        let query_params = [
-            (
-                "q",
-                nonempty_string(params.query.as_deref()).unwrap_or_default(),
-            ),
+            ("q", params.query.as_deref().unwrap_or_default()),
            (
                "admin_user_id",
-                nonempty_string(params.admin_user_id.as_deref()).unwrap_or_default(),
+                params.admin_user_id.as_deref().unwrap_or_default(),
            ),
            (
                "target_type",
-                nonempty_string(params.target_type.as_deref()).unwrap_or_default(),
+                params.target_type.as_deref().unwrap_or_default(),
            ),
-            (
-                "target_id",
-                nonempty_string(params.target_id.as_deref()).unwrap_or_default(),
-            ),
-            ("sort_by", sort_by.unwrap_or_default()),
-            ("sort_order", sort_order.unwrap_or_default()),
-            ("limit", limit),
-            ("offset", offset),
+            ("target_id", params.target_id.as_deref().unwrap_or_default()),
+            ("access", access.as_deref().unwrap_or_default()),
+            ("sort_by", sort_by.as_deref().unwrap_or_default()),
+            ("sort_order", sort_order.as_deref().unwrap_or_default()),
+            ("limit", limit.as_str()),
+            ("offset", offset.as_str()),
        ];
-        let query_params: Vec<(&str, &str)> = query_params
-            .iter()
-            .map(|(key, value)| (*key, value.as_str()))
-            .collect();
        self.get("/admin/audit-logs", Some(&query_params)).await
    }
 }

-#[cfg(test)]
-fn audit_logs_response(
-    response: generated_types::AuditLogsListResponseSchema,
-) -> ApiResult<AuditLogsListResponse> {
-    Ok(AuditLogsListResponse {
-        logs: response.logs.into_iter().map(audit_log_entry).collect(),
-        total: crate::api::generated::number_to_u64(response.total, "total")
-            .map_err(ApiError::Parse)?,
-    })
-}
-
-#[cfg(test)]
-fn audit_log_entry(entry: generated_types::AdminAuditLogResponseSchema) -> AuditLogEntry {
-    AuditLogEntry {
-        log_id: String::from(entry.log_id),
-        admin_user_id: String::from(entry.admin_user_id),
-        admin_user: None,
-        action: entry.action,
-        target_id: entry.target_id,
-        target_type: entry.target_type,
-        target_user: None,
-        target_guild: None,
-        target_channel: None,
-        related_users: Default::default(),
-        related_guilds: Default::default(),
-        related_channels: Default::default(),
-        audit_log_reason: entry.audit_log_reason,
-        metadata: entry.metadata,
-        created_at: entry.created_at,
-    }
+fn audit_access(value: &str) -> ApiResult<generated_types::ListAdminAuditLogsAccess> {
+    generated_types::ListAdminAuditLogsAccess::try_from(value)
+        .map_err(|e| ApiError::Parse(e.to_string()))
 }

 fn audit_sort_by(value: &str) -> ApiResult<generated_types::ListAdminAuditLogsSortBy> {
@@ -113,12 +82,6 @@ fn audit_sort_order(value: &str) -> ApiResult<generated_types::ListAdminAuditLog
        .map_err(|e| ApiError::Parse(e.to_string()))
 }

-fn nonempty_string(value: Option<&str>) -> Option<String> {
-    value
-        .filter(|value| !value.is_empty())
-        .map(std::borrow::ToOwned::to_owned)
-}
-
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -133,12 +96,69 @@ mod tests {
        assert_eq!(audit_sort_order("desc").unwrap().to_string(), "desc");
    }

+    #[test]
+    fn accepts_only_known_access_filters() {
+        assert_eq!(audit_access("read").unwrap().to_string(), "read");
+        assert_eq!(audit_access("write").unwrap().to_string(), "write");
+        assert!(audit_access("all").is_err());
+    }
+
    #[test]
    fn rejects_lossy_audit_totals() {
-        let response = generated_types::AuditLogsListResponseSchema {
-            logs: Vec::new(),
-            total: 1.5,
-        };
-        assert!(audit_logs_response(response).is_err());
+        for total in [serde_json::json!(1.5), serde_json::json!(-1)] {
+            let response = serde_json::json!({"logs": [], "total": total});
+            assert!(serde_json::from_value::<AuditLogsListResponse>(response).is_err());
+        }
+    }
+
+    #[test]
+    fn deserializes_audit_fields_without_losing_generated_string_values() {
+        let json = serde_json::json!({
+            "logs": [{
+                "log_id": "123456789012345678",
+                "admin_user_id": "234567890123456789",
+                "admin_user": null,
+                "action": "USER_UPDATE",
+                "access": "write",
+                "target_id": "345678901234567890",
+                "target_type": "user",
+                "target_user": null,
+                "target_guild": null,
+                "target_channel": null,
+                "related_users": {},
+                "related_guilds": {},
+                "related_channels": {},
+                "audit_log_reason": "Account review",
+                "metadata": {"field": "username"},
+                "created_at": "2026-09-11T12:00:00.000Z"
+            }],
+            "total": 1
+        });
+        let generated: generated_types::AuditLogsListResponseSchema =
+            serde_json::from_value(json.clone()).unwrap();
+        assert_eq!(generated.logs[0].action.to_string(), "USER_UPDATE");
+
+        let response: AuditLogsListResponse = serde_json::from_value(json.clone()).unwrap();
+        assert_eq!(response.logs[0].access.as_deref(), Some("write"));
+        assert_eq!(serde_json::to_value(response).unwrap(), json);
+    }
+
+    #[test]
+    fn deserializes_audit_entries_from_an_api_without_access() {
+        let json = serde_json::json!({
+            "logs": [{
+                "log_id": "123456789012345678",
+                "admin_user_id": "234567890123456789",
+                "action": "USER_UPDATE",
+                "target_id": "345678901234567890",
+                "target_type": "user",
+                "audit_log_reason": null,
+                "metadata": {},
+                "created_at": "2026-09-11T12:00:00.000Z"
+            }],
+            "total": 1
+        });
+        let response: AuditLogsListResponse = serde_json::from_value(json).unwrap();
+        assert_eq!(response.logs[0].access, None);
    }
 }
@@ -1,124 +1,134 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{BanAvatarResult, BanCheckResult, BulkBanResult};

 impl AdminApiClient {
-    pub async fn ban_email(&self, email: &str) -> ApiResult<()> {
+    pub async fn ban_email(&self, email: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
        self.create_blocklist_entry(
            "email",
-            generated_types::BanEmailRequest {
-                email: generated_types::EmailType::from(email.to_owned()),
-            }
-            .into(),
+            generated_types::AdminBlocklistEntryCreateRequest::from(
+                generated_types::BanEmailRequest {
+                    email: generated_types::EmailType::from(email.to_owned()),
+                },
+            ),
+            audit_log_reason,
        )
        .await
    }

-    pub async fn unban_email(&self, email: &str) -> ApiResult<()> {
-        self.delete_blocklist_entry("email", email, None).await
+    pub async fn unban_email(&self, email: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
+        self.delete_blocklist_entry("email", email, None, audit_log_reason)
+            .await
    }

    pub async fn check_email_ban(&self, email: &str) -> ApiResult<BanCheckResult> {
        self.check_blocklist_entry("email", email, None).await
    }

-    pub async fn ban_ip(&self, ip: &str) -> ApiResult<()> {
+    pub async fn ban_ip(&self, ip: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
        self.create_blocklist_entry(
            "ip",
-            generated_types::BanIpRequest { ip: ip.to_owned() }.into(),
+            generated_types::AdminBlocklistEntryCreateRequest::from(
+                generated_types::BanIpRequest { ip: ip.to_owned() },
+            ),
+            audit_log_reason,
        )
        .await
    }

-    pub async fn unban_ip(&self, ip: &str) -> ApiResult<()> {
-        self.delete_blocklist_entry("ip", ip, None).await
+    pub async fn unban_ip(&self, ip: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
+        self.delete_blocklist_entry("ip", ip, None, audit_log_reason)
+            .await
    }

    pub async fn check_ip_ban(&self, ip: &str) -> ApiResult<BanCheckResult> {
        self.check_blocklist_entry("ip", ip, None).await
    }

-    pub async fn add_suspicious_email_domain(&self, domain: &str) -> ApiResult<()> {
-        self.create_blocklist_entry(
-            SUSPICIOUS_EMAIL_DOMAIN_LIST,
-            suspicious_email_domain_request(domain)?.into(),
-        )
-        .await
-    }
-
-    pub async fn remove_suspicious_email_domain(&self, domain: &str) -> ApiResult<()> {
-        self.delete_blocklist_entry(SUSPICIOUS_EMAIL_DOMAIN_LIST, domain, None)
-            .await
-    }
-
-    pub async fn check_suspicious_email_domain(&self, domain: &str) -> ApiResult<BanCheckResult> {
-        self.check_blocklist_entry(SUSPICIOUS_EMAIL_DOMAIN_LIST, domain, None)
-            .await
-    }
-
-    pub async fn ban_phrase(&self, phrase: &str) -> ApiResult<()> {
+    pub async fn ban_phrase(&self, phrase: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
        self.create_blocklist_entry(
            "phrase",
-            generated_types::BanPhraseRequest {
-                phrase: phrase.to_owned(),
-            }
-            .into(),
+            generated_types::AdminBlocklistEntryCreateRequest::from(
+                generated_types::BanPhraseRequest {
+                    phrase: phrase.to_owned(),
+                },
+            ),
+            audit_log_reason,
        )
        .await
    }

-    pub async fn unban_phrase(&self, phrase: &str) -> ApiResult<()> {
-        self.delete_blocklist_entry("phrase", phrase, None).await
+    pub async fn unban_phrase(
+        &self,
+        phrase: &str,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        self.delete_blocklist_entry("phrase", phrase, None, audit_log_reason)
+            .await
    }

    pub async fn check_phrase_ban(&self, phrase: &str) -> ApiResult<BanCheckResult> {
        self.check_blocklist_entry("phrase", phrase, None).await
    }

-    pub async fn ban_url(&self, url: &str) -> ApiResult<()> {
+    pub async fn ban_url(&self, url: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
        self.create_blocklist_entry(
            "url",
-            generated_types::BanUrlRequest {
-                category: None,
-                notes: None,
-                severity: None,
-                source_url: None,
-                url: url.to_owned(),
-            }
-            .into(),
+            generated_types::AdminBlocklistEntryCreateRequest::from(
+                generated_types::BanUrlRequest {
+                    category: None,
+                    notes: None,
+                    severity: None,
+                    source_url: None,
+                    url: url.to_owned(),
+                },
+            ),
+            audit_log_reason,
        )
        .await
    }

-    pub async fn unban_url(&self, url: &str) -> ApiResult<()> {
-        self.delete_blocklist_entry("url", url, None).await
+    pub async fn unban_url(&self, url: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
+        self.delete_blocklist_entry("url", url, None, audit_log_reason)
+            .await
    }

    pub async fn check_url_ban(&self, url: &str) -> ApiResult<BanCheckResult> {
        self.check_blocklist_entry("url", url, None).await
    }

-    pub async fn ban_url_domain(&self, domain: &str, match_subdomains: bool) -> ApiResult<()> {
+    pub async fn ban_url_domain(
+        &self,
+        domain: &str,
+        match_subdomains: bool,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
        self.create_blocklist_entry(
            "url-domain",
-            generated_types::BanUrlDomainRequest {
-                category: None,
-                domain: domain.to_owned(),
-                match_subdomains: Some(match_subdomains),
-                notes: None,
-                severity: None,
-                source_url: None,
-            }
-            .into(),
+            generated_types::AdminBlocklistEntryCreateRequest::from(
+                generated_types::BanUrlDomainRequest {
+                    category: None,
+                    domain: domain.to_owned(),
+                    match_subdomains,
+                    notes: None,
+                    severity: None,
+                    source_url: None,
+                },
+            ),
+            audit_log_reason,
        )
        .await
    }

-    pub async fn unban_url_domain(&self, domain: &str) -> ApiResult<()> {
-        self.delete_blocklist_entry("url-domain", domain, None)
+    pub async fn unban_url_domain(
+        &self,
+        domain: &str,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        self.delete_blocklist_entry("url-domain", domain, None, audit_log_reason)
            .await
    }

@@ -131,19 +141,18 @@ impl AdminApiClient {
        sha256_hex: &str,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<()> {
-        let body = generated_types::AdminBlocklistEntryCreateRequest::from(
-            generated_types::BanFileShaRequest {
-                category: None,
-                content_type: None,
-                notes: None,
-                severity: None,
-                sha256_hex: sha256_hex.to_owned(),
-                source_url: None,
-            },
-        );
-        self.post_void_with_reason(
-            "/admin/blocklists/file-sha/entries",
-            Some(&serde_json::to_value(&body).map_err(|e| ApiError::Parse(e.to_string()))?),
+        self.create_blocklist_entry(
+            "file-sha",
+            generated_types::AdminBlocklistEntryCreateRequest::from(
+                generated_types::BanFileShaRequest {
+                    category: None,
+                    content_type: None,
+                    notes: None,
+                    severity: None,
+                    sha256_hex: sha256_hex.to_owned(),
+                    source_url: None,
+                },
+            ),
            audit_log_reason,
        )
        .await
@@ -154,12 +163,8 @@ impl AdminApiClient {
        sha256_hex: &str,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<()> {
-        self.delete_void_with_reason(
-            &blocklist_entry_path("file-sha", sha256_hex),
-            None,
-            audit_log_reason,
-        )
-        .await
+        self.delete_blocklist_entry("file-sha", sha256_hex, None, audit_log_reason)
+            .await
    }

    pub async fn check_file_sha_ban(&self, sha256_hex: &str) -> ApiResult<BanCheckResult> {
@@ -183,24 +188,34 @@ impl AdminApiClient {
        .await
    }

-    pub async fn ban_avatar_hash(&self, hash_short: &str) -> ApiResult<()> {
+    pub async fn ban_avatar_hash(
+        &self,
+        hash_short: &str,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
        self.create_blocklist_entry(
            "avatar-hash",
-            generated_types::BanAvatarHashRequest {
-                category: None,
-                hashes: vec![hash_short.to_owned()],
-                notes: None,
-                reason: None,
-                severity: None,
-                source_url: None,
-            }
-            .into(),
+            generated_types::AdminBlocklistEntryCreateRequest::from(
+                generated_types::BanAvatarHashRequest {
+                    category: None,
+                    hashes: vec![hash_short.to_owned()],
+                    notes: None,
+                    reason: None,
+                    severity: None,
+                    source_url: None,
+                },
+            ),
+            audit_log_reason,
        )
        .await
    }

-    pub async fn unban_avatar_hash(&self, hash_short: &str) -> ApiResult<()> {
-        self.delete_blocklist_entry("avatar-hash", hash_short, None)
+    pub async fn unban_avatar_hash(
+        &self,
+        hash_short: &str,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        self.delete_blocklist_entry("avatar-hash", hash_short, None, audit_log_reason)
            .await
    }

@@ -213,26 +228,41 @@ impl AdminApiClient {
        let body = generated_types::BanUserAvatarRequest::default();
        let response = self
            .generated()
-            .ban_admin_user_avatar(
-                &generated_types::SnowflakeType::from(user_id.to_owned()),
-                &body,
-            )
+            .ban_admin_user_avatar(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }

-    pub async fn ban_profile_substring(&self, scope: &str, substring: &str) -> ApiResult<()> {
+    pub async fn ban_profile_substring(
+        &self,
+        scope: &str,
+        substring: &str,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
        self.create_blocklist_entry(
            PROFILE_SUBSTRING_LIST,
-            profile_substring_request(scope, substring)?.into(),
+            generated_types::AdminBlocklistEntryCreateRequest::from(profile_substring_request(
+                scope, substring,
+            )?),
+            audit_log_reason,
        )
        .await
    }

-    pub async fn unban_profile_substring(&self, scope: &str, substring: &str) -> ApiResult<()> {
-        self.delete_blocklist_entry(PROFILE_SUBSTRING_LIST, substring, Some(scope))
-            .await
+    pub async fn unban_profile_substring(
+        &self,
+        scope: &str,
+        substring: &str,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        self.delete_blocklist_entry(
+            PROFILE_SUBSTRING_LIST,
+            substring,
+            Some(scope),
+            audit_log_reason,
+        )
+        .await
    }

    pub async fn check_profile_substring_ban(
@@ -248,12 +278,14 @@ impl AdminApiClient {
        &self,
        list_type: &str,
        body: generated_types::AdminBlocklistEntryCreateRequest,
+        audit_log_reason: Option<&str>,
    ) -> ApiResult<()> {
-        self.generated()
+        let list_type = blocklist_list_type(list_type)?;
+        self.generated_with_reason(audit_log_reason)?
            .create_admin_blocklist_entry(list_type, &body)
            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
+            .map(drop)
+            .map_err(|error| self.generated_error(error))
    }

    async fn delete_blocklist_entry(
@@ -261,13 +293,15 @@ impl AdminApiClient {
        list_type: &str,
        entry_value: &str,
        scope: Option<&str>,
+        audit_log_reason: Option<&str>,
    ) -> ApiResult<()> {
+        let list_type = blocklist_list_type(list_type)?;
        let scope = scope.map(blocklist_delete_scope).transpose()?;
-        self.generated()
+        self.generated_with_reason(audit_log_reason)?
            .delete_admin_blocklist_entry(list_type, entry_value, scope)
            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
+            .map(drop)
+            .map_err(|error| self.generated_error(error))
    }

    async fn check_blocklist_entry(
@@ -276,6 +310,7 @@ impl AdminApiClient {
        entry_value: &str,
        scope: Option<&str>,
    ) -> ApiResult<BanCheckResult> {
+        let list_type = blocklist_list_type(list_type)?;
        let scope = scope.map(blocklist_get_scope).transpose()?;
        let response = self
            .generated()
@@ -286,16 +321,11 @@ impl AdminApiClient {
    }
 }

-const SUSPICIOUS_EMAIL_DOMAIN_LIST: &str = "email-domain-suspicious";
-
 const PROFILE_SUBSTRING_LIST: &str = "profile-substring";

-fn blocklist_entry_path(list_type: &str, entry_value: &str) -> String {
-    format!(
-        "/admin/blocklists/{}/entries/{}",
-        urlencoding::encode(list_type),
-        urlencoding::encode(entry_value)
-    )
+fn blocklist_list_type(list_type: &str) -> ApiResult<generated_types::AdminBlocklistListType> {
+    generated_types::AdminBlocklistListType::try_from(list_type)
+        .map_err(|e| ApiError::Parse(e.to_string()))
 }

 fn blocklist_get_scope(scope: &str) -> ApiResult<generated_types::GetAdminBlocklistEntryScope> {
@@ -310,15 +340,6 @@ fn blocklist_delete_scope(
        .map_err(|e| ApiError::Parse(e.to_string()))
 }

-fn suspicious_email_domain_request(
-    domain: &str,
-) -> ApiResult<generated_types::SuspiciousEmailDomainRequest> {
-    Ok(generated_types::SuspiciousEmailDomainRequest {
-        domain: generated_types::SuspiciousEmailDomainRequestDomain::try_from(domain)
-            .map_err(|e| ApiError::Parse(e.to_string()))?,
-    })
-}
-
 fn profile_substring_request(
    scope: &str,
    substring: &str,
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::BulkJobResponse;
@@ -13,15 +13,11 @@ impl AdminApiClient {
        remove_flags: &[String],
        audit_log_reason: Option<&str>,
    ) -> ApiResult<BulkJobResponse> {
-        let body = generated_types::AdminBulkJobCreateRequest::from(
-            generated_types::UpdateUserFlagsAdminBulkJobCreateRequest {
-                add_flags: user_flags(add_flags),
-                remove_flags: user_flags(remove_flags),
-                task:
-                    generated_types::UpdateUserFlagsAdminBulkJobCreateRequestTask::UpdateUserFlags,
-                user_ids: snowflakes(user_ids),
-            },
-        );
+        let body = generated_types::AdminBulkJobCreateRequest::UpdateUserFlags {
+            add_flags: user_flags(add_flags)?,
+            remove_flags: user_flags(remove_flags)?,
+            user_ids: snowflakes(user_ids),
+        };
        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
            .await
    }
@@ -33,14 +29,11 @@ impl AdminApiClient {
        remove_flags: &[String],
        audit_log_reason: Option<&str>,
    ) -> ApiResult<BulkJobResponse> {
-        let body = generated_types::AdminBulkJobCreateRequest::from(
-            generated_types::UpdateSuspiciousActivityFlagsAdminBulkJobCreateRequest {
-                add_flags: add_flags.to_vec(),
-                remove_flags: remove_flags.to_vec(),
-                task: generated_types::UpdateSuspiciousActivityFlagsAdminBulkJobCreateRequestTask::UpdateSuspiciousActivityFlags,
-                user_ids: snowflakes(user_ids),
-            },
-        );
+        let body = generated_types::AdminBulkJobCreateRequest::UpdateSuspiciousActivityFlags {
+            add_flags: add_flags.to_vec(),
+            remove_flags: remove_flags.to_vec(),
+            user_ids: snowflakes(user_ids),
+        };
        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
            .await
    }
@@ -52,14 +45,11 @@ impl AdminApiClient {
        remove_features: &[String],
        audit_log_reason: Option<&str>,
    ) -> ApiResult<BulkJobResponse> {
-        let body = generated_types::AdminBulkJobCreateRequest::from(
-            generated_types::UpdateGuildFeaturesAdminBulkJobCreateRequest {
-                add_features: guild_features(add_features),
-                guild_ids: snowflakes(guild_ids),
-                remove_features: guild_features(remove_features),
-                task: generated_types::UpdateGuildFeaturesAdminBulkJobCreateRequestTask::UpdateGuildFeatures,
-            },
-        );
+        let body = generated_types::AdminBulkJobCreateRequest::UpdateGuildFeatures {
+            add_features: guild_features(add_features),
+            guild_ids: snowflakes(guild_ids),
+            remove_features: guild_features(remove_features),
+        };
        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
            .await
    }
@@ -70,14 +60,10 @@ impl AdminApiClient {
        user_ids: &[String],
        audit_log_reason: Option<&str>,
    ) -> ApiResult<BulkJobResponse> {
-        let body = generated_types::AdminBulkJobCreateRequest::from(
-            generated_types::AddGuildMembersAdminBulkJobCreateRequest {
-                guild_id: snowflake(guild_id),
-                task:
-                    generated_types::AddGuildMembersAdminBulkJobCreateRequestTask::AddGuildMembers,
-                user_ids: snowflakes(user_ids),
-            },
-        );
+        let body = generated_types::AdminBulkJobCreateRequest::AddGuildMembers {
+            guild_id: snowflake(guild_id),
+            user_ids: snowflakes(user_ids),
+        };
        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
            .await
    }
@@ -87,13 +73,9 @@ impl AdminApiClient {
        user_ids: &[String],
        audit_log_reason: Option<&str>,
    ) -> ApiResult<BulkJobResponse> {
-        let body = generated_types::AdminBulkJobCreateRequest::from(
-            generated_types::DeleteUserMessagesAdminBulkJobCreateRequest {
-                task:
-                    generated_types::DeleteUserMessagesAdminBulkJobCreateRequestTask::DeleteUserMessages,
-                user_ids: snowflakes(user_ids),
-            },
-        );
+        let body = generated_types::AdminBulkJobCreateRequest::DeleteUserMessages {
+            user_ids: snowflakes(user_ids),
+        };
        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
            .await
    }
@@ -104,46 +86,41 @@ impl AdminApiClient {
        reason_code: u32,
        days_until_deletion: u32,
        public_reason: Option<&str>,
+        notify_user: bool,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<BulkJobResponse> {
-        let body = generated_types::AdminBulkJobCreateRequest::from(
-            generated_types::ScheduleUserDeletionAdminBulkJobCreateRequest {
-                days_until_deletion: Some(
-                    crate::api::generated::nonzero_u32(days_until_deletion, "days_until_deletion")
-                        .map_err(ApiError::Parse)?,
-                ),
-                public_reason: public_reason.map(std::borrow::ToOwned::to_owned),
-                reason_code: crate::api::generated::deletion_reason_code(
-                    i32::try_from(reason_code).map_err(|e| ApiError::Parse(e.to_string()))?,
-                    "reason_code",
-                )
-                .map_err(ApiError::Parse)?,
-                task: generated_types::ScheduleUserDeletionAdminBulkJobCreateRequestTask::ScheduleUserDeletion,
-                user_ids: snowflakes(user_ids),
-            },
-        );
+        let body = generated_types::AdminBulkJobCreateRequest::ScheduleUserDeletion {
+            days_until_deletion: crate::api::generated::nonzero_u32(
+                days_until_deletion,
+                "days_until_deletion",
+            )
+            .map_err(ApiError::Parse)?
+            .into(),
+            notify_user,
+            public_reason: public_reason.map(std::borrow::ToOwned::to_owned),
+            reason_code: crate::api::generated::deletion_reason_code(
+                i32::try_from(reason_code).map_err(|e| ApiError::Parse(e.to_string()))?,
+                "reason_code",
+            )
+            .map_err(ApiError::Parse)?,
+            user_ids: snowflakes(user_ids),
+        };
        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
            .await
    }
 }

-fn snowflake(value: &str) -> generated_types::SnowflakeType {
-    generated_types::SnowflakeType::from(value.to_owned())
-}
-
 fn snowflakes(values: &[String]) -> Vec<generated_types::SnowflakeType> {
-    values
-        .iter()
-        .cloned()
-        .map(generated_types::SnowflakeType::from)
-        .collect()
+    values.iter().map(|value| snowflake(value)).collect()
 }

-fn user_flags(values: &[String]) -> Vec<generated_types::UserFlags> {
+fn user_flags(values: &[String]) -> ApiResult<Vec<generated_types::UserFlags>> {
    values
        .iter()
-        .cloned()
-        .map(generated_types::UserFlags::from)
+        .map(|value| {
+            generated_types::UserFlags::try_from(value.as_str())
+                .map_err(|error| ApiError::Parse(error.to_string()))
+        })
        .collect()
 }

@@ -1,6 +1,8 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+use crate::api::generated::GeneratedClient;
 use crate::{config::AdminConfig, session::Session};
+use progenitor_client::ClientInfo;
 use reqwest::header::{AUTHORIZATION, HeaderMap, HeaderName, HeaderValue};
 use reqwest::{Method, RequestBuilder};
 use serde::Serialize;
@@ -34,46 +36,39 @@ impl<T> ApiResultExt<T> for ApiResult<T> {
 }

 pub struct AdminApiClient {
-    http_client: reqwest::Client,
-    generated: crate::api::generated::GeneratedClient,
-    base_url: String,
-    access_token: String,
-    proxy_client_ip_headers: HeaderMap,
+    generated: GeneratedClient,
 }

 impl AdminApiClient {
    pub fn new(http_client: &reqwest::Client, config: &AdminConfig, session: &Session) -> Self {
-        let generated_http_client = build_generated_http_client(config, session);
-        let generated = crate::api::generated::GeneratedClient::new_with_client(
+        let generated = GeneratedClient::new_with_client(
            &config.api_endpoint,
-            generated_http_client,
+            http_client.clone(),
+            build_session_headers(config, session),
        );
-        Self {
-            http_client: http_client.clone(),
-            generated,
-            base_url: config.api_endpoint.clone(),
-            access_token: session.access_token.clone(),
-            proxy_client_ip_headers: build_proxy_client_ip_headers(config),
-        }
+        Self { generated }
    }

    fn build_url(&self, path: &str, query_params: Option<&[(&str, &str)]>) -> String {
-        let base = format!("{}{}", self.base_url, path);
-        match query_params {
-            None => base,
-            Some(params) => {
-                let filtered: Vec<_> = params.iter().filter(|(_, v)| !v.is_empty()).collect();
-                if filtered.is_empty() {
-                    return base;
-                }
-                let query = filtered
-                    .iter()
-                    .map(|(k, v)| format!("{}={}", urlencoding::encode(k), urlencoding::encode(v)))
-                    .collect::<Vec<_>>()
-                    .join("&");
-                format!("{base}?{query}")
-            }
+        let mut url = format!("{}{}", self.generated.baseurl(), path);
+        let query = query_params
+            .unwrap_or_default()
+            .iter()
+            .filter(|(_, value)| !value.is_empty())
+            .map(|(key, value)| {
+                format!(
+                    "{}={}",
+                    urlencoding::encode(key),
+                    urlencoding::encode(value)
+                )
+            })
+            .collect::<Vec<_>>()
+            .join("&");
+        if !query.is_empty() {
+            url.push('?');
+            url.push_str(&query);
        }
+        url
    }

    fn request(
@@ -81,30 +76,23 @@ impl AdminApiClient {
        method: Method,
        path: &str,
        query_params: Option<&[(&str, &str)]>,
-    ) -> RequestBuilder {
-        let url = self.build_url(path, query_params);
-        self.http_client
-            .request(method, &url)
-            .header("Authorization", format!("Bearer {}", self.access_token))
-            .header("Content-Type", "application/json")
-            .headers(self.proxy_client_ip_headers.clone())
-    }
-
-    fn with_audit_log_reason(
-        builder: RequestBuilder,
        audit_log_reason: Option<&str>,
-    ) -> RequestBuilder {
-        match audit_log_reason {
-            Some(reason) => builder.header("X-Audit-Log-Reason", reason),
-            None => builder,
-        }
+    ) -> ApiResult<RequestBuilder> {
+        let url = self.build_url(path, query_params);
+        Ok(self
+            .generated
+            .client()
+            .request(method, &url)
+            .header("Content-Type", "application/json")
+            .headers(self.headers_with_reason(audit_log_reason)?))
    }

-    fn with_json_body(builder: RequestBuilder, body: Option<&serde_json::Value>) -> RequestBuilder {
-        match body {
-            Some(body) => builder.json(body),
-            None => builder,
+    fn headers_with_reason(&self, audit_log_reason: Option<&str>) -> ApiResult<HeaderMap> {
+        let mut headers = self.generated.inner().clone();
+        if let Some(reason) = audit_log_reason {
+            headers.insert("x-audit-log-reason", audit_log_reason_header(reason)?);
        }
+        Ok(headers)
    }

    async fn send_request(builder: RequestBuilder) -> ApiResult<reqwest::Response> {
@@ -114,13 +102,29 @@ impl AdminApiClient {
            .map_err(|e| ApiError::Network(e.to_string()))
    }

+    async fn send_json<B: Serialize + ?Sized>(
+        &self,
+        method: Method,
+        path: &str,
+        body: Option<&B>,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<reqwest::Response> {
+        let builder = self.request(method, path, None, audit_log_reason)?;
+        let builder = match body {
+            Some(body) => builder.json(body),
+            None => builder,
+        };
+        Self::send_request(builder).await
+    }
+
    pub async fn get<T: DeserializeOwned>(
        &self,
        path: &str,
        query_params: Option<&[(&str, &str)]>,
    ) -> ApiResult<T> {
-        let response = Self::send_request(self.request(Method::GET, path, query_params)).await?;
-        self.parse_response(response).await
+        let response =
+            Self::send_request(self.request(Method::GET, path, query_params, None)?).await?;
+        Self::parse_response(response).await
    }

    pub async fn post<T: DeserializeOwned>(
@@ -149,10 +153,10 @@ impl AdminApiClient {
        T: DeserializeOwned,
        B: Serialize + ?Sized,
    {
-        let builder =
-            Self::with_audit_log_reason(self.request(Method::POST, path, None), audit_log_reason);
-        let response = Self::send_request(builder.json(body)).await?;
-        self.parse_response(response).await
+        let response = self
+            .send_json(Method::POST, path, Some(body), audit_log_reason)
+            .await?;
+        Self::parse_response(response).await
    }

    pub async fn post_with_reason<T: DeserializeOwned>(
@@ -161,10 +165,10 @@ impl AdminApiClient {
        body: Option<&serde_json::Value>,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<T> {
-        let builder =
-            Self::with_audit_log_reason(self.request(Method::POST, path, None), audit_log_reason);
-        let response = Self::send_request(Self::with_json_body(builder, body)).await?;
-        self.parse_response(response).await
+        let response = self
+            .send_json(Method::POST, path, body, audit_log_reason)
+            .await?;
+        Self::parse_response(response).await
    }

    pub async fn post_void(&self, path: &str, body: Option<&serde_json::Value>) -> ApiResult<()> {
@@ -177,9 +181,9 @@ impl AdminApiClient {
        body: Option<&serde_json::Value>,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<()> {
-        let builder =
-            Self::with_audit_log_reason(self.request(Method::POST, path, None), audit_log_reason);
-        let response = Self::send_request(Self::with_json_body(builder, body)).await?;
+        let response = self
+            .send_json(Method::POST, path, body, audit_log_reason)
+            .await?;
        Self::parse_void_response(response).await
    }

@@ -197,10 +201,10 @@ impl AdminApiClient {
        body: Option<&serde_json::Value>,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<T> {
-        let builder =
-            Self::with_audit_log_reason(self.request(Method::PATCH, path, None), audit_log_reason);
-        let response = Self::send_request(Self::with_json_body(builder, body)).await?;
-        self.parse_response(response).await
+        let response = self
+            .send_json(Method::PATCH, path, body, audit_log_reason)
+            .await?;
+        Self::parse_response(response).await
    }

    pub async fn patch_typed_with_reason<T, B>(
@@ -213,10 +217,10 @@ impl AdminApiClient {
        T: DeserializeOwned,
        B: Serialize + ?Sized,
    {
-        let builder =
-            Self::with_audit_log_reason(self.request(Method::PATCH, path, None), audit_log_reason);
-        let response = Self::send_request(builder.json(body)).await?;
-        self.parse_response(response).await
+        let response = self
+            .send_json(Method::PATCH, path, Some(body), audit_log_reason)
+            .await?;
+        Self::parse_response(response).await
    }

    pub async fn put_with_reason<T: DeserializeOwned>(
@@ -225,10 +229,10 @@ impl AdminApiClient {
        body: Option<&serde_json::Value>,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<T> {
-        let builder =
-            Self::with_audit_log_reason(self.request(Method::PUT, path, None), audit_log_reason);
-        let response = Self::send_request(Self::with_json_body(builder, body)).await?;
-        self.parse_response(response).await
+        let response = self
+            .send_json(Method::PUT, path, body, audit_log_reason)
+            .await?;
+        Self::parse_response(response).await
    }

    pub async fn put_typed_with_reason<T, B>(
@@ -241,10 +245,10 @@ impl AdminApiClient {
        T: DeserializeOwned,
        B: Serialize + ?Sized,
    {
-        let builder =
-            Self::with_audit_log_reason(self.request(Method::PUT, path, None), audit_log_reason);
-        let response = Self::send_request(builder.json(body)).await?;
-        self.parse_response(response).await
+        let response = self
+            .send_json(Method::PUT, path, Some(body), audit_log_reason)
+            .await?;
+        Self::parse_response(response).await
    }

    pub async fn put_void_with_reason(
@@ -253,9 +257,9 @@ impl AdminApiClient {
        body: Option<&serde_json::Value>,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<()> {
-        let builder =
-            Self::with_audit_log_reason(self.request(Method::PUT, path, None), audit_log_reason);
-        let response = Self::send_request(Self::with_json_body(builder, body)).await?;
+        let response = self
+            .send_json(Method::PUT, path, body, audit_log_reason)
+            .await?;
        Self::parse_void_response(response).await
    }

@@ -269,9 +273,9 @@ impl AdminApiClient {
        body: Option<&serde_json::Value>,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<()> {
-        let builder =
-            Self::with_audit_log_reason(self.request(Method::DELETE, path, None), audit_log_reason);
-        let response = Self::send_request(Self::with_json_body(builder, body)).await?;
+        let response = self
+            .send_json(Method::DELETE, path, body, audit_log_reason)
+            .await?;
        Self::parse_void_response(response).await
    }

@@ -281,31 +285,42 @@ impl AdminApiClient {
        body: Option<&serde_json::Value>,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<T> {
-        let builder =
-            Self::with_audit_log_reason(self.request(Method::DELETE, path, None), audit_log_reason);
-        let response = Self::send_request(Self::with_json_body(builder, body)).await?;
-        self.parse_response(response).await
+        let response = self
+            .send_json(Method::DELETE, path, body, audit_log_reason)
+            .await?;
+        Self::parse_response(response).await
    }

    async fn parse_void_response(response: reqwest::Response) -> ApiResult<()> {
-        if response.status().is_success() {
-            Ok(())
-        } else {
-            let status = response.status().as_u16();
-            let text = response.text().await.map_err(|error| {
-                ApiError::Network(format!("failed to read error response body: {error}"))
-            })?;
-            Err(ApiError::Http {
-                status,
-                message: text,
-            })
-        }
+        Self::check_response_status(response).await.map(drop)
    }

-    pub(crate) fn generated(&self) -> &crate::api::generated::GeneratedClient {
+    async fn check_response_status(response: reqwest::Response) -> ApiResult<reqwest::Response> {
+        if response.status().is_success() {
+            return Ok(response);
+        }
+        let status = response.status().as_u16();
+        let message = response.text().await.map_err(|error| {
+            ApiError::Network(format!("failed to read error response body: {error}"))
+        })?;
+        Err(ApiError::Http { status, message })
+    }
+
+    pub(crate) fn generated(&self) -> &GeneratedClient {
        &self.generated
    }

+    pub(crate) fn generated_with_reason(
+        &self,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<GeneratedClient> {
+        Ok(GeneratedClient::new_with_client(
+            self.generated.baseurl(),
+            self.generated.client().clone(),
+            self.headers_with_reason(audit_log_reason)?,
+        ))
+    }
+
    pub(crate) fn generated_value<T, U>(&self, value: U) -> ApiResult<T>
    where
        T: DeserializeOwned,
@@ -328,28 +343,16 @@ impl AdminApiClient {
        }
    }

-    async fn parse_response<T: DeserializeOwned>(
-        &self,
-        response: reqwest::Response,
-    ) -> ApiResult<T> {
-        let status = response.status();
-        if status.as_u16() == 204 {
-            return serde_json::from_value(serde_json::Value::Null)
-                .map_err(|e| ApiError::Parse(e.to_string()));
-        }
-        if !status.is_success() {
-            let text = response.text().await.map_err(|error| {
-                ApiError::Network(format!("failed to read error response body: {error}"))
-            })?;
-            return Err(ApiError::Http {
-                status: status.as_u16(),
-                message: text,
-            });
-        }
-        let text = response
-            .text()
-            .await
-            .map_err(|e| ApiError::Network(e.to_string()))?;
+    async fn parse_response<T: DeserializeOwned>(response: reqwest::Response) -> ApiResult<T> {
+        let response = Self::check_response_status(response).await?;
+        let text = if response.status() == reqwest::StatusCode::NO_CONTENT {
+            String::new()
+        } else {
+            response
+                .text()
+                .await
+                .map_err(|e| ApiError::Network(e.to_string()))?
+        };
        if text.is_empty() {
            return serde_json::from_value(serde_json::Value::Null)
                .map_err(|e| ApiError::Parse(e.to_string()));
@@ -358,17 +361,14 @@ impl AdminApiClient {
    }
 }

-fn build_generated_http_client(config: &AdminConfig, session: &Session) -> reqwest::Client {
+fn build_session_headers(config: &AdminConfig, session: &Session) -> HeaderMap {
    let mut headers = HeaderMap::new();
-    let auth_value = HeaderValue::from_str(&format!("Bearer {}", session.access_token))
+    let mut auth_value = HeaderValue::from_str(&format!("Bearer {}", session.access_token))
        .expect("failed to build generated API Authorization header");
+    auth_value.set_sensitive(true);
    headers.insert(AUTHORIZATION, auth_value);
    headers.extend(build_proxy_client_ip_headers(config));
-    reqwest::Client::builder()
-        .user_agent(format!("FluxerAdmin/{} (Rust)", config.build_version))
-        .default_headers(headers)
-        .build()
-        .expect("failed to create generated API HTTP client")
+    headers
 }

 pub(crate) fn with_proxy_client_ip_header(
@@ -418,3 +418,100 @@ impl std::fmt::Display for ApiError {
        }
    }
 }
+
+fn audit_log_reason_header(reason: &str) -> ApiResult<HeaderValue> {
+    let mut value = HeaderValue::from_bytes(reason.as_bytes())
+        .map_err(|_| ApiError::Parse("invalid audit log reason header".to_owned()))?;
+    value.set_sensitive(true);
+    Ok(value)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::{Value, json};
+
+    #[test]
+    fn audit_log_reason_header_carries_utf8_bytes() {
+        let reason = "§ 3 Regel – wiederholt 日本";
+        let value = audit_log_reason_header(reason).expect("valid reason header");
+        assert_eq!(value.as_bytes(), reason.as_bytes());
+        assert!(value.is_sensitive());
+        assert!(audit_log_reason_header("line one\nline two").is_err());
+    }
+
+    fn response(status: u16, body: &'static str) -> reqwest::Response {
+        axum::http::Response::builder()
+            .status(status)
+            .body(body)
+            .expect("valid response")
+            .into()
+    }
+
+    #[tokio::test]
+    async fn parses_successful_json_and_empty_responses() {
+        for (status, body, expected) in [
+            (200, r#"{"value":1}"#, json!({"value": 1})),
+            (201, "[1,2]", json!([1, 2])),
+            (202, "null", Value::Null),
+            (200, "", Value::Null),
+            (204, "ignored body", Value::Null),
+        ] {
+            let actual: Value = AdminApiClient::parse_response(response(status, body))
+                .await
+                .expect("valid response body");
+            assert_eq!(actual, expected, "HTTP {status}: {body}");
+        }
+    }
+
+    #[tokio::test]
+    async fn empty_responses_preserve_null_deserialization_errors() {
+        let expected = serde_json::from_value::<Vec<String>>(Value::Null)
+            .expect_err("null is not a list")
+            .to_string();
+        for (status, body) in [(200, ""), (204, "ignored body")] {
+            let error = AdminApiClient::parse_response::<Vec<String>>(response(status, body))
+                .await
+                .expect_err("missing list");
+            assert_eq!(error.to_string(), format!("parse error: {expected}"));
+        }
+    }
+
+    #[tokio::test]
+    async fn malformed_json_preserves_deserialization_errors() {
+        for body in [" ", "{", "not JSON"] {
+            let expected = serde_json::from_str::<Value>(body)
+                .expect_err("malformed JSON")
+                .to_string();
+            let error = AdminApiClient::parse_response::<Value>(response(200, body))
+                .await
+                .expect_err("malformed response");
+            assert_eq!(error.to_string(), format!("parse error: {expected}"));
+        }
+    }
+
+    #[tokio::test]
+    async fn void_responses_do_not_parse_successful_bodies() {
+        for status in [200, 201, 202, 204] {
+            AdminApiClient::parse_void_response(response(status, "not JSON"))
+                .await
+                .expect("successful void response");
+        }
+    }
+
+    #[tokio::test]
+    async fn typed_and_void_responses_preserve_http_errors() {
+        for status in [302, 400, 403, 404, 500] {
+            for body in ["", "plain error", r#"{"code":"FORBIDDEN"}"#] {
+                let typed = AdminApiClient::parse_response::<Value>(response(status, body))
+                    .await
+                    .map(drop);
+                let empty = AdminApiClient::parse_void_response(response(status, body)).await;
+                for result in [typed, empty] {
+                    let error = result.expect_err("unsuccessful response");
+                    assert_eq!(error.to_string(), format!("HTTP {status}: {body}"));
+                }
+            }
+        }
+    }
+}
@@ -9,20 +9,20 @@ impl AdminApiClient {
    pub async fn generate_gift_codes(
        &self,
        count: u32,
-        duration_type: &str,
+        duration_type: generated_types::GiftCodeDurationTypeSchema,
        duration_quantity: u32,
    ) -> ApiResult<CodesResponse> {
        let body = generated_types::GenerateGiftCodesRequest {
-            count: crate::api::generated::nonzero_u32(count, "count").map_err(ApiError::Parse)?,
+            count: crate::api::generated::nonzero_u32(count, "count")
+                .map_err(ApiError::Parse)?
+                .into(),
            duration_quantity: crate::api::generated::nonzero_u32(
                duration_quantity,
                "duration_quantity",
            )
-            .map_err(ApiError::Parse)?,
-            duration_type: generated_types::GenerateGiftCodesRequestDurationType::try_from(
-                duration_type,
-            )
-            .map_err(|e| ApiError::Parse(e.to_string()))?,
+            .map_err(ApiError::Parse)?
+            .into(),
+            duration_type,
        };
        let response = self
            .generated()
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{
@@ -16,8 +16,7 @@ impl AdminApiClient {
            .list_admin_discovery_applications()
            .await
            .map_err(|e| self.generated_error(e))?;
-        response
-            .into_inner()
+        Vec::from(response.into_inner())
            .into_iter()
            .map(pending_discovery_application)
            .collect()
@@ -29,8 +28,7 @@ impl AdminApiClient {
            .list_admin_discovery_listings()
            .await
            .map_err(|e| self.generated_error(e))?;
-        response
-            .into_inner()
+        Vec::from(response.into_inner())
            .into_iter()
            .map(listed_guild)
            .collect()
@@ -41,16 +39,13 @@ impl AdminApiClient {
        guild_id: &str,
        reason: Option<&str>,
    ) -> ApiResult<DiscoveryApplicationResponse> {
-        let guild_id = generated_types::SnowflakeType::from(guild_id.to_owned());
-        let body = generated_types::DiscoveryAdminApplicationUpdateRequest::from(
-            generated_types::ApprovedDiscoveryAdminApplicationUpdateRequest {
-                reason: reason
-                    .map(generated_types::ApprovedDiscoveryAdminApplicationUpdateRequestReason::try_from)
-                    .transpose()
-                    .map_err(|e| ApiError::Parse(e.to_string()))?,
-                status: generated_types::ApprovedDiscoveryAdminApplicationUpdateRequestStatus::Approved,
-            },
-        );
+        let guild_id = snowflake(guild_id);
+        let body = generated_types::DiscoveryAdminApplicationUpdateRequest::Approved {
+            reason: reason
+                .map(generated_types::DiscoveryReviewReason::try_from)
+                .transpose()
+                .map_err(|e| ApiError::Parse(e.to_string()))?,
+        };
        let response = self
            .generated()
            .update_admin_discovery_application(&guild_id, &body)
@@ -64,18 +59,11 @@ impl AdminApiClient {
        guild_id: &str,
        reason: &str,
    ) -> ApiResult<DiscoveryApplicationResponse> {
-        let guild_id = generated_types::SnowflakeType::from(guild_id.to_owned());
-        let body = generated_types::DiscoveryAdminApplicationUpdateRequest::from(
-            generated_types::RejectedDiscoveryAdminApplicationUpdateRequest {
-                reason:
-                    generated_types::RejectedDiscoveryAdminApplicationUpdateRequestReason::try_from(
-                        reason,
-                    )
-                    .map_err(|e| ApiError::Parse(e.to_string()))?,
-                status:
-                    generated_types::RejectedDiscoveryAdminApplicationUpdateRequestStatus::Rejected,
-            },
-        );
+        let guild_id = snowflake(guild_id);
+        let body = generated_types::DiscoveryAdminApplicationUpdateRequest::Rejected {
+            reason: generated_types::DiscoveryRejectionReason::try_from(reason)
+                .map_err(|e| ApiError::Parse(e.to_string()))?,
+        };
        let response = self
            .generated()
            .update_admin_discovery_application(&guild_id, &body)
@@ -89,7 +77,7 @@ impl AdminApiClient {
        guild_id: &str,
        reason: &str,
    ) -> ApiResult<DiscoveryApplicationResponse> {
-        let guild_id = generated_types::SnowflakeType::from(guild_id.to_owned());
+        let guild_id = snowflake(guild_id);
        let body = generated_types::DiscoveryAdminRemoveRequest {
            reason: generated_types::DiscoveryAdminRemoveRequestReason::try_from(reason)
                .map_err(|e| ApiError::Parse(e.to_string()))?,
@@ -1,5 +1,8 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+use progenitor_client::{ClientHooks, ClientInfo, Error, OperationInfo};
+use reqwest::header::HeaderMap;
+
 #[allow(
    clippy::all,
    unused_imports,
@@ -16,6 +19,24 @@ pub use inner::types;

 pub use inner::Client as GeneratedClient;

+impl ClientHooks<HeaderMap> for GeneratedClient {
+    async fn pre<E>(
+        &self,
+        request: &mut reqwest::Request,
+        _info: &OperationInfo,
+    ) -> Result<(), Error<E>> {
+        let headers = request.headers_mut();
+        for (name, value) in self.inner() {
+            headers.entry(name.clone()).or_insert_with(|| value.clone());
+        }
+        Ok(())
+    }
+}
+
+pub(crate) fn snowflake(value: &str) -> types::SnowflakeType {
+    types::SnowflakeType::Variant0(value.to_owned())
+}
+
 pub(crate) fn number_to_u64(value: f64, field: &str) -> Result<u64, String> {
    const MAX_SAFE_INTEGER: f64 = 9_007_199_254_740_991.0;
    if !value.is_finite() || value < 0.0 || value.fract() != 0.0 || value > MAX_SAFE_INTEGER {
@@ -126,10 +147,10 @@ mod tests {
        let response: SearchGuildsResponse =
            serde_json::from_value(json).expect("failed to deserialize SearchGuildsResponse");

-        assert_eq!(response.total as i64, 1);
+        assert_eq!(response.total, 1.0);
        assert_eq!(response.guilds.len(), 1);
        assert_eq!(response.guilds[0].name, "Test Guild");
-        assert_eq!(response.guilds[0].member_count, 42);
+        assert_eq!(*response.guilds[0].member_count, 42);
    }

    #[test]
@@ -1,13 +1,13 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::snowflake;

 use super::client::{AdminApiClient, ApiResult};
 use super::types::{ListGuildEmojisResponse, ListGuildStickersResponse};

 impl AdminApiClient {
    pub async fn list_guild_emojis(&self, guild_id: &str) -> ApiResult<ListGuildEmojisResponse> {
-        let guild_id = generated_types::SnowflakeType::from(guild_id.to_owned());
+        let guild_id = snowflake(guild_id);
        let response = self
            .generated()
            .list_admin_guild_emojis(&guild_id)
@@ -20,7 +20,7 @@ impl AdminApiClient {
        &self,
        guild_id: &str,
    ) -> ApiResult<ListGuildStickersResponse> {
-        let guild_id = generated_types::SnowflakeType::from(guild_id.to_owned());
+        let guild_id = snowflake(guild_id);
        let response = self
            .generated()
            .list_admin_guild_stickers(&guild_id)
@@ -1,9 +1,10 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};
 use serde::Deserialize;

 use super::client::{AdminApiClient, ApiError, ApiResult};
+use super::reports::SearchReportsParams;
 use super::types::{
    GuildAuditLogResponse, GuildDetailInfo, GuildInfo, GuildUpdateResponse,
    ListGuildMembersResponse, LookupGuildResponse, SearchGuildsResponse, SearchReportsResponse,
@@ -15,7 +16,7 @@ impl AdminApiClient {
        &self,
        query: &str,
        limit: u32,
-        offset: u32,
+        offset: u64,
    ) -> ApiResult<SearchGuildsResponse> {
        let limit = limit.to_string();
        let offset = offset.to_string();
@@ -28,13 +29,8 @@ impl AdminApiClient {
    }

    pub async fn get_guild_by_id(&self, guild_id: &str) -> ApiResult<GuildInfo> {
-        let response = self
-            .generated()
-            .get_admin_guild(&snowflake(guild_id))
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        let resp: LookupGuildResponse = self.generated_value(response.into_inner())?;
-        resp.guild
+        self.lookup_guild(guild_id)
+            .await?
            .map(GuildInfo::from)
            .ok_or_else(|| super::client::ApiError::Http {
                status: 404,
@@ -101,7 +97,7 @@ impl AdminApiClient {
        &self,
        guild_id: &str,
        limit: u32,
-        offset: u32,
+        offset: u64,
    ) -> ApiResult<ListGuildMembersResponse> {
        let limit = limit.to_string();
        let offset = offset.to_string();
@@ -144,8 +140,7 @@ impl AdminApiClient {
        let limit = limit
            .map(i32::try_from)
            .transpose()
-            .map_err(|e| ApiError::Parse(e.to_string()))?
-            .map(generated_types::Int32Type::from);
+            .map_err(|e| ApiError::Parse(e.to_string()))?;
        let response = self
            .generated()
            .list_admin_guild_audit_logs(
@@ -153,7 +148,7 @@ impl AdminApiClient {
                None,
                None,
                before.as_ref(),
-                limit.as_ref(),
+                limit,
                None,
            )
            .await
@@ -257,39 +252,29 @@ impl AdminApiClient {
        &self,
        guild_id: &str,
        limit: u32,
-        offset: u32,
+        offset: u64,
    ) -> ApiResult<SearchReportsResponse> {
-        self.search_reports(
-            None,
-            None,
-            None,
-            None,
-            None,
-            None,
-            Some(guild_id),
-            None,
-            None,
-            None,
-            None,
-            None,
+        self.search_reports(&SearchReportsParams {
+            reported_guild_id: Some(guild_id),
            limit,
            offset,
-        )
+            ..Default::default()
+        })
        .await
    }
 }

 #[derive(Deserialize)]
 struct GuildSettingsPatch {
-    content_warning_level: Option<generated_types::ContentWarningLevel>,
+    content_warning_level: Option<generated_types::ContentWarningLevelInput>,
    content_warning_text: Option<String>,
-    default_message_notifications: Option<generated_types::DefaultMessageNotifications>,
+    default_message_notifications: Option<generated_types::DefaultMessageNotificationsInput>,
    disabled_operations: Option<generated_types::GuildOperations>,
-    explicit_content_filter: Option<generated_types::GuildExplicitContentFilter>,
-    mfa_level: Option<generated_types::GuildMfaLevel>,
+    explicit_content_filter: Option<generated_types::GuildExplicitContentFilterInput>,
+    mfa_level: Option<generated_types::GuildMfaLevelInput>,
    nsfw: Option<bool>,
-    nsfw_level: Option<generated_types::NsfwLevel>,
-    verification_level: Option<generated_types::GuildVerificationLevel>,
+    nsfw_level: Option<generated_types::NsfwLevelInput>,
+    verification_level: Option<generated_types::GuildVerificationLevelInput>,
 }

 fn search_guilds_response(
@@ -317,7 +302,7 @@ fn guild_admin_response(response: generated_types::GuildAdminResponse) -> ApiRes
        owner_global_name: response.owner_global_name,
        owner_discriminator: response.owner_discriminator,
        member_count: crate::api::generated::i64_to_u64(
-            i64::from(response.member_count),
+            i64::from(i32::from(response.member_count)),
            "member_count",
        )
        .map_err(ApiError::Parse)?,
@@ -325,7 +310,7 @@ fn guild_admin_response(response: generated_types::GuildAdminResponse) -> ApiRes
        nsfw_level: response.nsfw_level.map(i32::from),
        nsfw: response.nsfw,
        content_warning_level: response.content_warning_level.map(i32::from),
-        content_warning_text: response.content_warning_text,
+        content_warning_text: response.content_warning_text.map(String::from),
        description: None,
        vanity_url_code: None,
    })
@@ -338,9 +323,9 @@ fn guild_update_response(
    Ok(GuildUpdateResponse {
        guild: GuildInfo {
            id: String::from(guild.id),
-            name: guild.name,
-            icon: guild.icon,
-            banner: guild.banner,
+            name: String::from(guild.name),
+            icon: guild.icon.map(String::from),
+            banner: guild.banner.map(String::from),
            owner_id: String::from(guild.owner_id),
            owner_username: None,
            owner_global_name: None,
@@ -350,11 +335,11 @@ fn guild_update_response(
                "member_count",
            )
            .map_err(ApiError::Parse)?,
-            features: guild.features,
+            features: guild.features.into_iter().map(String::from).collect(),
            nsfw_level: guild.nsfw_level.map(i32::from),
            nsfw: guild.nsfw,
            content_warning_level: guild.content_warning_level.map(i32::from),
-            content_warning_text: guild.content_warning_text,
+            content_warning_text: guild.content_warning_text.map(String::from),
            description: None,
            vanity_url_code: None,
        },
@@ -380,10 +365,6 @@ fn guild_settings_request(
    })
 }

-fn snowflake(value: &str) -> generated_types::SnowflakeType {
-    generated_types::SnowflakeType::from(value.to_owned())
-}
-
 fn guild_features(values: &[String]) -> Vec<generated_types::GuildFeatureSchema> {
    values
        .iter()
@@ -4,6 +4,7 @@ use super::client::{AdminApiClient, ApiResult};
 use super::types::{
    CreateRegistrationUrlRequest, CreateRegistrationUrlResponse, InstanceConfigResponse,
    InstanceConfigUpdateRequest, InstanceEmailSmtpTestRequest, InstanceEmailSmtpTestResponse,
+    InstancePremiumDiscovery,
 };

 impl AdminApiClient {
@@ -11,6 +12,10 @@ impl AdminApiClient {
        self.get("/admin/instance/config", None).await
    }

+    pub async fn get_instance_premium_discovery(&self) -> ApiResult<InstancePremiumDiscovery> {
+        self.get("/.well-known/fluxer", None).await
+    }
+
    pub async fn update_instance_config(
        &self,
        update: &InstanceConfigUpdateRequest,
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+use crate::api::generated::snowflake;
+
 use super::client::{AdminApiClient, ApiResult};
 use super::types::{ActiveJobsResponse, CancelJobResponse, GetJobResponse, ListJobsResponse};

@@ -22,9 +24,9 @@ impl AdminApiClient {
        let max_lookback_days = params.max_lookback_days.to_string();
        let query_params = [
            ("limit", limit.as_str()),
-            ("cursor_bucket_day", cursor_bucket_day.as_str()),
-            ("cursor_created_at", cursor_created_at.as_str()),
-            ("cursor_job_id", cursor_job_id.as_str()),
+            ("cursor_bucket_day", cursor_bucket_day),
+            ("cursor_created_at", cursor_created_at),
+            ("cursor_job_id", cursor_job_id),
            ("max_lookback_days", max_lookback_days.as_str()),
            ("status", params.status.as_deref().unwrap_or_default()),
            ("task_type", params.task_type.as_deref().unwrap_or_default()),
@@ -39,7 +41,7 @@ impl AdminApiClient {
    pub async fn get_job(&self, job_id: &str) -> ApiResult<GetJobResponse> {
        let response = self
            .generated()
-            .get_admin_job(job_id)
+            .get_admin_job(&snowflake(job_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -68,10 +70,9 @@ impl AdminApiClient {
    }
 }

-fn cursor_field(cursor: Option<&serde_json::Value>, field: &str) -> String {
+fn cursor_field<'a>(cursor: Option<&'a serde_json::Value>, field: &str) -> &'a str {
    cursor
        .and_then(|cursor| cursor.get(field))
        .and_then(serde_json::Value::as_str)
        .unwrap_or_default()
-        .to_owned()
 }
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{
@@ -43,7 +43,8 @@ impl AdminApiClient {
            attachment_id: snowflake(attachment_id),
            channel_id: snowflake(channel_id),
            confirmed_viewed: true,
-            filename: filename.to_owned(),
+            filename: generated_types::ReportAttachmentToNcmecRequestFilename::try_from(filename)
+                .map_err(|e| ApiError::Parse(e.to_string()))?,
            message_id: snowflake(message_id),
            reporter_full_name:
                generated_types::ReportAttachmentToNcmecRequestReporterFullName::try_from(
@@ -119,7 +120,7 @@ impl AdminApiClient {
    ) -> ApiResult<MessageShredStatusResponse> {
        let response = self
            .generated()
-            .get_admin_message_shred(job_id)
+            .get_admin_message_shred(&snowflake(job_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -133,13 +134,15 @@ impl AdminApiClient {
        context_limit: u32,
    ) -> ApiResult<LookupMessageResponse> {
        let context_limit = context_limit.to_string();
+        let filename = generated_types::SearchAdminMessagesFilename::try_from(filename)
+            .map_err(|e| ApiError::Parse(e.to_string()))?;
        let response = self
            .generated()
            .search_admin_messages(
                Some(&snowflake(attachment_id)),
                &snowflake(channel_id),
                Some(context_limit.as_str()),
-                Some(filename),
+                Some(&filename),
                None,
                None,
                None,
@@ -195,7 +198,3 @@ impl AdminApiClient {
        self.generated_value(response.into_inner())
    }
 }
-
-fn snowflake(value: &str) -> generated_types::SnowflakeType {
-    generated_types::SnowflakeType::from(value.to_owned())
-}
@@ -1,10 +1,30 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+use crate::api::generated::snowflake;
+
 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{
    ListReportsResponse, ReportEntry, ResolveReportResponse, SearchReportsResponse,
 };

+#[derive(Default)]
+pub struct SearchReportsParams<'a> {
+    pub query: Option<&'a str>,
+    pub status: Option<i32>,
+    pub report_type: Option<i32>,
+    pub category: Option<&'a str>,
+    pub reporter_id: Option<&'a str>,
+    pub reported_user_id: Option<&'a str>,
+    pub reported_guild_id: Option<&'a str>,
+    pub reported_channel_id: Option<&'a str>,
+    pub guild_context_id: Option<&'a str>,
+    pub resolved_by_admin_id: Option<&'a str>,
+    pub sort_by: Option<&'a str>,
+    pub sort_order: Option<&'a str>,
+    pub limit: u32,
+    pub offset: u64,
+}
+
 impl AdminApiClient {
    pub async fn list_reports(
        &self,
@@ -26,7 +46,7 @@ impl AdminApiClient {
    pub async fn get_report(&self, report_id: &str) -> ApiResult<ReportEntry> {
        let response = self
            .generated()
-            .get_admin_report(report_id)
+            .get_admin_report(&snowflake(report_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -36,12 +56,14 @@ impl AdminApiClient {
        &self,
        report_id: &str,
        public_comment: Option<&str>,
+        notify_reporter: bool,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<ResolveReportResponse> {
        let mut body = serde_json::json!({"status": "resolved"});
        if let Some(public_comment) = public_comment {
            body["public_comment"] = serde_json::Value::from(public_comment);
        }
+        body["notify_reporter"] = serde_json::Value::from(notify_reporter);
        self.patch_with_reason(
            &format!("/admin/reports/{}", urlencoding::encode(report_id)),
            Some(&body),
@@ -50,51 +72,55 @@ impl AdminApiClient {
        .await
    }

-    #[allow(clippy::too_many_arguments)]
    pub async fn search_reports(
        &self,
-        query: Option<&str>,
-        status: Option<i32>,
-        report_type: Option<i32>,
-        category: Option<&str>,
-        reporter_id: Option<&str>,
-        reported_user_id: Option<&str>,
-        reported_guild_id: Option<&str>,
-        reported_channel_id: Option<&str>,
-        guild_context_id: Option<&str>,
-        resolved_by_admin_id: Option<&str>,
-        sort_by: Option<&str>,
-        sort_order: Option<&str>,
-        limit: u32,
-        offset: u32,
+        params: &SearchReportsParams<'_>,
    ) -> ApiResult<SearchReportsResponse> {
-        let status = status.map(report_status).transpose()?.unwrap_or_default();
-        let report_type = report_type
+        let status = params
+            .status
+            .map(report_status)
+            .transpose()?
+            .unwrap_or_default();
+        let report_type = params
+            .report_type
            .map(report_type_name)
            .transpose()?
            .unwrap_or_default();
-        let sort_by = sort_by.map(report_sort_by).transpose()?.unwrap_or_default();
-        let limit = limit.to_string();
-        let offset = offset.to_string();
+        let sort_by = params
+            .sort_by
+            .map(report_sort_by)
+            .transpose()?
+            .unwrap_or_default();
+        let limit = params.limit.to_string();
+        let offset = params.offset.to_string();
        let query_params = [
-            ("q", query.unwrap_or_default()),
+            ("q", params.query.unwrap_or_default()),
            ("status", status),
            ("report_type", report_type),
-            ("category", category.unwrap_or_default()),
-            ("reporter_id", reporter_id.unwrap_or_default()),
-            ("reported_user_id", reported_user_id.unwrap_or_default()),
-            ("reported_guild_id", reported_guild_id.unwrap_or_default()),
+            ("category", params.category.unwrap_or_default()),
+            ("reporter_id", params.reporter_id.unwrap_or_default()),
+            (
+                "reported_user_id",
+                params.reported_user_id.unwrap_or_default(),
+            ),
+            (
+                "reported_guild_id",
+                params.reported_guild_id.unwrap_or_default(),
+            ),
            (
                "reported_channel_id",
-                reported_channel_id.unwrap_or_default(),
+                params.reported_channel_id.unwrap_or_default(),
+            ),
+            (
+                "guild_context_id",
+                params.guild_context_id.unwrap_or_default(),
            ),
-            ("guild_context_id", guild_context_id.unwrap_or_default()),
            (
                "resolved_by_admin_id",
-                resolved_by_admin_id.unwrap_or_default(),
+                params.resolved_by_admin_id.unwrap_or_default(),
            ),
            ("sort_by", sort_by),
-            ("sort_order", sort_order.unwrap_or_default()),
+            ("sort_order", params.sort_order.unwrap_or_default()),
            ("limit", limit.as_str()),
            ("offset", offset.as_str()),
        ];
@@ -105,24 +131,14 @@ impl AdminApiClient {
        &self,
        reporter_id: &str,
        limit: u32,
-        offset: u32,
+        offset: u64,
    ) -> ApiResult<SearchReportsResponse> {
-        self.search_reports(
-            None,
-            None,
-            None,
-            None,
-            Some(reporter_id),
-            None,
-            None,
-            None,
-            None,
-            None,
-            None,
-            None,
+        self.search_reports(&SearchReportsParams {
+            reporter_id: Some(reporter_id),
            limit,
            offset,
-        )
+            ..Default::default()
+        })
        .await
    }

@@ -130,24 +146,14 @@ impl AdminApiClient {
        &self,
        reported_user_id: &str,
        limit: u32,
-        offset: u32,
+        offset: u64,
    ) -> ApiResult<SearchReportsResponse> {
-        self.search_reports(
-            None,
-            None,
-            None,
-            None,
-            None,
-            Some(reported_user_id),
-            None,
-            None,
-            None,
-            None,
-            None,
-            None,
+        self.search_reports(&SearchReportsParams {
+            reported_user_id: Some(reported_user_id),
            limit,
            offset,
-        )
+            ..Default::default()
+        })
        .await
    }
 }
@@ -179,3 +185,61 @@ fn report_sort_by(value: &str) -> ApiResult<&'static str> {
        ))),
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn report_statuses_preserve_the_closed_wire_mapping() {
+        for (value, expected) in [(0, "pending"), (1, "resolved")] {
+            assert_eq!(report_status(value).expect("supported status"), expected);
+        }
+        for value in [-1, 2] {
+            assert_eq!(
+                report_status(value)
+                    .expect_err("unknown status")
+                    .to_string(),
+                format!("parse error: unknown report status: {value}")
+            );
+        }
+    }
+
+    #[test]
+    fn report_types_preserve_the_closed_wire_mapping() {
+        for (value, expected) in [(0, "message"), (1, "user"), (2, "guild")] {
+            assert_eq!(report_type_name(value).expect("supported type"), expected);
+        }
+        for value in [-1, 3] {
+            assert_eq!(
+                report_type_name(value)
+                    .expect_err("unknown type")
+                    .to_string(),
+                format!("parse error: unknown report type: {value}")
+            );
+        }
+    }
+
+    #[test]
+    fn report_sort_fields_accept_only_the_existing_aliases() {
+        for (field, expected) in [
+            ("createdAt", "created_at"),
+            ("created_at", "created_at"),
+            ("reportedAt", "reported_at"),
+            ("reported_at", "reported_at"),
+            ("resolvedAt", "resolved_at"),
+            ("resolved_at", "resolved_at"),
+        ] {
+            assert_eq!(
+                report_sort_by(field).expect("supported sort field"),
+                expected
+            );
+        }
+        assert_eq!(
+            report_sort_by("unknown")
+                .expect_err("unknown sort field")
+                .to_string(),
+            "parse error: unknown report sort field: unknown"
+        );
+    }
+}
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{IndexRefreshStatusResponse, RefreshSearchIndexResponse};
@@ -11,8 +11,11 @@ impl AdminApiClient {
        index_type: &str,
        guild_id: Option<&str>,
    ) -> ApiResult<RefreshSearchIndexResponse> {
+        let index_type =
+            generated_types::CreateAdminSearchIndexRefreshIndexName::try_from(index_type)
+                .map_err(|e| ApiError::Parse(e.to_string()))?;
        let body = generated_types::RefreshSearchIndexRequest {
-            guild_id: guild_id.map(|id| generated_types::SnowflakeType::from(id.to_owned())),
+            guild_id: guild_id.map(snowflake),
            user_id: None,
        };
        let response = self
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiResult};
 use super::types::{
@@ -24,11 +24,7 @@ impl AdminApiClient {
        guild_ids: &[String],
    ) -> ApiResult<ReloadAllGuildsResponse> {
        let body = generated_types::ReloadGuildsRequest {
-            guild_ids: guild_ids
-                .iter()
-                .cloned()
-                .map(generated_types::SnowflakeType::from)
-                .collect(),
+            guild_ids: guild_ids.iter().map(|id| snowflake(id)).collect(),
        };
        let response = self
            .generated()
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::SendSystemDmResponse;
@@ -8,17 +8,18 @@ use super::types::SendSystemDmResponse;
 impl AdminApiClient {
    pub async fn send_system_dm(
        &self,
-        user_ids: &[String],
+        user_ids: Option<&[String]>,
        content: &str,
    ) -> ApiResult<SendSystemDmResponse> {
        let body = generated_types::SendSystemDmRequest {
            content: generated_types::SendSystemDmRequestContent::try_from(content)
                .map_err(|e| ApiError::Parse(e.to_string()))?,
            user_ids: user_ids
+                .unwrap_or_default()
                .iter()
-                .cloned()
-                .map(generated_types::SnowflakeType::from)
+                .map(|id| snowflake(id))
                .collect(),
+            all_users: user_ids.is_none().then_some(true),
        };
        let response = self
            .generated()
@@ -9,6 +9,8 @@ pub struct AuditLogEntry {
    #[serde(default)]
    pub admin_user: Option<AuditLogUserSummary>,
    pub action: String,
+    #[serde(default)]
+    pub access: Option<String>,
    pub target_id: String,
    pub target_type: String,
    #[serde(default)]
@@ -6,8 +6,14 @@ pub fn deserialize_discriminator<'de, D: Deserializer<'de>>(d: D) -> Result<Stri
    let v: serde_json::Value = Deserialize::deserialize(d)?;
    match v {
        serde_json::Value::String(s) => Ok(format!("{:0>4}", s)),
-        serde_json::Value::Number(n) => Ok(format!("{:04}", n.as_u64().unwrap_or(0))),
-        _ => Ok("0000".to_owned()),
+        serde_json::Value::Number(n) => n
+            .as_u64()
+            .map(|value| format!("{value:04}"))
+            .ok_or_else(|| serde::de::Error::custom("expected an unsigned integer discriminator")),
+        serde_json::Value::Null => Ok("0000".to_owned()),
+        _ => Err(serde::de::Error::custom(
+            "expected string or unsigned integer discriminator",
+        )),
    }
 }

@@ -15,7 +21,9 @@ pub fn deserialize_string_or_u64<'de, D: Deserializer<'de>>(d: D) -> Result<u64,
    let v: serde_json::Value = Deserialize::deserialize(d)?;
    match v {
        serde_json::Value::String(s) => s.parse::<u64>().map_err(serde::de::Error::custom),
-        serde_json::Value::Number(n) => Ok(n.as_u64().unwrap_or(0)),
+        serde_json::Value::Number(n) => n
+            .as_u64()
+            .ok_or_else(|| serde::de::Error::custom("expected an unsigned 64-bit integer")),
        serde_json::Value::Null => Ok(0),
        _ => Err(serde::de::Error::custom("expected string or number")),
    }
@@ -114,6 +122,12 @@ pub struct AdminUser {
    pub pending_bulk_message_deletion_at: Option<String>,
    pub deletion_reason_code: Option<i32>,
    pub deletion_public_reason: Option<String>,
+    #[serde(default)]
+    pub deletion_audit_log_reason: Option<String>,
+    #[serde(default)]
+    pub deletion_scheduled_by: Option<String>,
+    #[serde(default)]
+    pub deletion_scheduled_at: Option<String>,
    pub last_active_at: Option<String>,
    pub last_active_ip: Option<String>,
    pub last_active_ip_reverse: Option<String>,
@@ -0,0 +1,332 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+use super::{InstanceConfigResponse, PremiumMode};
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
+
+pub const BILLING_MAX_CURRENCIES: usize = 64;
+pub const BILLING_MAX_COUNTRY_CURRENCIES: usize = 300;
+pub const BILLING_MAX_LEGACY_SLOTS: usize = 256;
+pub const BILLING_MAX_LEGACY_PRICES_PER_SLOT: usize = 32;
+pub const BILLING_PRICE_SLOTS: [&str; 4] = ["monthly", "yearly", "gift_1_month", "gift_1_year"];
+pub const PREMIUM_PRODUCT_NAME_MAX_CHARS: usize = 40;
+pub const TRI_STATE_DEFAULT: &str = "default";
+pub const TRI_STATE_ON: &str = "on";
+pub const TRI_STATE_OFF: &str = "off";
+
+#[derive(Clone, Copy, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum BillingCatalogMode {
+    #[default]
+    Env,
+    Operator,
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+pub struct BillingPriceSet {
+    pub monthly: Option<String>,
+    pub yearly: Option<String>,
+    pub gift_1_month: Option<String>,
+    pub gift_1_year: Option<String>,
+}
+
+impl BillingPriceSet {
+    pub fn has_recurring_pair(&self) -> bool {
+        self.monthly.is_some() && self.yearly.is_some()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.monthly.is_none()
+            && self.yearly.is_none()
+            && self.gift_1_month.is_none()
+            && self.gift_1_year.is_none()
+    }
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
+pub struct InstanceBillingResponse {
+    pub enabled: Option<bool>,
+    #[serde(default)]
+    pub effective_enabled: bool,
+    #[serde(default)]
+    pub stripe_secret_key_set: bool,
+    #[serde(default)]
+    pub stripe_webhook_secret_set: bool,
+    #[serde(default)]
+    pub stripe_secret_key_stored: bool,
+    #[serde(default)]
+    pub stripe_webhook_secret_stored: bool,
+    pub default_currency: Option<String>,
+    pub prices: Option<BTreeMap<String, BillingPriceSet>>,
+    pub country_currencies: Option<BTreeMap<String, String>>,
+    pub legacy_prices: Option<BTreeMap<String, Vec<String>>>,
+    #[serde(default)]
+    pub billing_active: bool,
+    #[serde(default)]
+    pub stripe_serviceable: bool,
+    #[serde(default)]
+    pub catalog_mode: BillingCatalogMode,
+    #[serde(default)]
+    pub webhook_url: String,
+    pub automatic_tax: Option<bool>,
+    pub tax_id_collection: Option<bool>,
+    pub terms_consent_required: Option<bool>,
+    #[serde(default)]
+    pub effective_automatic_tax: bool,
+    #[serde(default)]
+    pub effective_tax_id_collection: bool,
+    #[serde(default)]
+    pub effective_terms_consent_required: bool,
+}
+
+#[derive(Clone, Debug, Default, Serialize)]
+pub struct InstanceBillingUpdateRequest {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enabled: Option<Option<bool>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub stripe_secret_key: Option<Option<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub stripe_webhook_secret: Option<Option<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub default_currency: Option<Option<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub prices: Option<Option<BTreeMap<String, BillingPriceSet>>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub country_currencies: Option<Option<BTreeMap<String, String>>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub legacy_prices: Option<Option<BTreeMap<String, Vec<String>>>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub automatic_tax: Option<Option<bool>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tax_id_collection: Option<Option<bool>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub terms_consent_required: Option<Option<bool>>,
+}
+
+#[derive(Clone, Debug, Default, Deserialize)]
+pub struct InstancePremiumDiscovery {
+    #[serde(default)]
+    pub app_public: InstancePremiumDiscoveryAppPublic,
+    #[serde(default)]
+    pub features: InstancePremiumDiscoveryFeatures,
+}
+
+#[derive(Clone, Debug, Default, Deserialize)]
+pub struct InstancePremiumDiscoveryAppPublic {
+    #[serde(default)]
+    pub branding: InstancePremiumDiscoveryBranding,
+}
+
+#[derive(Clone, Debug, Default, Deserialize)]
+pub struct InstancePremiumDiscoveryBranding {
+    pub premium_product_name: Option<String>,
+}
+
+#[derive(Clone, Debug, Default, Deserialize)]
+pub struct InstancePremiumDiscoveryFeatures {
+    #[serde(default)]
+    pub premium_enabled: bool,
+}
+
+impl InstancePremiumDiscovery {
+    pub fn premium_product_name(&self) -> Option<&str> {
+        self.app_public
+            .branding
+            .premium_product_name
+            .as_deref()
+            .map(str::trim)
+            .filter(|name| !name.is_empty())
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct PremiumBranding {
+    pub name: Option<String>,
+    pub premium_enabled: bool,
+}
+
+impl PremiumBranding {
+    pub fn from_discovery(discovery: &InstancePremiumDiscovery) -> Self {
+        Self {
+            name: discovery.premium_product_name().map(str::to_owned),
+            premium_enabled: discovery.features.premium_enabled,
+        }
+    }
+
+    pub fn from_instance_config(config: &InstanceConfigResponse) -> Self {
+        Self::from_config_parts(
+            config.self_hosted,
+            &config.app_public.branding.premium_product_name,
+            config.policy.premium_mode,
+        )
+    }
+
+    fn from_config_parts(self_hosted: bool, name: &str, premium_mode: PremiumMode) -> Self {
+        let name = name.trim();
+        Self {
+            name: (!name.is_empty()).then(|| name.to_owned()),
+            premium_enabled: !self_hosted || matches!(premium_mode, PremiumMode::Mirror),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::api::generated::types as generated_types;
+    use serde_json::json;
+
+    #[test]
+    fn billing_response_round_trips_through_the_generated_contract() {
+        let value = json!({
+            "enabled": true,
+            "effective_enabled": true,
+            "stripe_secret_key_set": true,
+            "stripe_webhook_secret_set": false,
+            "stripe_secret_key_stored": true,
+            "stripe_webhook_secret_stored": false,
+            "default_currency": "GBP",
+            "prices": {
+                "GBP": {
+                    "monthly": "price_1Monthly",
+                    "yearly": "price_1Yearly",
+                    "gift_1_month": null,
+                    "gift_1_year": null
+                }
+            },
+            "country_currencies": {"GB": "GBP"},
+            "legacy_prices": {"monthly_GBP": ["price_1Old"]},
+            "billing_active": false,
+            "stripe_serviceable": false,
+            "catalog_mode": "operator",
+            "webhook_url": "https://api.example.com/stripe/webhook",
+            "automatic_tax": null,
+            "tax_id_collection": false,
+            "terms_consent_required": true,
+            "effective_automatic_tax": false,
+            "effective_tax_id_collection": false,
+            "effective_terms_consent_required": true
+        });
+        let generated: generated_types::InstanceBillingResponse =
+            serde_json::from_value(value.clone()).expect("generated billing response");
+        let ours: InstanceBillingResponse =
+            serde_json::from_value(value.clone()).expect("hand-written billing response");
+        assert_eq!(ours.catalog_mode, BillingCatalogMode::Operator);
+        assert!(ours.stripe_secret_key_stored);
+        assert_eq!(ours.automatic_tax, None);
+        assert_eq!(ours.tax_id_collection, Some(false));
+        assert!(ours.effective_terms_consent_required);
+        assert!(ours.prices.as_ref().expect("prices")["GBP"].has_recurring_pair());
+        assert_eq!(serde_json::to_value(&ours).expect("serializable"), value);
+        assert_eq!(
+            serde_json::to_value(generated).expect("serializable generated"),
+            value
+        );
+    }
+
+    #[test]
+    fn default_billing_response_matches_the_generated_contract() {
+        let value = serde_json::to_value(InstanceBillingResponse::default()).expect("serializable");
+        serde_json::from_value::<generated_types::InstanceBillingResponse>(value.clone())
+            .expect("generated billing response");
+        assert_eq!(value["catalog_mode"], json!("env"));
+        assert_eq!(value["prices"], json!(null));
+    }
+
+    #[test]
+    fn billing_update_preserves_explicit_nulls_and_omits_untouched_fields() {
+        let mut prices = BTreeMap::new();
+        prices.insert(
+            "SEK".to_owned(),
+            BillingPriceSet {
+                monthly: Some("price_1Monthly".to_owned()),
+                yearly: Some("price_1Yearly".to_owned()),
+                ..Default::default()
+            },
+        );
+        let update = InstanceBillingUpdateRequest {
+            enabled: Some(None),
+            stripe_secret_key: Some(None),
+            default_currency: Some(None),
+            prices: Some(Some(prices)),
+            country_currencies: Some(None),
+            legacy_prices: Some(Some(BTreeMap::new())),
+            automatic_tax: Some(None),
+            tax_id_collection: Some(Some(true)),
+            terms_consent_required: Some(Some(false)),
+            ..Default::default()
+        };
+        let value = serde_json::to_value(update).expect("serializable update");
+        serde_json::from_value::<generated_types::InstanceBillingUpdateRequest>(value.clone())
+            .expect("generated update contract");
+        assert_eq!(
+            value,
+            json!({
+                "enabled": null,
+                "stripe_secret_key": null,
+                "default_currency": null,
+                "prices": {
+                    "SEK": {
+                        "monthly": "price_1Monthly",
+                        "yearly": "price_1Yearly",
+                        "gift_1_month": null,
+                        "gift_1_year": null
+                    }
+                },
+                "country_currencies": null,
+                "legacy_prices": {},
+                "automatic_tax": null,
+                "tax_id_collection": true,
+                "terms_consent_required": false
+            })
+        );
+        assert_eq!(
+            serde_json::to_value(InstanceBillingUpdateRequest::default())
+                .expect("serializable update"),
+            json!({})
+        );
+    }
+
+    #[test]
+    fn premium_discovery_reads_the_name_and_feature_flag() {
+        let discovery: InstancePremiumDiscovery = serde_json::from_value(json!({
+            "app_public": {"branding": {"product_name": "Example", "premium_product_name": " Gold "}},
+            "features": {"premium_enabled": true, "stripe_enabled": false}
+        }))
+        .expect("discovery");
+        assert_eq!(discovery.premium_product_name(), Some("Gold"));
+        assert!(discovery.features.premium_enabled);
+        let empty: InstancePremiumDiscovery =
+            serde_json::from_value(json!({})).expect("empty discovery");
+        assert_eq!(empty.premium_product_name(), None);
+        assert!(!empty.features.premium_enabled);
+        assert_eq!(
+            PremiumBranding::from_discovery(&discovery),
+            PremiumBranding {
+                name: Some("Gold".to_owned()),
+                premium_enabled: true
+            }
+        );
+    }
+
+    #[test]
+    fn premium_branding_from_instance_config_matches_discovery_rules() {
+        assert_eq!(
+            PremiumBranding::from_config_parts(true, " Gold ", PremiumMode::Everyone),
+            PremiumBranding {
+                name: Some("Gold".to_owned()),
+                premium_enabled: false
+            }
+        );
+        assert!(
+            PremiumBranding::from_config_parts(true, "Gold", PremiumMode::Mirror).premium_enabled
+        );
+        assert_eq!(
+            PremiumBranding::from_config_parts(false, "  ", PremiumMode::Everyone),
+            PremiumBranding {
+                name: None,
+                premium_enabled: true
+            }
+        );
+    }
+}
@@ -2,6 +2,8 @@

 use serde::{Deserialize, Serialize};

+use super::{InstanceBillingResponse, InstanceBillingUpdateRequest};
+
 #[derive(Clone, Debug, Deserialize, Serialize)]
 pub struct InstanceConfigResponse {
    pub sso: SsoConfigResponse,
@@ -18,6 +20,16 @@ pub struct InstanceConfigResponse {
    pub integrations: InstanceIntegrationsResponse,
    #[serde(default)]
    pub media: InstanceMediaResponse,
+    #[serde(default)]
+    pub push_relay: PushRelayConfigResponse,
+    #[serde(default)]
+    pub domain_migration: DomainMigrationConfigResponse,
+    #[serde(default)]
+    pub captcha: CaptchaConfigResponse,
+    #[serde(default)]
+    pub experiment_delivery: ExperimentDeliveryConfigResponse,
+    #[serde(default)]
+    pub billing: InstanceBillingResponse,
 }

 #[derive(Clone, Debug, Deserialize, Serialize)]
@@ -31,34 +43,18 @@ pub struct InstancePolicyResponse {
    pub direct_messages_locked: bool,
    #[serde(default)]
    pub premium_mode: PremiumMode,
+    #[serde(default = "default_guild_create_access")]
+    pub guild_create_access: bool,
    #[serde(default)]
    pub services: InstanceServicesOverrides,
    #[serde(default)]
    pub services_resolved: InstanceServicesResolved,
    #[serde(default)]
    pub services_available: InstanceServicesAvailable,
-    #[serde(default)]
-    pub deferred_phone_gate: DeferredPhoneGateResponse,
 }

-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct DeferredPhoneGateResponse {
-    #[serde(default)]
-    pub enabled: bool,
-    #[serde(default)]
-    pub window_hours: f64,
-    #[serde(default)]
-    pub member_threshold: i64,
-}
-
-impl Default for DeferredPhoneGateResponse {
-    fn default() -> Self {
-        Self {
-            enabled: true,
-            window_hours: 6.0,
-            member_threshold: 50,
-        }
-    }
+fn default_guild_create_access() -> bool {
+    true
 }

 impl Default for InstancePolicyResponse {
@@ -69,10 +65,10 @@ impl Default for InstancePolicyResponse {
            direct_messages_disabled: false,
            direct_messages_locked: false,
            premium_mode: PremiumMode::Everyone,
+            guild_create_access: default_guild_create_access(),
            services: InstanceServicesOverrides::default(),
            services_resolved: InstanceServicesResolved::default(),
            services_available: InstanceServicesAvailable::default(),
-            deferred_phone_gate: DeferredPhoneGateResponse::default(),
        }
    }
 }
@@ -111,8 +107,6 @@ pub struct InstanceIntegrationsResponse {
    #[serde(default)]
    pub youtube: InstanceYoutubeIntegrationResponse,
    #[serde(default)]
-    pub captcha: InstanceCaptchaIntegrationResponse,
-    #[serde(default)]
    pub email: InstanceEmailIntegrationResponse,
    #[serde(default)]
    pub bluesky: InstanceBlueskyIntegrationResponse,
@@ -133,21 +127,6 @@ pub struct InstanceYoutubeIntegrationResponse {
    pub effective_available: bool,
 }

-#[derive(Clone, Debug, Default, Deserialize, Serialize)]
-pub struct InstanceCaptchaIntegrationResponse {
-    pub provider: Option<String>,
-    #[serde(default)]
-    pub effective_provider: String,
-    pub hcaptcha_site_key: Option<String>,
-    #[serde(default)]
-    pub hcaptcha_secret_key_set: bool,
-    pub turnstile_site_key: Option<String>,
-    #[serde(default)]
-    pub turnstile_secret_key_set: bool,
-    #[serde(default)]
-    pub effective_enabled: bool,
-}
-
 #[derive(Clone, Debug, Default, Deserialize, Serialize)]
 pub struct InstanceEmailIntegrationResponse {
    pub enabled: Option<bool>,
@@ -320,6 +299,11 @@ pub struct AppBrandingConfigResponse {
    pub wordmark_url: Option<String>,
    pub favicon_url: Option<String>,
    pub theme_color: Option<String>,
+    pub status_page_url: Option<String>,
+    pub status_page_incident_history_url: Option<String>,
+    #[serde(default = "default_premium_product_name")]
+    pub premium_product_name: String,
+    pub premium_info_url: Option<String>,
 }

 impl Default for AppBrandingConfigResponse {
@@ -332,6 +316,10 @@ impl Default for AppBrandingConfigResponse {
            wordmark_url: None,
            favicon_url: None,
            theme_color: None,
+            status_page_url: None,
+            status_page_incident_history_url: None,
+            premium_product_name: default_premium_product_name(),
+            premium_info_url: None,
        }
    }
 }
@@ -340,6 +328,10 @@ fn default_product_name() -> String {
    "Fluxer".to_owned()
 }

+fn default_premium_product_name() -> String {
+    "Premium".to_owned()
+}
+
 #[derive(Clone, Debug, Default, Deserialize, Serialize)]
 pub struct AppSetupConfigResponse {
    #[serde(default)]
@@ -436,6 +428,131 @@ impl VoiceE2eeScope {
    }
 }

+pub const EXPERIMENT_MAX_TARGETED_USERS: usize = 1_000;
+pub const DOMAIN_MIGRATION_DEFAULT_SALT: &str = "domain-migration-v1";
+pub const CAPTCHA_COST_RANGE: std::ops::RangeInclusive<u32> = 1_000..=20_000;
+pub const CAPTCHA_MAX_COUNTER_RANGE: std::ops::RangeInclusive<u32> = 100..=20_000;
+
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
+#[serde(default)]
+pub struct PushRelayConfigResponse {
+    pub relay_consent_accepted: bool,
+    pub relay_consent_accepted_at: Option<String>,
+    pub relay_consent_accepted_by: Option<String>,
+}
+
+#[derive(Clone, Debug, Default, Serialize)]
+pub struct PushRelayConfigUpdateRequest {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub relay_consent_accepted: Option<bool>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(default)]
+pub struct DomainMigrationConfigResponse {
+    pub enabled: bool,
+    pub config_version: u64,
+    pub rollout_basis_points: u32,
+    pub rollout_salt: String,
+    pub included_user_ids: Vec<String>,
+    pub included_guild_ids: Vec<String>,
+    pub include_premium_users: bool,
+    pub excluded_user_ids: Vec<String>,
+    pub anonymous_rollout_basis_points: u32,
+    pub standalone_forwarding: bool,
+}
+
+impl Default for DomainMigrationConfigResponse {
+    fn default() -> Self {
+        Self {
+            enabled: false,
+            config_version: 0,
+            rollout_basis_points: 0,
+            rollout_salt: DOMAIN_MIGRATION_DEFAULT_SALT.to_owned(),
+            included_user_ids: Vec::new(),
+            included_guild_ids: Vec::new(),
+            include_premium_users: false,
+            excluded_user_ids: Vec::new(),
+            anonymous_rollout_basis_points: 0,
+            standalone_forwarding: false,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Default, Serialize)]
+pub struct DomainMigrationConfigUpdateRequest {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enabled: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub rollout_basis_points: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub rollout_salt: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub included_user_ids: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub included_guild_ids: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub include_premium_users: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub excluded_user_ids: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub anonymous_rollout_basis_points: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub standalone_forwarding: Option<bool>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(default)]
+pub struct CaptchaConfigResponse {
+    pub enabled: bool,
+    pub cost: u32,
+    pub max_counter: u32,
+}
+
+impl Default for CaptchaConfigResponse {
+    fn default() -> Self {
+        Self {
+            enabled: true,
+            cost: 5_000,
+            max_counter: 1_000,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Default, Serialize)]
+pub struct CaptchaConfigUpdateRequest {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enabled: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cost: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_counter: Option<u32>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(default)]
+pub struct ExperimentDeliveryConfigResponse {
+    pub poll_interval_seconds: u64,
+    pub poll_jitter_percent: u32,
+}
+
+impl Default for ExperimentDeliveryConfigResponse {
+    fn default() -> Self {
+        Self {
+            poll_interval_seconds: 300,
+            poll_jitter_percent: 15,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Default, Serialize)]
+pub struct ExperimentDeliveryConfigUpdateRequest {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub poll_interval_seconds: Option<u64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub poll_jitter_percent: Option<u32>,
+}
+
 #[derive(Clone, Debug, Deserialize, Serialize)]
 pub struct InstanceRegistrationResponse {
    pub mode: RegistrationMode,
@@ -525,6 +642,16 @@ pub struct InstanceConfigUpdateRequest {
    pub integrations: Option<InstanceIntegrationsUpdateRequest>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub media: Option<InstanceMediaUpdateRequest>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub push_relay: Option<PushRelayConfigUpdateRequest>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub domain_migration: Option<DomainMigrationConfigUpdateRequest>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub captcha: Option<CaptchaConfigUpdateRequest>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub experiment_delivery: Option<ExperimentDeliveryConfigUpdateRequest>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub billing: Option<InstanceBillingUpdateRequest>,
 }

 #[derive(Clone, Debug, Default, Serialize)]
@@ -536,21 +663,11 @@ pub struct InstancePolicyUpdateRequest {
    #[serde(skip_serializing_if = "Option::is_none")]
    pub direct_messages_disabled: Option<bool>,
    #[serde(skip_serializing_if = "Option::is_none")]
+    pub guild_create_access: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
    pub premium_mode: Option<PremiumMode>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub services: Option<InstanceServicesUpdateRequest>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub deferred_phone_gate: Option<DeferredPhoneGateUpdateRequest>,
-}
-
-#[derive(Clone, Debug, Default, Serialize)]
-pub struct DeferredPhoneGateUpdateRequest {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub enabled: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub window_hours: Option<f64>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub member_threshold: Option<i64>,
 }

 #[derive(Clone, Debug, Default, Serialize)]
@@ -570,8 +687,6 @@ pub struct InstanceIntegrationsUpdateRequest {
    #[serde(skip_serializing_if = "Option::is_none")]
    pub youtube: Option<InstanceYoutubeIntegrationUpdateRequest>,
    #[serde(skip_serializing_if = "Option::is_none")]
-    pub captcha: Option<InstanceCaptchaIntegrationUpdateRequest>,
-    #[serde(skip_serializing_if = "Option::is_none")]
    pub email: Option<InstanceEmailIntegrationUpdateRequest>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub bluesky: Option<InstanceBlueskyIntegrationUpdateRequest>,
@@ -589,20 +704,6 @@ pub struct InstanceYoutubeIntegrationUpdateRequest {
    pub api_key: Option<String>,
 }

-#[derive(Clone, Debug, Default, Serialize)]
-pub struct InstanceCaptchaIntegrationUpdateRequest {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub provider: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub hcaptcha_site_key: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub hcaptcha_secret_key: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub turnstile_site_key: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub turnstile_secret_key: Option<String>,
-}
-
 #[derive(Clone, Debug, Default, Serialize)]
 pub struct InstanceEmailIntegrationUpdateRequest {
    #[serde(skip_serializing_if = "Option::is_none")]
@@ -729,6 +830,14 @@ pub struct AppBrandingConfigUpdateRequest {
    pub favicon_url: Option<Option<String>>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub theme_color: Option<Option<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status_page_url: Option<Option<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status_page_incident_history_url: Option<Option<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub premium_product_name: Option<Option<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub premium_info_url: Option<Option<String>>,
 }

 #[derive(Clone, Debug, Default, Serialize)]
@@ -826,3 +935,83 @@ pub struct CreateRegistrationUrlResponse {
    pub code: String,
    pub url: String,
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::api::generated::types as generated_types;
+    use serde_json::json;
+
+    #[test]
+    fn default_instance_config_sections_match_the_published_contract() {
+        let schema: serde_json::Value =
+            serde_json::from_str(include_str!("../../../openapi-admin.json"))
+                .expect("admin schema");
+        let domain_migration = serde_json::from_value::<DomainMigrationConfigResponse>(json!({}))
+            .expect("default domain migration config");
+        let captcha = serde_json::from_value::<CaptchaConfigResponse>(json!({}))
+            .expect("default captcha config");
+        let delivery = serde_json::from_value::<ExperimentDeliveryConfigResponse>(json!({}))
+            .expect("default delivery config");
+        let domain_migration =
+            serde_json::to_value(domain_migration).expect("serializable domain migration config");
+        let captcha = serde_json::to_value(captcha).expect("serializable captcha config");
+        let delivery = serde_json::to_value(delivery).expect("serializable delivery config");
+        let generated_domain_migration: generated_types::DomainMigrationConfigResponse =
+            serde_json::from_value(domain_migration.clone())
+                .expect("generated domain migration config contract");
+        let generated_captcha: generated_types::CaptchaConfigResponse =
+            serde_json::from_value(captcha.clone()).expect("generated captcha config contract");
+        let generated_delivery: generated_types::ExperimentDeliveryConfigResponse =
+            serde_json::from_value(delivery.clone()).expect("generated delivery config contract");
+        assert_eq!(
+            serde_json::to_value(generated_domain_migration)
+                .expect("serializable generated domain migration config"),
+            domain_migration
+        );
+        assert_eq!(
+            serde_json::to_value(generated_captcha).expect("serializable generated captcha config"),
+            captcha
+        );
+        assert_eq!(
+            serde_json::to_value(generated_delivery)
+                .expect("serializable generated delivery config"),
+            delivery
+        );
+        for (name, value) in [
+            ("DomainMigrationConfigResponse", domain_migration),
+            ("CaptchaConfigResponse", captcha),
+            ("ExperimentDeliveryConfigResponse", delivery),
+        ] {
+            for (field, value) in value.as_object().expect("config object") {
+                assert_eq!(
+                    value, &schema["components"]["schemas"][name]["properties"][field]["default"],
+                    "{name}.{field}"
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn domain_migration_update_preserves_empty_lists_and_omitted_fields() {
+        let update = DomainMigrationConfigUpdateRequest {
+            included_user_ids: Some(Vec::new()),
+            excluded_user_ids: Some(Vec::new()),
+            ..Default::default()
+        };
+        let value = serde_json::to_value(update).expect("serializable update");
+        serde_json::from_value::<generated_types::DomainMigrationConfigUpdateRequest>(
+            value.clone(),
+        )
+        .expect("generated update contract");
+        assert_eq!(
+            value,
+            json!({"included_user_ids": [], "excluded_user_ids": []})
+        );
+        assert_eq!(
+            serde_json::to_value(DomainMigrationConfigUpdateRequest::default())
+                .expect("serializable update"),
+            json!({})
+        );
+    }
+}
@@ -9,6 +9,7 @@ mod codes;
 mod common;
 mod discovery;
 mod guild_assets;
+mod instance_billing;
 mod instance_config;
 mod jobs;
 mod limit_config;
@@ -28,6 +29,7 @@ pub use codes::*;
 pub use common::*;
 pub use discovery::*;
 pub use guild_assets::*;
+pub use instance_billing::*;
 pub use instance_config::*;
 pub use jobs::*;
 pub use limit_config::*;
@@ -4,5 +4,5 @@ use serde::{Deserialize, Serialize};

 #[derive(Clone, Debug, Deserialize, Serialize)]
 pub struct SendSystemDmResponse {
-    pub recipient_count: i64,
+    pub recipient_count: Option<i64>,
 }
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{
@@ -15,7 +15,7 @@ impl AdminApiClient {
        email: Option<&str>,
        last_active_ip: Option<&str>,
        limit: u32,
-        offset: u32,
+        offset: u64,
    ) -> ApiResult<SearchUsersResponse> {
        let limit = limit.to_string();
        let offset = offset.to_string();
@@ -35,7 +35,8 @@ impl AdminApiClient {
        let response = response.into_inner();
        Ok(SearchUsersResponse {
            users: self.generated_value(response.users)?,
-            total: response.total as u64,
+            total: crate::api::generated::number_to_u64(response.total, "total")
+                .map_err(ApiError::Parse)?,
        })
    }

@@ -94,8 +95,8 @@ impl AdminApiClient {
        remove_flags: &[String],
    ) -> ApiResult<AdminUser> {
        let body = generated_types::AdminUserFlagsUpdateRequest {
-            add_flags: user_flags(add_flags),
-            remove_flags: user_flags(remove_flags),
+            add_flags: user_flags(add_flags)?,
+            remove_flags: user_flags(remove_flags)?,
        };
        let response = self
            .generated()
@@ -362,11 +363,8 @@ impl AdminApiClient {
    ) -> ApiResult<AdminUser> {
        let body = generated_types::AdminUserUsernameUpdateRequest {
            discriminator: discriminator
-                .map(generated_types::DiscriminatorType::try_from)
-                .transpose()
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-            username: generated_types::UsernameType::try_from(username)
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
+                .map(|value| generated_types::DiscriminatorType::String(value.to_owned())),
+            username: generated_types::UsernameType::from(username.to_owned()),
        };
        let response = self
            .generated()
@@ -395,11 +393,14 @@ impl AdminApiClient {
        user_id: &str,
        duration_hours: u32,
        reason: Option<&str>,
+        notify_user: bool,
        private_reason: Option<&str>,
    ) -> ApiResult<AdminUser> {
        let body = generated_types::AdminUserBanRequest {
            duration_hours: i32::try_from(duration_hours)
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
+                .map_err(|e| ApiError::Parse(e.to_string()))?
+                .into(),
+            notify_user,
            reason: reason.map(std::borrow::ToOwned::to_owned),
        };
        let resp: UserMutationResponse = self
@@ -412,10 +413,20 @@ impl AdminApiClient {
        Ok(resp.user)
    }

-    pub async fn unban_user(&self, user_id: &str) -> ApiResult<AdminUser> {
+    pub async fn unban_user(
+        &self,
+        user_id: &str,
+        public_reason: Option<&str>,
+        notify_user: bool,
+        private_reason: Option<&str>,
+    ) -> ApiResult<AdminUser> {
+        let body = generated_types::AdminUserUnbanRequest {
+            notify_user,
+            public_reason: public_reason.map(std::borrow::ToOwned::to_owned),
+        };
        let response = self
-            .generated()
-            .unban_admin_user(&snowflake(user_id))
+            .generated_with_reason(private_reason)?
+            .unban_admin_user(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -428,35 +439,69 @@ impl AdminApiClient {
        reason_code: i32,
        public_reason: Option<&str>,
        days_until_deletion: u32,
+        notify_user: bool,
+        audit_log_reason: Option<&str>,
    ) -> ApiResult<AdminUser> {
        let body = generated_types::AdminUserDeletionScheduleRequest {
-            days_until_deletion: Some(
-                crate::api::generated::nonzero_u32(days_until_deletion, "days_until_deletion")
-                    .map_err(ApiError::Parse)?,
-            ),
+            days_until_deletion: crate::api::generated::nonzero_u32(
+                days_until_deletion,
+                "days_until_deletion",
+            )
+            .map_err(ApiError::Parse)?
+            .into(),
+            notify_user,
            public_reason: public_reason.map(std::borrow::ToOwned::to_owned),
            reason_code: crate::api::generated::deletion_reason_code(reason_code, "reason_code")
                .map_err(ApiError::Parse)?,
+            replace_pending_deletion_at: None,
        };
        let response = self
-            .generated()
+            .generated_with_reason(audit_log_reason)?
            .schedule_admin_user_deletion(&snowflake(user_id), &body)
            .await
-            .map_err(|e| self.generated_error(e))?;
+            .map_err(|error| self.generated_error(error))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
        Ok(resp.user)
    }

-    pub async fn cancel_deletion(&self, user_id: &str) -> ApiResult<AdminUser> {
-        let response = self
-            .generated()
-            .cancel_admin_user_deletion(&snowflake(user_id))
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
+    pub async fn cancel_deletion(
+        &self,
+        user_id: &str,
+        expected_pending_deletion_at: &str,
+        notify_user: bool,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<AdminUser> {
+        let body = serde_json::json!({
+            "expected_pending_deletion_at": expected_pending_deletion_at,
+            "notify_user": notify_user,
+        });
+        let resp: UserMutationResponse = self
+            .delete_with_reason(
+                &format!("/admin/users/{}/deletion", urlencoding::encode(user_id)),
+                Some(&body),
+                audit_log_reason,
+            )
+            .await?;
        Ok(resp.user)
    }

+    pub async fn annotate_ban(
+        &self,
+        user_id: &str,
+        ban_audit_log_id: &str,
+        note: &str,
+    ) -> ApiResult<()> {
+        let body = serde_json::json!({
+            "ban_audit_log_id": ban_audit_log_id,
+            "note": note,
+        });
+        self.post_void(
+            &format!("/admin/users/{}/ban/notes", urlencoding::encode(user_id)),
+            Some(&body),
+        )
+        .await
+    }
+
    pub async fn change_dob(&self, user_id: &str, dob: &str) -> ApiResult<AdminUser> {
        let body = generated_types::AdminUserDobUpdateRequest {
            date_of_birth: dob.to_owned(),
@@ -484,10 +529,10 @@ impl AdminApiClient {
        target_id: &str,
        category: &str,
    ) -> ApiResult<()> {
-        let category = generated_types::RemoveAdminUserRelationshipCategory::try_from(category)
+        let category = generated_types::RelationshipCategoryEnum::try_from(category)
            .map_err(|e| ApiError::Parse(e.to_string()))?;
        self.generated()
-            .remove_admin_user_relationship(&snowflake(user_id), target_id, category)
+            .remove_admin_user_relationship(&snowflake(user_id), &snowflake(target_id), category)
            .await
            .map_err(|e| self.generated_error(e))?;
        Ok(())
@@ -498,7 +543,7 @@ impl AdminApiClient {
        user_id: &str,
        category: &str,
    ) -> ApiResult<super::types::RemoveRelationshipsResponse> {
-        let category = generated_types::ClearAdminUserRelationshipsCategory::try_from(category)
+        let category = generated_types::RelationshipCategoryEnum::try_from(category)
            .map_err(|e| ApiError::Parse(e.to_string()))?;
        let response = self
            .generated()
@@ -565,15 +610,13 @@ fn bool_param(value: bool) -> &'static str {
    if value { "true" } else { "false" }
 }

-fn snowflake(value: &str) -> generated_types::SnowflakeType {
-    generated_types::SnowflakeType::from(value.to_owned())
-}
-
-fn user_flags(values: &[String]) -> Vec<generated_types::UserFlags> {
+fn user_flags(values: &[String]) -> ApiResult<Vec<generated_types::UserFlags>> {
    values
        .iter()
-        .cloned()
-        .map(generated_types::UserFlags::from)
+        .map(|value| {
+            generated_types::UserFlags::try_from(value.as_str())
+                .map_err(|error| ApiError::Parse(error.to_string()))
+        })
        .collect()
 }

@@ -55,15 +55,14 @@ impl AdminApiClient {
        params: &serde_json::Value,
    ) -> ApiResult<UpdateVoiceRegionResponse> {
        let region_id = required_field(params, "id")?;
-        let body =
-            serde_json::from_value::<generated_types::UpdateVoiceRegionRequest>(params.clone())
-                .map_err(|e| ApiError::Parse(e.to_string()))?;
-        let response = self
-            .generated()
-            .update_admin_voice_region(&region_id, &body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        let body = voice_request_body(params, &["id"])?;
+        validate_against::<generated_types::UpdateVoiceRegionRequestBody>(&body)?;
+        self.patch_with_reason(
+            &format!("/admin/voice/regions/{}", urlencoding::encode(&region_id)),
+            Some(&body),
+            None,
+        )
+        .await
    }

    pub async fn delete_voice_region(&self, id: &str) -> ApiResult<DeleteVoiceResponse> {
@@ -103,9 +102,10 @@ impl AdminApiClient {
    ) -> ApiResult<CreateVoiceServerResponse> {
        let region_id = required_field(params, "region_id")?;
        paired_coordinates(params)?;
-        let body =
-            serde_json::from_value::<generated_types::CreateVoiceServerRequest>(params.clone())
-                .map_err(|e| ApiError::Parse(e.to_string()))?;
+        let body = serde_json::from_value::<generated_types::CreateVoiceServerRequestBody>(
+            voice_request_body(params, &["region_id"])?,
+        )
+        .map_err(|e| ApiError::Parse(e.to_string()))?;
        let response = self
            .generated()
            .create_admin_voice_server(&region_id, &body)
@@ -121,15 +121,18 @@ impl AdminApiClient {
        let region_id = required_field(params, "region_id")?;
        let server_id = required_field(params, "server_id")?;
        paired_coordinates(params)?;
-        let body =
-            serde_json::from_value::<generated_types::UpdateVoiceServerRequest>(params.clone())
-                .map_err(|e| ApiError::Parse(e.to_string()))?;
-        let response = self
-            .generated()
-            .update_admin_voice_server(&region_id, &server_id, &body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        let body = voice_request_body(params, &["region_id", "server_id"])?;
+        validate_against::<generated_types::UpdateVoiceServerRequestBody>(&body)?;
+        self.patch_with_reason(
+            &format!(
+                "/admin/voice/regions/{}/servers/{}",
+                urlencoding::encode(&region_id),
+                urlencoding::encode(&server_id)
+            ),
+            Some(&body),
+            None,
+        )
+        .await
    }

    pub async fn delete_voice_server(
@@ -150,6 +153,26 @@ fn bool_param(value: bool) -> &'static str {
    if value { "true" } else { "false" }
 }

+fn validate_against<T: serde::de::DeserializeOwned>(params: &serde_json::Value) -> ApiResult<()> {
+    serde_json::from_value::<T>(params.clone())
+        .map(drop)
+        .map_err(|e| ApiError::Parse(e.to_string()))
+}
+
+fn voice_request_body(
+    params: &serde_json::Value,
+    path_fields: &[&str],
+) -> ApiResult<serde_json::Value> {
+    let mut body = params
+        .as_object()
+        .ok_or_else(|| ApiError::Parse("voice request body must be an object".to_owned()))?
+        .clone();
+    for field in path_fields {
+        body.remove(*field);
+    }
+    Ok(body.into())
+}
+
 fn paired_coordinates(params: &serde_json::Value) -> ApiResult<()> {
    let has_coordinate = |field: &str| params.get(field).is_some_and(|value| !value.is_null());
    if has_coordinate("latitude") == has_coordinate("longitude") {
@@ -168,3 +191,67 @@ fn required_field(params: &serde_json::Value, field: &str) -> ApiResult<String>
        .map(std::borrow::ToOwned::to_owned)
        .ok_or_else(|| ApiError::Parse(format!("{field} is required")))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn region_update_body_preserves_explicit_restriction_clears() {
+        let expected = json!({
+            "required_guild_features": [],
+            "allowed_guild_ids": [],
+            "allowed_user_ids": [],
+        });
+        let mut params = expected.clone();
+        params["id"] = json!("eu");
+        let body = voice_request_body(&params, &["id"]).expect("region body");
+        validate_against::<generated_types::UpdateVoiceRegionRequestBody>(&body)
+            .expect("valid region body");
+        assert_eq!(body, expected);
+    }
+
+    #[test]
+    fn server_update_body_preserves_clears_and_omitted_restrictions() {
+        for expected in [
+            json!({
+                "required_guild_features": [],
+                "allowed_guild_ids": [],
+                "allowed_user_ids": [],
+                "soft_connection_limit": null,
+                "latitude": null,
+                "longitude": null,
+            }),
+            json!({"is_active": false}),
+        ] {
+            let mut params = expected.clone();
+            params["region_id"] = json!("eu");
+            params["server_id"] = json!("primary");
+            let body =
+                voice_request_body(&params, &["region_id", "server_id"]).expect("server body");
+            validate_against::<generated_types::UpdateVoiceServerRequestBody>(&body)
+                .expect("valid server body");
+            assert_eq!(body, expected);
+        }
+    }
+
+    #[test]
+    fn create_server_body_keeps_the_server_id_and_rejects_missing_fields() {
+        let expected = json!({
+            "server_id": "primary",
+            "endpoint": "wss://voice.example.com",
+            "api_key": "key",
+            "api_secret": "secret",
+        });
+        let mut params = expected.clone();
+        params["region_id"] = json!("eu");
+        let body = voice_request_body(&params, &["region_id"]).expect("server body");
+        validate_against::<generated_types::CreateVoiceServerRequestBody>(&body)
+            .expect("valid server body");
+        assert_eq!(body, expected);
+        assert!(
+            validate_against::<generated_types::CreateVoiceServerRequestBody>(&json!({})).is_err()
+        );
+    }
+}
@@ -1,7 +1,9 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use fluxer_common::config::normalize_public_endpoint_from_env;
-use std::env;
+use fluxer_common::config::{
+    normalize_base_path, normalize_public_endpoint_from_env, read_bool_env, read_env,
+    read_first_env, trim_trailing_slash,
+};

 const DEFAULT_ADMIN_OAUTH_CLIENT_ID: &str = "1234567890123456789";

@@ -17,12 +19,10 @@ pub struct AdminConfig {
    pub static_cdn_endpoint: String,
    pub admin_endpoint: String,
    pub web_app_endpoint: String,
-    pub kv_url: String,
    pub oauth_client_id: String,
    pub oauth_client_secret: String,
    pub oauth_redirect_uri: String,
    pub build_version: String,
-    pub release_channel: String,
    pub self_hosted: bool,
    pub proxy: ProxyConfig,
 }
@@ -47,8 +47,8 @@ impl AdminConfig {
            "FLUXER_ADMIN_ENDPOINT",
            "https://admin.fluxer.app",
        )));
-        let oauth_redirect_uri = normalize_public_endpoint_from_env(&read_env_preferred(
-            &["FLUXER_ADMIN_OAUTH_REDIRECT_URI"],
+        let oauth_redirect_uri = normalize_public_endpoint_from_env(&read_env(
+            "FLUXER_ADMIN_OAUTH_REDIRECT_URI",
            &format!("{admin_endpoint}/oauth2_callback"),
        ));
        let secret_key_base = read_env("FLUXER_ADMIN_SECRET_KEY_BASE", "");
@@ -82,38 +82,22 @@ impl AdminConfig {
                "FLUXER_APP_ENDPOINT",
                "https://app.fluxer.app",
            ))),
-            kv_url: read_env("FLUXER_KV_URL", ""),
            oauth_client_id: read_env(
                "FLUXER_ADMIN_OAUTH_CLIENT_ID",
                DEFAULT_ADMIN_OAUTH_CLIENT_ID,
            ),
            oauth_client_secret: read_env("FLUXER_ADMIN_OAUTH_CLIENT_SECRET", ""),
            oauth_redirect_uri,
-            build_version: read_env_preferred(
+            build_version: read_first_env(
                &["BUILD_VERSION", "FLUXER_BUILD_VERSION"],
                env!("CARGO_PKG_VERSION"),
            ),
-            release_channel: read_env_preferred(
-                &["RELEASE_CHANNEL", "FLUXER_RELEASE_CHANNEL"],
-                "stable",
-            ),
-            self_hosted: read_bool_env(&["FLUXER_SELF_HOSTED"], false),
+            self_hosted: read_bool_env("FLUXER_SELF_HOSTED", false),
            proxy: ProxyConfig {
-                trust_client_ip_header: read_bool_env(
-                    &["FLUXER_TRUST_CLIENT_IP_HEADER", "TRUST_CLIENT_IP_HEADER"],
-                    false,
-                ),
-                client_ip_header_name: read_env_preferred(
-                    &[
-                        "FLUXER_CLIENT_IP_HEADER_NAME",
-                        "FLUXER_CLIENT_IP_HEADER",
-                        "CLIENT_IP_HEADER_NAME",
-                        "CLIENT_IP_HEADER",
-                    ],
-                    "x-forwarded-for",
-                )
-                .trim()
-                .to_ascii_lowercase(),
+                trust_client_ip_header: read_bool_env("FLUXER_TRUST_CLIENT_IP_HEADER", false),
+                client_ip_header_name: read_env("FLUXER_CLIENT_IP_HEADER_NAME", "x-forwarded-for")
+                    .trim()
+                    .to_ascii_lowercase(),
            },
        })
    }
@@ -146,55 +130,21 @@ impl RuntimeEnv {
    }
 }

-pub fn normalize_base_path(value: &str) -> String {
-    let trimmed = value.trim().trim_matches('/');
-    if trimmed.is_empty() {
-        String::new()
-    } else {
-        format!("/{trimmed}")
-    }
-}
-
-pub fn trim_trailing_slash(value: &str) -> String {
-    value.trim_end_matches('/').to_owned()
-}
-
-pub(crate) fn read_env(name: &str, fallback: &str) -> String {
-    env::var(name).unwrap_or_else(|_| fallback.to_owned())
-}
-
-pub(crate) fn read_env_preferred(names: &[&str], fallback: &str) -> String {
-    names
-        .iter()
-        .find_map(|name| env::var(name).ok().filter(|value| !value.trim().is_empty()))
-        .unwrap_or_else(|| fallback.to_owned())
-}
-
-pub(crate) fn read_bool_env(names: &[&str], fallback: bool) -> bool {
-    let Some(value) = names.iter().find_map(|name| env::var(name).ok()) else {
-        return fallback;
-    };
-    matches!(
-        value.trim().to_ascii_lowercase().as_str(),
-        "1" | "true" | "yes" | "on"
-    )
-}
-
 #[cfg(test)]
 mod tests {
    use super::*;
+    use std::env;
    use std::sync::Mutex;

    static ENV_LOCK: Mutex<()> = Mutex::new(());

-    const MANAGED_ENV: [&str; 11] = [
+    const MANAGED_ENV: [&str; 10] = [
        "FLUXER_ENV",
        "FLUXER_ADMIN_HOST",
        "FLUXER_ADMIN_PORT",
        "FLUXER_ADMIN_ENDPOINT",
        "FLUXER_ADMIN_OAUTH_CLIENT_ID",
        "FLUXER_ADMIN_OAUTH_REDIRECT_URI",
-        "FLUXER_MASTER_CONFIG",
        "FLUXER_APP_ENDPOINT",
        "FLUXER_MEDIA_ENDPOINT",
        "FLUXER_STATIC_CDN_ENDPOINT",
@@ -291,12 +241,10 @@ mod tests {

            admin_endpoint: String::new(),
            web_app_endpoint: String::new(),
-            kv_url: String::new(),
            oauth_client_id: String::new(),
            oauth_client_secret: String::new(),
            oauth_redirect_uri: String::new(),
            build_version: String::new(),
-            release_channel: String::new(),
            self_hosted: false,
            proxy: ProxyConfig {
                trust_client_ip_header: false,
@@ -321,12 +269,10 @@ mod tests {

            admin_endpoint: String::new(),
            web_app_endpoint: String::new(),
-            kv_url: String::new(),
            oauth_client_id: String::new(),
            oauth_client_secret: String::new(),
            oauth_redirect_uri: String::new(),
            build_version: String::new(),
-            release_channel: String::new(),
            self_hosted: false,
            proxy: ProxyConfig {
                trust_client_ip_header: false,
@@ -2,6 +2,7 @@

 pub mod acl;
 pub mod admin_flags;
+pub mod admin_hints;
 pub mod api;
 pub mod config;
 pub mod fonts;
@@ -8,9 +8,7 @@ use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
    tracing_subscriber::registry()
-        .with(
-            tracing_subscriber::EnvFilter::try_from_default_env().unwrap_or_else(|_| "info".into()),
-        )
+        .with(fluxer_common::config::env_filter("info"))
        .with(tracing_subscriber::fmt::layer())
        .init();

@@ -215,12 +215,10 @@ mod tests {
            static_cdn_endpoint: String::new(),
            admin_endpoint: admin_endpoint.to_owned(),
            web_app_endpoint: String::new(),
-            kv_url: String::new(),
            oauth_client_id: String::new(),
            oauth_client_secret: String::new(),
            oauth_redirect_uri: String::new(),
            build_version: "test".to_owned(),
-            release_channel: String::new(),
            self_hosted: false,
            proxy: ProxyConfig {
                trust_client_ip_header: false,
@@ -81,7 +81,7 @@ async fn admin_api_keys_post(
        "create" => {
            let name = form.clean("name").unwrap_or_default();
            let acls = form.list_values_any(&["acls[]", "acls"]);
-            return match client.create_api_key(&name, &acls).await {
+            match client.create_api_key(&name, &acls).await {
                Ok(created) => {
                    let keys = client
                        .list_api_keys()
@@ -107,29 +107,38 @@ async fn admin_api_keys_post(
                        is_htmx,
                    )
                }
-            };
-        }
-        "revoke" => {
-            if let Some(key_id) = form.clean("key_id") {
-                let result = client.revoke_api_key(&key_id).await;
-                let flash = match result.log_error("revoke API key") {
-                    Some(_) => FlashData::success("API key revoked."),
-                    None => FlashData::error("Failed to revoke API key"),
-                };
-                return flash::redirect_with_flash(
-                    &format!("{base}/admin-api-keys"),
-                    flash,
-                    config.secure_cookies(),
-                );
            }
        }
-        _ => {}
+        "revoke" => {
+            let Some(key_id) = form.clean("key_id") else {
+                return admin_api_key_flash_response(
+                    config,
+                    FlashData::error("API key ID is required"),
+                    is_htmx,
+                );
+            };
+            let result = client.revoke_api_key(&key_id).await;
+            let flash = match result.log_error("revoke API key") {
+                Some(_) => FlashData::success("API key revoked."),
+                None => FlashData::error("Failed to revoke API key"),
+            };
+            flash::redirect_with_flash(
+                &format!("{base}/admin-api-keys"),
+                flash,
+                config.secure_cookies(),
+            )
+        }
+        "" => admin_api_key_flash_response(
+            config,
+            FlashData::error("API key action is required"),
+            is_htmx,
+        ),
+        _ => admin_api_key_flash_response(
+            config,
+            FlashData::error("Unknown API key action"),
+            is_htmx,
+        ),
    }
-    flash::redirect_with_flash(
-        &format!("{base}/admin-api-keys"),
-        FlashData::success(format!("API key action '{action}' completed.")),
-        config.secure_cookies(),
-    )
 }

 fn admin_api_key_flash_response(
@@ -16,17 +16,13 @@ use axum::{

 use super::ActionQuery;
 use super::bans_actions::{
-    BanFormData, custom_flash, execute_ban, extract_value, flash_response, htmx_flash,
+    BanFormData, custom_flash, execute_ban, extract_value, flash_response, render_inline_flash,
 };

 pub fn router() -> Router<AppState> {
    Router::new()
        .route("/ip-bans", get(ip_bans).post(ip_bans_post))
        .route("/email-bans", get(email_bans).post(email_bans_post))
-        .route(
-            "/suspicious-email-domains",
-            get(suspicious_email_domains).post(suspicious_email_domains_post),
-        )
        .route("/phrase-bans", get(phrase_bans).post(phrase_bans_post))
        .route("/url-bans", get(url_bans).post(url_bans_post))
        .route(
@@ -72,7 +68,6 @@ macro_rules! ban_get {

 ban_get!(ip_bans, "ip-bans");
 ban_get!(email_bans, "email-bans");
-ban_get!(suspicious_email_domains, "suspicious-email-domains");
 ban_get!(phrase_bans, "phrase-bans");
 ban_get!(url_bans, "url-bans");
 ban_get!(file_sha_bans, "file-sha-bans");
@@ -105,7 +100,7 @@ async fn generic_ban_post(
        form.audit_log_reason.as_deref(),
    )
    .await;
-    flash_response(config, auth, is_htmx, &level, &msg, ban_cfg, csrf_token)
+    flash_response(config, auth, is_htmx, level, &msg, ban_cfg, csrf_token)
 }

 macro_rules! ban_post {
@@ -141,7 +136,6 @@ macro_rules! ban_post {

 ban_post!(ip_bans_post, "ip-bans");
 ban_post!(email_bans_post, "email-bans");
-ban_post!(suspicious_email_domains_post, "suspicious-email-domains");
 ban_post!(phrase_bans_post, "phrase-bans");
 ban_post!(url_bans_post, "url-bans");
 ban_post!(file_sha_bans_post, "file-sha-bans");
@@ -171,19 +165,22 @@ async fn url_domain_bans_post(
        Query::try_from_uri(request.uri()).unwrap_or(Query(ActionQuery { action: None }));
    let form: BanFormData = match Form::from_request(request, &state).await {
        Ok(Form(f)) => f,
-        Err(_) => return htmx_flash("error", "Invalid form data", &headers),
+        Err(_) => return render_inline_flash("error", "Invalid form data"),
    };
    let is_htmx = htmx::is_htmx_request(&headers);
    let client = AdminApiClient::new(state.http_client(), config, &auth.0.session);
    let domain = form.domain.as_deref().unwrap_or("").trim().to_owned();
    if domain.is_empty() {
-        return htmx_flash("error", "Domain is required", &headers);
+        return render_inline_flash("error", "Domain is required");
    }
    let action = aq.action.as_deref().unwrap_or("");
    let (level, msg) = match action {
        "ban" => {
            let m_sub = form.match_subdomains.as_deref() == Some("true");
-            match client.ban_url_domain(&domain, m_sub).await {
+            match client
+                .ban_url_domain(&domain, m_sub, form.audit_log_reason.as_deref())
+                .await
+            {
                Ok(()) => ("success", format!("Domain {domain} banned successfully")),
                Err(error) => {
                    tracing::warn!(%error, domain, "admin API request failed: ban URL domain");
@@ -191,7 +188,10 @@ async fn url_domain_bans_post(
                }
            }
        }
-        "unban" => match client.unban_url_domain(&domain).await {
+        "unban" => match client
+            .unban_url_domain(&domain, form.audit_log_reason.as_deref())
+            .await
+        {
            Ok(()) => ("success", format!("Domain {domain} unbanned")),
            Err(error) => {
                tracing::warn!(%error, domain, "admin API request failed: unban URL domain");
@@ -247,25 +247,31 @@ async fn profile_substring_bans_post(
        Query::try_from_uri(request.uri()).unwrap_or(Query(ActionQuery { action: None }));
    let form: BanFormData = match Form::from_request(request, &state).await {
        Ok(Form(f)) => f,
-        Err(_) => return htmx_flash("error", "Invalid form data", &headers),
+        Err(_) => return render_inline_flash("error", "Invalid form data"),
    };
    let is_htmx = htmx::is_htmx_request(&headers);
    let client = AdminApiClient::new(state.http_client(), config, &auth.0.session);
    let scope = form.scope.as_deref().unwrap_or("").trim().to_owned();
    let substring = form.substring.as_deref().unwrap_or("").trim().to_owned();
    if scope.is_empty() || substring.is_empty() {
-        return htmx_flash("error", "Scope and substring required", &headers);
+        return render_inline_flash("error", "Scope and substring required");
    }
    let action = aq.action.as_deref().unwrap_or("");
    let (level, msg) = match action {
-        "ban" => match client.ban_profile_substring(&scope, &substring).await {
+        "ban" => match client
+            .ban_profile_substring(&scope, &substring, form.audit_log_reason.as_deref())
+            .await
+        {
            Ok(()) => ("success", format!("\"{substring}\" banned for {scope}")),
            Err(error) => {
                tracing::warn!(%error, scope, substring, "admin API request failed: ban profile substring");
                ("error", format!("Failed to ban substring for {scope}"))
            }
        },
-        "unban" => match client.unban_profile_substring(&scope, &substring).await {
+        "unban" => match client
+            .unban_profile_substring(&scope, &substring, form.audit_log_reason.as_deref())
+            .await
+        {
            Ok(()) => ("success", format!("\"{substring}\" unbanned for {scope}")),
            Err(error) => {
                tracing::warn!(%error, scope, substring, "admin API request failed: unban profile substring");
@@ -1,17 +1,13 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::client::AdminApiClient;
+use crate::api::client::{AdminApiClient, ApiResult};
 use crate::api::types::{FlashLevel, FlashMessage};
 use crate::middleware::auth::AuthContext;
 use crate::templates;
-use axum::{
-    http::HeaderMap,
-    response::{Html, IntoResponse, Response},
-};
+use axum::response::{Html, IntoResponse, Response};
 use serde::Deserialize;

 #[derive(Deserialize)]
-#[allow(dead_code)]
 pub struct BanFormData {
    #[serde(default)]
    pub ip: Option<String>,
@@ -65,7 +61,7 @@ pub async fn execute_ban(
    bulk_hashes: Option<&str>,
    bulk_sha256_list: Option<&str>,
    audit_log_reason: Option<&str>,
-) -> (String, String) {
+) -> (&'static str, String) {
    if (action == "bulk-ban" || action == "bulk-ban-files") && ban_type == "file-sha-bans" {
        let raw_hashes = if action == "bulk-ban-files" {
            bulk_sha256_list
@@ -75,13 +71,13 @@ pub async fn execute_ban(
        return execute_bulk_ban(client, raw_hashes, audit_log_reason).await;
    }
    if value.is_empty() {
-        return ("error".into(), "Value is required".into());
+        return ("error", "Value is required".into());
    }
    match action {
        "ban" => execute_single_ban(client, ban_type, value, audit_log_reason).await,
        "unban" => execute_single_unban(client, ban_type, value, audit_log_reason).await,
        "check" => execute_check(client, ban_type, value).await,
-        _ => ("error".into(), "Unknown action".into()),
+        _ => ("error", "Unknown action".into()),
    }
 }

@@ -89,7 +85,7 @@ async fn execute_bulk_ban(
    client: &AdminApiClient,
    bulk_hashes: Option<&str>,
    audit_log_reason: Option<&str>,
-) -> (String, String) {
+) -> (&'static str, String) {
    let hashes: Vec<String> = bulk_hashes
        .unwrap_or("")
        .split(|c: char| c.is_whitespace() || c == ',' || c == ';')
@@ -98,18 +94,15 @@ async fn execute_bulk_ban(
        .collect();
    if hashes.is_empty() {
        return (
-            "error".into(),
+            "error",
            "No valid 64-character hex hashes found in input".into(),
        );
    }
    match client.bulk_ban_file_shas(&hashes, audit_log_reason).await {
-        Ok(r) => (
-            "success".into(),
-            format!("Bulk ban job created: {}", r.job_id),
-        ),
+        Ok(r) => ("success", format!("Bulk ban job created: {}", r.job_id)),
        Err(error) => {
            tracing::warn!(%error, "admin API request failed: bulk ban file SHAs");
-            ("error".into(), "Failed to enqueue bulk ban job".into())
+            ("error", "Failed to enqueue bulk ban job".into())
        }
    }
 }
@@ -119,29 +112,21 @@ async fn execute_single_ban(
    ban_type: &str,
    value: &str,
    audit_log_reason: Option<&str>,
-) -> (String, String) {
-    let success = format!("{value} banned successfully");
-    let failure = format!("Failed to ban {value}");
-    match ban_type {
-        "ip-bans" => ban_action_result(client.ban_ip(value).await, success, failure),
-        "email-bans" => ban_action_result(client.ban_email(value).await, success, failure),
-        "suspicious-email-domains" => ban_action_result(
-            client.add_suspicious_email_domain(value).await,
-            success,
-            failure,
-        ),
-        "phrase-bans" => ban_action_result(client.ban_phrase(value).await, success, failure),
-        "url-bans" => ban_action_result(client.ban_url(value).await, success, failure),
-        "file-sha-bans" => ban_action_result(
-            client.ban_file_sha(value, audit_log_reason).await,
-            success,
-            failure,
-        ),
-        "avatar-hash-bans" => {
-            ban_action_result(client.ban_avatar_hash(value).await, success, failure)
-        }
-        _ => ("error".into(), "Unknown ban type".into()),
-    }
+) -> (&'static str, String) {
+    let result = match ban_type {
+        "ip-bans" => client.ban_ip(value, audit_log_reason).await,
+        "email-bans" => client.ban_email(value, audit_log_reason).await,
+        "phrase-bans" => client.ban_phrase(value, audit_log_reason).await,
+        "url-bans" => client.ban_url(value, audit_log_reason).await,
+        "file-sha-bans" => client.ban_file_sha(value, audit_log_reason).await,
+        "avatar-hash-bans" => client.ban_avatar_hash(value, audit_log_reason).await,
+        _ => return ("error", "Unknown ban type".into()),
+    };
+    ban_action_result(
+        result,
+        format!("{value} banned successfully"),
+        format!("Failed to ban {value}"),
+    )
 }

 async fn execute_single_unban(
@@ -149,62 +134,57 @@ async fn execute_single_unban(
    ban_type: &str,
    value: &str,
    audit_log_reason: Option<&str>,
-) -> (String, String) {
-    let success = format!("{value} unbanned successfully");
-    let failure = format!("Failed to unban {value}");
-    match ban_type {
-        "ip-bans" => ban_action_result(client.unban_ip(value).await, success, failure),
-        "email-bans" => ban_action_result(client.unban_email(value).await, success, failure),
-        "suspicious-email-domains" => ban_action_result(
-            client.remove_suspicious_email_domain(value).await,
-            success,
-            failure,
-        ),
-        "phrase-bans" => ban_action_result(client.unban_phrase(value).await, success, failure),
-        "url-bans" => ban_action_result(client.unban_url(value).await, success, failure),
-        "file-sha-bans" => ban_action_result(
-            client.unban_file_sha(value, audit_log_reason).await,
-            success,
-            failure,
-        ),
-        "avatar-hash-bans" => {
-            ban_action_result(client.unban_avatar_hash(value).await, success, failure)
-        }
-        _ => ("error".into(), "Unknown ban type".into()),
-    }
+) -> (&'static str, String) {
+    let result = match ban_type {
+        "ip-bans" => client.unban_ip(value, audit_log_reason).await,
+        "email-bans" => client.unban_email(value, audit_log_reason).await,
+        "phrase-bans" => client.unban_phrase(value, audit_log_reason).await,
+        "url-bans" => client.unban_url(value, audit_log_reason).await,
+        "file-sha-bans" => client.unban_file_sha(value, audit_log_reason).await,
+        "avatar-hash-bans" => client.unban_avatar_hash(value, audit_log_reason).await,
+        _ => return ("error", "Unknown ban type".into()),
+    };
+    ban_action_result(
+        result,
+        format!("{value} unbanned successfully"),
+        format!("Failed to unban {value}"),
+    )
 }

-async fn execute_check(client: &AdminApiClient, ban_type: &str, value: &str) -> (String, String) {
+async fn execute_check(
+    client: &AdminApiClient,
+    ban_type: &str,
+    value: &str,
+) -> (&'static str, String) {
    let result = match ban_type {
        "ip-bans" => client.check_ip_ban(value).await,
        "email-bans" => client.check_email_ban(value).await,
-        "suspicious-email-domains" => client.check_suspicious_email_domain(value).await,
        "phrase-bans" => client.check_phrase_ban(value).await,
        "url-bans" => client.check_url_ban(value).await,
        "file-sha-bans" => client.check_file_sha_ban(value).await,
        "avatar-hash-bans" => client.check_avatar_hash_ban(value).await,
-        _ => return ("error".into(), "Unknown ban type".into()),
+        _ => return ("error", "Unknown ban type".into()),
    };
    match result {
-        Ok(r) if r.banned => ("info".into(), format!("{value} is banned")),
-        Ok(_) => ("info".into(), format!("{value} is NOT banned")),
+        Ok(r) if r.banned => ("info", format!("{value} is banned")),
+        Ok(_) => ("info", format!("{value} is NOT banned")),
        Err(error) => {
            tracing::warn!(%error, ban_type, value, "admin API request failed: check ban status");
-            ("error".into(), "Error checking ban status".into())
+            ("error", "Error checking ban status".into())
        }
    }
 }

-fn ban_action_result<T, E: std::fmt::Display>(
-    result: Result<T, E>,
+fn ban_action_result(
+    result: ApiResult<()>,
    success_message: String,
    error_message: String,
-) -> (String, String) {
+) -> (&'static str, String) {
    match result {
-        Ok(_) => ("success".into(), success_message),
+        Ok(()) => ("success", success_message),
        Err(error) => {
            tracing::warn!(%error, "admin API request failed: ban action");
-            ("error".into(), error_message)
+            ("error", error_message)
        }
    }
 }
@@ -228,11 +208,6 @@ pub fn flash_response(
    }
 }

-pub fn htmx_flash(level: &str, message: &str, headers: &HeaderMap) -> Response {
-    let _ = headers;
-    render_inline_flash(level, message)
-}
-
 pub fn render_inline_flash(level: &str, message: &str) -> Response {
    let (border, bg, text) = match level {
        "success" => ("border-green-300", "bg-green-50", "text-green-800"),
@@ -0,0 +1,597 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+use crate::{
+    api::{
+        client::ApiError,
+        types::{
+            AppBrandingConfigUpdateRequest, AppPublicConfigUpdateRequest,
+            BILLING_MAX_COUNTRY_CURRENCIES, BILLING_MAX_CURRENCIES,
+            BILLING_MAX_LEGACY_PRICES_PER_SLOT, BILLING_MAX_LEGACY_SLOTS, BILLING_PRICE_SLOTS,
+            BillingPriceSet, InstanceBillingUpdateRequest, InstanceConfigUpdateRequest,
+            PREMIUM_PRODUCT_NAME_MAX_CHARS, TRI_STATE_DEFAULT, TRI_STATE_OFF, TRI_STATE_ON,
+        },
+    },
+    middleware::flash::FlashData,
+    utils::forms::MultiValueForm,
+};
+use std::collections::BTreeMap;
+
+const PRICE_ID_MAX_CHARS: usize = 255;
+const INFO_URL_MAX_CHARS: usize = 2048;
+
+pub(super) fn build_billing_update(
+    form: &MultiValueForm,
+) -> Result<InstanceConfigUpdateRequest, String> {
+    let premium_product_name = if form.contains_key("billing_premium_product_name") {
+        Some(parse_premium_product_name(
+            form.clean("billing_premium_product_name"),
+        )?)
+    } else {
+        None
+    };
+    let premium_info_url = if form.contains_key("billing_premium_info_url") {
+        Some(parse_info_url(form.clean("billing_premium_info_url"))?)
+    } else {
+        None
+    };
+    let branding = (premium_product_name.is_some() || premium_info_url.is_some()).then(|| {
+        AppBrandingConfigUpdateRequest {
+            premium_product_name,
+            premium_info_url,
+            ..Default::default()
+        }
+    });
+    let prices = if form.contains_key("billing_price_currency") {
+        Some(parse_price_rows(form)?)
+    } else {
+        None
+    };
+    let default_currency = if form.contains_key("billing_default_currency") {
+        Some(
+            form.clean("billing_default_currency")
+                .map(|value| parse_currency(&value))
+                .transpose()?,
+        )
+    } else {
+        None
+    };
+    let country_currencies = if form.contains_key("billing_country_currencies") {
+        Some(parse_country_currencies(
+            form.first("billing_country_currencies").unwrap_or(""),
+        )?)
+    } else {
+        None
+    };
+    let legacy_prices = if form.contains_key("billing_legacy_prices") {
+        Some(parse_legacy_prices(
+            form.first("billing_legacy_prices").unwrap_or(""),
+        )?)
+    } else {
+        None
+    };
+    if let Some(Some(prices)) = &prices {
+        if let Some(Some(currency)) = &default_currency
+            && !prices.contains_key(currency)
+        {
+            return Err(format!(
+                "Default currency {currency} has no row in the price table"
+            ));
+        }
+        if let Some(Some(countries)) = &country_currencies
+            && let Some((country, currency)) = countries
+                .iter()
+                .find(|(_, currency)| !prices.contains_key(*currency))
+        {
+            return Err(format!(
+                "{country} maps to {currency}, which has no row in the price table"
+            ));
+        }
+    }
+    Ok(InstanceConfigUpdateRequest {
+        app_public: branding.map(|branding| AppPublicConfigUpdateRequest {
+            branding: Some(branding),
+            ..Default::default()
+        }),
+        billing: Some(InstanceBillingUpdateRequest {
+            enabled: parse_tri_state(form, "billing_enabled")?,
+            stripe_secret_key: secret_update(
+                form,
+                "billing_stripe_secret_key",
+                "billing_clear_stripe_secret_key",
+            ),
+            stripe_webhook_secret: secret_update(
+                form,
+                "billing_stripe_webhook_secret",
+                "billing_clear_stripe_webhook_secret",
+            ),
+            default_currency,
+            prices,
+            country_currencies,
+            legacy_prices,
+            automatic_tax: parse_tri_state(form, "billing_automatic_tax")?,
+            tax_id_collection: parse_tri_state(form, "billing_tax_id_collection")?,
+            terms_consent_required: parse_tri_state(form, "billing_terms_consent_required")?,
+        }),
+        ..Default::default()
+    })
+}
+
+fn parse_tri_state(form: &MultiValueForm, key: &str) -> Result<Option<Option<bool>>, String> {
+    if !form.contains_key(key) {
+        return Ok(None);
+    }
+    match form.first(key).map(str::trim).unwrap_or("") {
+        TRI_STATE_DEFAULT => Ok(Some(None)),
+        TRI_STATE_ON => Ok(Some(Some(true))),
+        TRI_STATE_OFF => Ok(Some(Some(false))),
+        other => Err(format!("Invalid choice \"{other}\" for {key}")),
+    }
+}
+
+pub(super) fn billing_result<T>(result: Result<T, ApiError>) -> FlashData {
+    match result {
+        Ok(_) => FlashData::success("Premium and billing settings updated"),
+        Err(error) => {
+            tracing::warn!(%error, "admin API request failed: update billing config");
+            match validation_message(&error) {
+                Some(message) => FlashData::error(format!(
+                    "Failed to update premium and billing settings: {message}"
+                )),
+                None => FlashData::error("Failed to update premium and billing settings"),
+            }
+        }
+    }
+}
+
+fn validation_message(error: &ApiError) -> Option<String> {
+    let ApiError::Http {
+        status: 400,
+        message,
+    } = error
+    else {
+        return None;
+    };
+    let body: serde_json::Value = serde_json::from_str(message).ok()?;
+    let first = body["errors"].as_array().and_then(|errors| errors.first());
+    let detail = first.and_then(|error| {
+        let message = error["message"].as_str()?;
+        Some(
+            match error["path"].as_str().filter(|path| !path.is_empty()) {
+                Some(path) => format!("{path}: {message}"),
+                None => message.to_owned(),
+            },
+        )
+    });
+    detail.or_else(|| body["message"].as_str().map(str::to_owned))
+}
+
+fn secret_update(form: &MultiValueForm, key: &str, clear_key: &str) -> Option<Option<String>> {
+    match form.clean(key) {
+        Some(secret) => Some(Some(secret)),
+        None if form.bool_value(clear_key) => Some(None),
+        None => None,
+    }
+}
+
+fn parse_premium_product_name(value: Option<String>) -> Result<Option<String>, String> {
+    match value {
+        Some(name) if name.encode_utf16().count() > PREMIUM_PRODUCT_NAME_MAX_CHARS => Err(format!(
+            "Premium name must be at most {PREMIUM_PRODUCT_NAME_MAX_CHARS} characters"
+        )),
+        other => Ok(other),
+    }
+}
+
+fn parse_info_url(value: Option<String>) -> Result<Option<String>, String> {
+    let Some(value) = value else {
+        return Ok(None);
+    };
+    let valid = value.chars().count() <= INFO_URL_MAX_CHARS
+        && url::Url::parse(&value).is_ok_and(|url| {
+            matches!(url.scheme(), "http" | "https")
+                && url.host_str().is_some_and(|h| !h.is_empty())
+        });
+    if valid {
+        Ok(Some(value))
+    } else {
+        Err("Premium info URL must be an absolute http or https URL".to_owned())
+    }
+}
+
+fn parse_currency(value: &str) -> Result<String, String> {
+    let currency = value.trim().to_ascii_uppercase();
+    if currency.len() == 3 && currency.bytes().all(|byte| byte.is_ascii_uppercase()) {
+        Ok(currency)
+    } else {
+        Err(format!(
+            "Invalid currency \"{}\": use a 3-letter ISO 4217 code such as GBP",
+            value.trim()
+        ))
+    }
+}
+
+fn parse_country(value: &str) -> Result<String, String> {
+    let country = value.trim().to_ascii_uppercase();
+    if country.len() == 2 && country.bytes().all(|byte| byte.is_ascii_uppercase()) {
+        Ok(country)
+    } else {
+        Err(format!(
+            "Invalid country \"{}\": use a 2-letter ISO 3166 code such as SE",
+            value.trim()
+        ))
+    }
+}
+
+fn parse_price_id(value: &str) -> Result<String, String> {
+    let id = value.trim();
+    let valid = id.len() <= PRICE_ID_MAX_CHARS
+        && id.strip_prefix("price_").is_some_and(|rest| {
+            !rest.is_empty() && rest.bytes().all(|b| b.is_ascii_alphanumeric())
+        });
+    if valid {
+        Ok(id.to_owned())
+    } else {
+        Err(format!(
+            "Invalid Stripe price ID \"{id}\": it must look like price_1AbC"
+        ))
+    }
+}
+
+fn parse_optional_price_id(value: Option<&String>) -> Result<Option<String>, String> {
+    match value
+        .map(|value| value.trim())
+        .filter(|value| !value.is_empty())
+    {
+        Some(id) => parse_price_id(id).map(Some),
+        None => Ok(None),
+    }
+}
+
+fn parse_price_rows(
+    form: &MultiValueForm,
+) -> Result<Option<BTreeMap<String, BillingPriceSet>>, String> {
+    let currencies = form.values("billing_price_currency");
+    let column = |key: &str, index: usize| form.values(key).get(index);
+    let mut prices = BTreeMap::new();
+    for (index, currency) in currencies.iter().enumerate() {
+        if currency.trim().is_empty() {
+            continue;
+        }
+        let currency = parse_currency(currency)?;
+        let set = BillingPriceSet {
+            monthly: parse_optional_price_id(column("billing_price_monthly", index))?,
+            yearly: parse_optional_price_id(column("billing_price_yearly", index))?,
+            gift_1_month: parse_optional_price_id(column("billing_price_gift_1_month", index))?,
+            gift_1_year: parse_optional_price_id(column("billing_price_gift_1_year", index))?,
+        };
+        if set.is_empty() {
+            return Err(format!("{currency} needs at least one price ID"));
+        }
+        if prices.insert(currency.clone(), set).is_some() {
+            return Err(format!(
+                "{currency} appears more than once in the price table"
+            ));
+        }
+    }
+    if prices.len() > BILLING_MAX_CURRENCIES {
+        return Err(format!(
+            "The price table holds at most {BILLING_MAX_CURRENCIES} currencies"
+        ));
+    }
+    Ok((!prices.is_empty()).then_some(prices))
+}
+
+fn key_value_lines(value: &str) -> impl Iterator<Item = Result<(&str, &str), String>> {
+    value
+        .lines()
+        .map(str::trim)
+        .filter(|line| !line.is_empty())
+        .map(|line| {
+            line.split_once('=')
+                .map(|(key, value)| (key.trim(), value.trim()))
+                .ok_or_else(|| format!("Line \"{line}\" must use the form KEY=VALUE"))
+        })
+}
+
+fn parse_country_currencies(value: &str) -> Result<Option<BTreeMap<String, String>>, String> {
+    let mut countries = BTreeMap::new();
+    for line in key_value_lines(value) {
+        let (country, currency) = line?;
+        let country = parse_country(country)?;
+        let currency = parse_currency(currency)?;
+        if countries.insert(country.clone(), currency).is_some() {
+            return Err(format!("{country} is mapped more than once"));
+        }
+    }
+    if countries.len() > BILLING_MAX_COUNTRY_CURRENCIES {
+        return Err(format!(
+            "At most {BILLING_MAX_COUNTRY_CURRENCIES} country mappings are allowed"
+        ));
+    }
+    Ok((!countries.is_empty()).then_some(countries))
+}
+
+fn parse_legacy_slot(value: &str) -> Result<String, String> {
+    let invalid = || {
+        format!(
+            "Invalid legacy price slot \"{value}\": use monthly, yearly, gift_1_month or gift_1_year followed by _ and a currency, such as monthly_GBP"
+        )
+    };
+    let (slot, currency) = value.rsplit_once('_').ok_or_else(invalid)?;
+    let slot = slot.to_ascii_lowercase();
+    if !BILLING_PRICE_SLOTS.contains(&slot.as_str()) {
+        return Err(invalid());
+    }
+    let currency = parse_currency(currency).map_err(|_| invalid())?;
+    Ok(format!("{slot}_{currency}"))
+}
+
+fn parse_legacy_prices(value: &str) -> Result<Option<BTreeMap<String, Vec<String>>>, String> {
+    let mut legacy: BTreeMap<String, Vec<String>> = BTreeMap::new();
+    for line in key_value_lines(value) {
+        let (slot, ids) = line?;
+        let slot = parse_legacy_slot(slot)?;
+        let entry = legacy.entry(slot.clone()).or_default();
+        for id in ids.split(',').map(str::trim).filter(|id| !id.is_empty()) {
+            let id = parse_price_id(id)?;
+            if !entry.contains(&id) {
+                entry.push(id);
+            }
+        }
+        if entry.is_empty() {
+            return Err(format!("{slot} needs at least one price ID"));
+        }
+        if entry.len() > BILLING_MAX_LEGACY_PRICES_PER_SLOT {
+            return Err(format!(
+                "{slot} holds at most {BILLING_MAX_LEGACY_PRICES_PER_SLOT} legacy price IDs"
+            ));
+        }
+    }
+    if legacy.len() > BILLING_MAX_LEGACY_SLOTS {
+        return Err(format!(
+            "At most {BILLING_MAX_LEGACY_SLOTS} legacy price slots are allowed"
+        ));
+    }
+    Ok((!legacy.is_empty()).then_some(legacy))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::api::generated::types as generated_types;
+    use serde_json::json;
+
+    fn full_form(extra: &str) -> MultiValueForm {
+        let base = "billing_premium_product_name=%20Gold%20\
+            &billing_premium_info_url=https%3A%2F%2Fexample.com%2Fgold\
+            &billing_enabled=on\
+            &billing_automatic_tax=default&billing_tax_id_collection=on&billing_terms_consent_required=off\
+            &billing_stripe_secret_key=\
+            &billing_stripe_webhook_secret=whsec_new\
+            &billing_default_currency=gbp\
+            &billing_price_currency=gbp&billing_price_monthly=price_1GbpM&billing_price_yearly=price_1GbpY\
+            &billing_price_gift_1_month=&billing_price_gift_1_year=price_1GbpG\
+            &billing_price_currency=SEK&billing_price_monthly=price_1SekM&billing_price_yearly=price_1SekY\
+            &billing_price_gift_1_month=&billing_price_gift_1_year=\
+            &billing_price_currency=&billing_price_monthly=&billing_price_yearly=\
+            &billing_price_gift_1_month=&billing_price_gift_1_year=\
+            &billing_country_currencies=se%3Dsek%0D%0AGB%20%3D%20GBP%0D%0A\
+            &billing_legacy_prices=monthly_GBP%3Dprice_1OldA%0Amonthly_gbp%3Dprice_1OldB%2Cprice_1OldA%0Ayearly_SEK%3Dprice_1OldC";
+        MultiValueForm::parse(format!("{base}{extra}").as_bytes())
+    }
+
+    #[test]
+    fn full_billing_form_builds_the_expected_patch() {
+        let update = build_billing_update(&full_form("")).expect("valid form");
+        let value = serde_json::to_value(&update).expect("serializable");
+        serde_json::from_value::<generated_types::InstanceConfigUpdateRequest>(value.clone())
+            .expect("generated update contract");
+        assert_eq!(
+            value,
+            json!({
+                "app_public": {
+                    "branding": {
+                        "premium_product_name": "Gold",
+                        "premium_info_url": "https://example.com/gold"
+                    }
+                },
+                "billing": {
+                    "enabled": true,
+                    "stripe_webhook_secret": "whsec_new",
+                    "default_currency": "GBP",
+                    "prices": {
+                        "GBP": {
+                            "monthly": "price_1GbpM",
+                            "yearly": "price_1GbpY",
+                            "gift_1_month": null,
+                            "gift_1_year": "price_1GbpG"
+                        },
+                        "SEK": {
+                            "monthly": "price_1SekM",
+                            "yearly": "price_1SekY",
+                            "gift_1_month": null,
+                            "gift_1_year": null
+                        }
+                    },
+                    "country_currencies": {"GB": "GBP", "SE": "SEK"},
+                    "legacy_prices": {
+                        "monthly_GBP": ["price_1OldA", "price_1OldB"],
+                        "yearly_SEK": ["price_1OldC"]
+                    },
+                    "automatic_tax": null,
+                    "tax_id_collection": true,
+                    "terms_consent_required": false
+                }
+            })
+        );
+    }
+
+    #[test]
+    fn blank_fields_clear_and_the_default_choice_sends_null() {
+        let form = MultiValueForm::parse(
+            b"billing_premium_product_name=&billing_premium_info_url=&billing_enabled=default\
+              &billing_stripe_secret_key=&billing_clear_stripe_secret_key=true\
+              &billing_stripe_webhook_secret=\
+              &billing_default_currency=\
+              &billing_price_currency=&billing_price_monthly=price_1Ignored\
+              &billing_country_currencies=&billing_legacy_prices=",
+        );
+        let value = serde_json::to_value(build_billing_update(&form).expect("valid form")).unwrap();
+        assert_eq!(
+            value,
+            json!({
+                "app_public": {
+                    "branding": {"premium_product_name": null, "premium_info_url": null}
+                },
+                "billing": {
+                    "enabled": null,
+                    "stripe_secret_key": null,
+                    "default_currency": null,
+                    "prices": null,
+                    "country_currencies": null,
+                    "legacy_prices": null
+                }
+            })
+        );
+    }
+
+    #[test]
+    fn a_new_secret_wins_over_the_clear_checkbox() {
+        let form = MultiValueForm::parse(
+            b"billing_stripe_secret_key=%20sk_live_x%20&billing_clear_stripe_secret_key=true",
+        );
+        let billing = build_billing_update(&form)
+            .expect("valid form")
+            .billing
+            .expect("billing");
+        assert_eq!(
+            billing.stripe_secret_key,
+            Some(Some("sk_live_x".to_owned()))
+        );
+        assert_eq!(billing.stripe_webhook_secret, None);
+    }
+
+    #[test]
+    fn absent_form_keys_leave_their_fields_untouched() {
+        let update = build_billing_update(&MultiValueForm::parse(b"billing_enabled=off"))
+            .expect("valid form");
+        assert!(update.app_public.is_none());
+        assert_eq!(
+            serde_json::to_value(update.billing).unwrap(),
+            json!({"enabled": false})
+        );
+        let untouched = build_billing_update(&MultiValueForm::parse(b"")).expect("valid form");
+        assert_eq!(serde_json::to_value(untouched.billing).unwrap(), json!({}));
+    }
+
+    #[test]
+    fn invalid_input_is_rejected_with_a_message() {
+        let cases: &[(&str, &str)] = &[
+            (
+                "billing_premium_info_url=ftp%3A%2F%2Fexample.com",
+                "http or https",
+            ),
+            ("billing_premium_info_url=example.com", "http or https"),
+            ("billing_default_currency=GB", "Invalid currency"),
+            ("billing_enabled=true", "Invalid choice"),
+            ("billing_automatic_tax=maybe", "Invalid choice"),
+            (
+                "billing_price_currency=GBPX&billing_price_monthly=price_1A",
+                "Invalid currency",
+            ),
+            (
+                "billing_price_currency=GBP&billing_price_monthly=prod_1A",
+                "Invalid Stripe price ID",
+            ),
+            (
+                "billing_price_currency=GBP&billing_price_monthly=price_1-A",
+                "Invalid Stripe price ID",
+            ),
+            ("billing_price_currency=GBP", "needs at least one price ID"),
+            (
+                "billing_price_currency=GBP&billing_price_monthly=price_1A&billing_price_currency=gbp&billing_price_monthly=price_1B",
+                "more than once",
+            ),
+            ("billing_country_currencies=SWE%3DSEK", "Invalid country"),
+            ("billing_country_currencies=SE", "KEY=VALUE"),
+            (
+                "billing_country_currencies=SE%3DSEK%0ASE%3DEUR",
+                "mapped more than once",
+            ),
+            (
+                "billing_legacy_prices=weekly_GBP%3Dprice_1A",
+                "Invalid legacy price slot",
+            ),
+            (
+                "billing_legacy_prices=monthly_GBP%3D",
+                "needs at least one price ID",
+            ),
+            (
+                "billing_default_currency=EUR&billing_price_currency=GBP&billing_price_monthly=price_1A",
+                "Default currency EUR has no row",
+            ),
+            (
+                "billing_country_currencies=SE%3DSEK&billing_price_currency=GBP&billing_price_monthly=price_1A",
+                "SE maps to SEK",
+            ),
+        ];
+        let long_name = format!("billing_premium_product_name={}", "A".repeat(41));
+        let emoji_name = format!(
+            "billing_premium_product_name=Gold{}",
+            "%F0%9F%92%8E".repeat(20)
+        );
+        let long_case = [
+            (long_name.as_str(), "at most 40"),
+            (emoji_name.as_str(), "at most 40"),
+        ];
+        for (body, expected) in long_case.iter().chain(cases.iter()) {
+            let error =
+                build_billing_update(&MultiValueForm::parse(body.as_bytes())).expect_err(body);
+            assert!(error.contains(expected), "{body}: {error}");
+        }
+    }
+
+    #[test]
+    fn premium_name_limit_counts_utf16_units() {
+        let name = format!("{}{}", "A".repeat(39), "\u{1F48E}");
+        assert_eq!(name.chars().count(), 40);
+        assert!(parse_premium_product_name(Some(name)).is_err());
+        let fits = format!("{}{}", "A".repeat(38), "\u{E9}\u{E9}");
+        assert_eq!(
+            parse_premium_product_name(Some(fits.clone())),
+            Ok(Some(fits))
+        );
+    }
+
+    #[test]
+    fn country_currencies_are_not_cross_checked_without_a_price_table() {
+        let form = MultiValueForm::parse(b"billing_country_currencies=SE%3DSEK");
+        let billing = build_billing_update(&form).unwrap().billing.unwrap();
+        assert_eq!(
+            billing.country_currencies,
+            Some(Some(BTreeMap::from([("SE".to_owned(), "SEK".to_owned())])))
+        );
+    }
+
+    #[test]
+    fn validation_errors_surface_the_first_api_message() {
+        let error = ApiError::Http {
+            status: 400,
+            message: json!({
+                "code": "VALIDATION_ERROR",
+                "message": "Validation failed",
+                "errors": [{"path": "billing.enabled", "code": "X", "message": "Switch the premium model to mirror first"}]
+            })
+            .to_string(),
+        };
+        assert_eq!(
+            validation_message(&error).as_deref(),
+            Some("billing.enabled: Switch the premium model to mirror first")
+        );
+        let server_error = ApiError::Http {
+            status: 500,
+            message: "{}".to_owned(),
+        };
+        assert_eq!(validation_message(&server_error), None);
+    }
+}
@@ -1,19 +1,22 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

 use crate::{
-    api::client::AdminApiClient,
+    api::{client::AdminApiClient, generated::types::GiftCodeDurationTypeSchema},
    middleware::{
        auth::AuthContext,
        csrf::CsrfToken,
        flash::{self, FlashData},
    },
    state::AppState,
-    templates,
+    templates::{
+        self,
+        pages::gift_codes::{GiftCodesPremium, MAX_GIFT_CODES},
+    },
 };
 use axum::{
    Form, Router,
    extract::{FromRequest, Query, Request, State},
-    response::{Html, IntoResponse, Redirect, Response},
+    response::{Html, IntoResponse, Response},
    routing::get,
 };
 use serde::Deserialize;
@@ -28,11 +31,11 @@ struct GiftCodesForm {
    #[serde(default)]
    _csrf: Option<String>,
    #[serde(default)]
-    count: Option<String>,
+    count: Option<u32>,
    #[serde(default)]
-    duration_type: Option<String>,
+    duration_type: Option<GiftCodeDurationTypeSchema>,
    #[serde(default)]
-    duration_quantity: Option<String>,
+    duration_quantity: Option<u32>,
 }

 pub fn router() -> Router<AppState> {
@@ -46,10 +49,11 @@ async fn gift_codes_page(
    Query(query): Query<GiftCodesQuery>,
 ) -> Response {
    let config = state.config();
-
-    if config.self_hosted {
-        return Redirect::to(&format!("{}/dashboard", config.base_path)).into_response();
-    }
+    let client = AdminApiClient::new(state.http_client(), config, &auth.0.session);
+    let premium = GiftCodesPremium::from_branding(
+        config.self_hosted,
+        state.premium_branding(&client).await.as_ref(),
+    );

    let generated_codes: Option<Vec<String>> = query
        .codes
@@ -60,6 +64,7 @@ async fn gift_codes_page(
        config,
        &auth.0,
        &csrf.0.0,
+        &premium,
        generated_codes.as_deref(),
    );
    Html(markup.into_string()).into_response()
@@ -72,9 +77,6 @@ async fn gift_codes_post(
 ) -> Response {
    let config = state.config();
    let base = &config.base_path;
-    if config.self_hosted {
-        return Redirect::to(&format!("{base}/dashboard")).into_response();
-    }
    let form: GiftCodesForm = match Form::from_request(request, &state).await {
        Ok(Form(f)) => f,
        Err(error) => {
@@ -86,21 +88,17 @@ async fn gift_codes_post(
            );
        }
    };
-    let count = form
-        .count
-        .as_deref()
-        .and_then(|s| s.parse::<u32>().ok())
-        .unwrap_or(1)
-        .clamp(1, 100);
-    let dur_type = form.duration_type.as_deref().unwrap_or("month");
-    let dur_qty = form
-        .duration_quantity
-        .as_deref()
-        .and_then(|s| s.parse::<u32>().ok())
-        .unwrap_or(1);
+    let count = form.count.unwrap_or(1).clamp(1, MAX_GIFT_CODES);
+    let duration_type = form
+        .duration_type
+        .unwrap_or(GiftCodeDurationTypeSchema::Months);
+    let duration_quantity = form.duration_quantity.unwrap_or(1);
    let client = AdminApiClient::new(state.http_client(), config, &auth.0.session);
    let secure_cookies = config.secure_cookies();
-    match client.generate_gift_codes(count, dur_type, dur_qty).await {
+    match client
+        .generate_gift_codes(count, duration_type, duration_quantity)
+        .await
+    {
        Ok(result) => {
            let codes = result.codes.join(",");
            flash::redirect_with_flash(
@@ -43,7 +43,7 @@ pub async fn render(
            let page = query.members_page.unwrap_or(0);
            let limit: u32 = 50;
            let resp = client
-                .list_guild_members(guild_id, limit, page * limit)
+                .list_guild_members(guild_id, limit, u64::from(page) * u64::from(limit))
                .await
                .log_error("load guild members")?;
            Some(tabs::members::members_tab(
@@ -57,7 +57,7 @@ pub async fn render(
            let page = query.reports_page.unwrap_or(0);
            let limit: u32 = 25;
            let resp = client
-                .search_reports_by_guild(guild_id, limit, page * limit)
+                .search_reports_by_guild(guild_id, limit, u64::from(page) * u64::from(limit))
                .await
                .log_error("load guild reports")?;
            Some(tabs::reports::reports_tab(
@@ -121,6 +121,7 @@ pub async fn render(
                    admin_user_id: None,
                    target_id: Some(guild_id.to_owned()),
                    target_type: Some("guild".to_owned()),
+                    access: Some("write".to_owned()),
                    sort_by: Some("created_at".to_owned()),
                    sort_order: Some("desc".to_owned()),
                    limit: 50,
@@ -134,7 +135,7 @@ pub async fn render(
                    @if let Some(resp) = resp {
                        @if resp.logs.is_empty() {
                            p class="text-sm text-neutral-500" {
-                                "No admin audit log entries for this guild."
+                                "No admin write actions have been recorded for this guild."
                            }
                        } @else {
                            (table_container(table(maud::html! {
@@ -82,23 +82,19 @@ async fn guilds_list(
                }
            }
        }
-        Some((guilds, Some(params.requested_ids.len() as u64), false))
+        Some((guilds, params.requested_ids.len() as u64))
    } else if params.has_search() {
-        let offset = params.page.saturating_mul(params.limit);
+        let offset = u64::from(params.page) * u64::from(params.limit);
        client
            .search_guilds(params.search_query(), params.limit, offset)
            .await
            .log_error("search guilds")
-            .map(|response| {
-                let has_more = u64::from(offset) + (response.guilds.len() as u64) < response.total;
-                (response.guilds, Some(response.total), has_more)
-            })
+            .map(|response| (response.guilds, response.total))
    } else {
        None
    };
    let result_guilds = results.as_ref().map(|result| result.0.as_slice());
-    let total = results.as_ref().and_then(|result| result.1);
-    let has_more = results.as_ref().is_some_and(|result| result.2);
+    let total = results.as_ref().map(|result| result.1);

    let markup = templates::pages::guilds_list::guilds_list_page(
        config,
@@ -106,7 +102,6 @@ async fn guilds_list(
        &params,
        result_guilds,
        total,
-        has_more,
        is_results_fragment,
    );
    Html(markup.into_string()).into_response()
@@ -324,8 +319,12 @@ async fn dispatch_guild_action(
                "default_message_notifications",
                "disabled_operations",
            ] {
-                if let Some(v) = form.parse_i64(key) {
-                    settings.insert(key.to_string(), serde_json::json!(v));
+                let value = match form.parse_value::<i64>(key) {
+                    Ok(value) => value,
+                    Err(_) => return FlashData::error(format!("Invalid {key} value")),
+                };
+                if let Some(value) = value {
+                    settings.insert(key.to_string(), serde_json::json!(value));
                }
            }
            if form.contains_key("nsfw_submitted") {
@@ -356,11 +355,12 @@ async fn dispatch_guild_action(
            )
        }
        "update_disabled_operations" => {
-            let disabled_operations = form
-                .list_values_any(&["disabled_operations[]", "disabled_operations"])
-                .iter()
-                .filter_map(|value| value.parse::<i64>().ok())
-                .fold(0_i64, |acc, value| acc | value);
+            let Ok(operations) =
+                form.parse_list_values::<i64>(&["disabled_operations[]", "disabled_operations"])
+            else {
+                return FlashData::error("Invalid disabled operation value");
+            };
+            let disabled_operations = operations.into_iter().fold(0_i64, |acc, value| acc | value);
            let settings = serde_json::json!({
                "disabled_operations": disabled_operations,
            });
@@ -21,7 +21,6 @@ use axum::{
 use serde::Deserialize;

 #[derive(Deserialize)]
-#[allow(dead_code)]
 struct JobsQuery {
    status: Option<String>,
    task_type: Option<String>,
@@ -219,49 +218,36 @@ async fn job_detail_post(
 }

 fn jobs_url(config: &crate::config::AdminConfig, query: &JobsQuery) -> String {
-    let mut params = Vec::new();
-    push_query(&mut params, "status", query.status.as_deref());
-    push_query(&mut params, "task_type", query.task_type.as_deref());
-    push_query(
-        &mut params,
-        "requested_by_user_id",
-        query.requested_by_user_id.as_deref(),
-    );
-    push_query(
-        &mut params,
-        "max_lookback_days",
-        query.max_lookback_days.as_deref(),
-    );
-    push_query(
-        &mut params,
-        "cursor_bucket_day",
-        query.cursor_bucket_day.as_deref(),
-    );
-    push_query(
-        &mut params,
-        "cursor_created_at",
-        query.cursor_created_at.as_deref(),
-    );
-    push_query(&mut params, "cursor_job_id", query.cursor_job_id.as_deref());
-    if params.is_empty() {
-        return format!("{}/jobs", config.base_path);
-    }
-    let query = params
-        .iter()
-        .map(|(key, value)| {
-            format!(
-                "{}={}",
-                urlencoding::encode(key),
-                urlencoding::encode(value)
-            )
-        })
-        .collect::<Vec<_>>()
-        .join("&");
-    format!("{}/jobs?{query}", config.base_path)
-}
-
-fn push_query(params: &mut Vec<(String, String)>, key: &str, value: Option<&str>) {
-    if let Some(value) = value.filter(|value| !value.is_empty()) {
-        params.push((key.to_owned(), value.to_owned()));
+    let query = [
+        ("status", query.status.as_deref()),
+        ("task_type", query.task_type.as_deref()),
+        (
+            "requested_by_user_id",
+            query.requested_by_user_id.as_deref(),
+        ),
+        ("max_lookback_days", query.max_lookback_days.as_deref()),
+        ("cursor_bucket_day", query.cursor_bucket_day.as_deref()),
+        ("cursor_created_at", query.cursor_created_at.as_deref()),
+        ("cursor_job_id", query.cursor_job_id.as_deref()),
+    ]
+    .into_iter()
+    .filter_map(|(key, value)| {
+        value
+            .filter(|value| !value.is_empty())
+            .map(|value| (key, value))
+    })
+    .map(|(key, value)| {
+        format!(
+            "{}={}",
+            urlencoding::encode(key),
+            urlencoding::encode(value)
+        )
+    })
+    .collect::<Vec<_>>()
+    .join("&");
+    if query.is_empty() {
+        format!("{}/jobs", config.base_path)
+    } else {
+        format!("{}/jobs?{query}", config.base_path)
    }
 }
@@ -59,53 +59,51 @@ pub(crate) async fn messages_post(
    match action {
        "lookup" => {
            let context_limit = parse_context_limit(form.first("context_limit"));
-            return Redirect::to(&format!(
+            Redirect::to(&format!(
                "{base}/messages?channel_id={}&message_id={}&context_limit={context_limit}",
                encode_opt(&channel_id),
                encode_opt(&message_id)
            ))
-            .into_response();
+            .into_response()
        }
        "lookup-by-attachment" => {
            let attachment_id = form.clean("attachment_id");
            let filename = form.clean("filename");
            let context_limit = parse_context_limit(form.first("context_limit"));
-            return Redirect::to(&format!(
+            Redirect::to(&format!(
                "{base}/messages?channel_id={}&attachment_id={}&filename={}&context_limit={context_limit}",
                encode_opt(&channel_id),
                encode_opt(&attachment_id),
                encode_opt(&filename)
            ))
-            .into_response();
-        }
-        "browse" => {
-            return Redirect::to(&format!(
-                "{base}/messages?channel_id={}",
-                encode_opt(&channel_id)
-            ))
-            .into_response();
+            .into_response()
        }
+        "browse" => Redirect::to(&format!(
+            "{base}/messages?channel_id={}",
+            encode_opt(&channel_id)
+        ))
+        .into_response(),
        "search" => {
            let search = form.clean("search");
-            return Redirect::to(&format!(
+            Redirect::to(&format!(
                "{base}/messages?channel_id={}&search={}",
                encode_opt(&channel_id),
                encode_opt(&search)
            ))
-            .into_response();
+            .into_response()
        }
        "delete" => {
            let (Some(cid), Some(mid)) = (&channel_id, &message_id) else {
                return json_error(StatusCode::BAD_REQUEST, "Missing channel_id or message_id");
            };
            let audit_log_reason = form.clean("audit_log_reason");
-            return match client
+            match client
                .delete_message(cid, mid, audit_log_reason.as_deref())
                .await
            {
                Ok(()) => Json(serde_json::json!({"success": true})).into_response(),
                Err(e) => json_error(StatusCode::BAD_REQUEST, &format!("{e}")),
-            };
+            }
        }
        "report-to-ncmec" => {
            let attachment_id = form.clean("attachment_id");
@@ -131,7 +129,7 @@ pub(crate) async fn messages_post(
                    "Missing required NCMEC report fields",
                );
            }
-            return match client
+            match client
                .report_attachment_to_ncmec(
                    cid,
                    mid,
@@ -144,11 +142,10 @@ pub(crate) async fn messages_post(
            {
                Ok(resp) => Json(resp.data).into_response(),
                Err(e) => json_error(StatusCode::BAD_REQUEST, &format!("{e}")),
-            };
+            }
        }
-        _ => {}
+        _ => Redirect::to(&format!("{base}/messages")).into_response(),
    }
-    Redirect::to(&format!("{base}/messages")).into_response()
 }

 pub(crate) async fn system_dms_post(
@@ -174,7 +171,8 @@ pub(crate) async fn system_dms_post(
    let flash = if let Some(content) = content.as_deref()
        && !user_ids.is_empty()
    {
-        match client.send_system_dm(&user_ids, content).await {
+        let recipients = (user_ids != ["*"]).then_some(user_ids.as_slice());
+        match client.send_system_dm(recipients, content).await {
            Ok(_) => FlashData::success("System DM sent"),
            Err(error) => {
                tracing::warn!(%error, "admin API request failed: send system DM");
@@ -253,15 +251,25 @@ pub(crate) async fn bulk_actions_post(
        }
        "bulk-schedule-user-deletion" | "bulk_delete_users" => {
            let user_ids = form.list_values_any(&["user_ids[]", "user_ids"]);
-            let reason_code = form.parse_u32("reason_code").unwrap_or(2);
-            let days = form.parse_u32("days_until_deletion").unwrap_or(14);
+            let (Ok(reason_code), Ok(days)) = (
+                form.parse_value::<u32>("reason_code"),
+                form.parse_value::<u32>("days_until_deletion"),
+            ) else {
+                return flash::redirect_with_flash(
+                    &format!("{base}/bulk-actions"),
+                    FlashData::error("Invalid deletion reason code or delay"),
+                    config.secure_cookies(),
+                );
+            };
            let public_reason = form.clean("public_reason");
+            let notify_user = form.opt_out_value("notify_user");
            client
                .bulk_schedule_user_deletion(
                    &user_ids,
-                    reason_code,
-                    days,
+                    reason_code.unwrap_or(2),
+                    days.unwrap_or(14),
                    public_reason.as_deref(),
+                    notify_user,
                    audit_log_reason.as_deref(),
                )
                .await
@@ -357,7 +365,7 @@ pub(crate) async fn messages_browse_fragment(
    }
 }

-fn parse_context_limit(value: Option<&str>) -> u32 {
+pub(super) fn parse_context_limit(value: Option<&str>) -> u32 {
    value
        .and_then(|s| s.parse::<u32>().ok())
        .filter(|n| *n > 0)
@@ -16,7 +16,6 @@ use axum::{
 use serde::Deserialize;

 #[derive(Deserialize)]
-#[allow(dead_code)]
 struct MessagesQuery {
    channel_id: Option<String>,
    message_id: Option<String>,
@@ -82,13 +81,7 @@ async fn messages_page(
    let before = query.before.as_deref().filter(|s| !s.is_empty());
    let after = query.after.as_deref().filter(|s| !s.is_empty());
    let search = query.search.as_deref().filter(|s| !s.is_empty());
-    let context_limit = query
-        .context_limit
-        .as_deref()
-        .and_then(|s| s.parse::<u32>().ok())
-        .filter(|n| *n > 0)
-        .unwrap_or(50)
-        .min(100);
+    let context_limit = super::message_actions::parse_context_limit(query.context_limit.as_deref());
    let mut lookup_result = None;
    let mut browse_result = None;
    let mut search_result = None;
@@ -5,6 +5,7 @@ pub mod applications;
 pub mod auth;
 pub mod bans;
 mod bans_actions;
+mod billing_actions;
 pub mod codes;
 pub mod discovery;
 mod guild_tabs;
@@ -1,7 +1,10 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

 use crate::{
-    api::client::{AdminApiClient, ApiResultExt},
+    api::{
+        client::{AdminApiClient, ApiResultExt},
+        reports::SearchReportsParams,
+    },
    config::AdminConfig,
    middleware::{
        auth::AuthContext,
@@ -23,7 +26,7 @@ use axum::{
 };
 use serde::Deserialize;

-const MAX_REPORT_OFFSET: u32 = 10_000;
+const MAX_REPORT_OFFSET: u64 = 10_000;

 #[derive(Deserialize)]
 struct ReportsQuery {
@@ -49,6 +52,10 @@ struct ResolveForm {
    _csrf: Option<String>,
    #[serde(default)]
    resolution: Option<String>,
+    #[serde(default)]
+    notify_reporter: Option<String>,
+    #[serde(default)]
+    notify_reporter_present: Option<String>,
 }

 pub fn router() -> Router<AppState> {
@@ -72,12 +79,12 @@ async fn reports_list(
    let config = state.config();
    let page = query.page.unwrap_or(0);
    let limit = query.limit.unwrap_or(25).clamp(1, 200);
-    let offset = page.saturating_mul(limit);
+    let offset = u64::from(page) * u64::from(limit);
    if offset > MAX_REPORT_OFFSET {
        return reports_error_page(
            config,
            &auth.0,
-            "That page is out of range. The reports search returns at most the first 10000 reports, so narrow the filters and start again.",
+            "That page is out of range. The reports search returns at most the first 10000 reports. Narrow the filters and start again.",
        );
    }
    let search_query = query.q.as_deref().and_then(clean_string);
@@ -89,22 +96,22 @@ async fn reports_list(
        .as_deref()
        .and_then(|s| s.parse::<i32>().ok());
    let reports = client
-        .search_reports(
-            search_query.as_deref(),
+        .search_reports(&SearchReportsParams {
+            query: search_query.as_deref(),
            status,
            report_type,
-            query.category.as_deref(),
-            query.reporter_id.as_deref(),
-            query.reported_user_id.as_deref(),
-            query.reported_guild_id.as_deref(),
-            query.reported_channel_id.as_deref(),
-            query.guild_context_id.as_deref(),
-            query.resolved_by_admin_id.as_deref(),
-            Some(sort_by),
-            Some(sort_order),
+            category: query.category.as_deref(),
+            reporter_id: query.reporter_id.as_deref(),
+            reported_user_id: query.reported_user_id.as_deref(),
+            reported_guild_id: query.reported_guild_id.as_deref(),
+            reported_channel_id: query.reported_channel_id.as_deref(),
+            guild_context_id: query.guild_context_id.as_deref(),
+            resolved_by_admin_id: query.resolved_by_admin_id.as_deref(),
+            sort_by: Some(sort_by),
+            sort_order: Some(sort_order),
            limit,
            offset,
-        )
+        })
        .await
        .log_error("search reports");

@@ -224,8 +231,10 @@ async fn report_resolve(
    };
    let client = AdminApiClient::new(state.http_client(), config, &auth.0.session);
    let public_comment = clean_string(form.resolution.as_deref().unwrap_or(""));
+    let notify_reporter =
+        form.notify_reporter_present.is_none() || form.notify_reporter.as_deref() == Some("true");
    let result = client
-        .resolve_report(&report_id, public_comment.as_deref(), None)
+        .resolve_report(&report_id, public_comment.as_deref(), notify_reporter, None)
        .await;
    match result {
        Ok(_) => {
@@ -17,19 +17,18 @@ use serde::Deserialize;
 use super::system_actions;

 #[derive(Deserialize)]
-#[allow(dead_code)]
 struct GatewayQuery {
    leaderboard_limit: Option<String>,
    node_stats: Option<String>,
 }

 #[derive(Deserialize)]
-#[allow(dead_code)]
 struct AuditLogsQuery {
    q: Option<String>,
    admin_user_id: Option<String>,
    target_id: Option<String>,
    target_type: Option<String>,
+    access: Option<String>,
    sort_by: Option<String>,
    sort_order: Option<String>,
    limit: Option<u32>,
@@ -121,6 +120,7 @@ async fn audit_logs_page(
        admin_user_id: query.admin_user_id.as_deref().unwrap_or(""),
        target_id: query.target_id.as_deref().unwrap_or(""),
        target_type: query.target_type.as_deref().unwrap_or(""),
+        access: query.access.as_deref().unwrap_or(""),
        sort_by: query.sort_by.as_deref().unwrap_or("createdAt"),
        sort_order: query.sort_order.as_deref().unwrap_or("desc"),
        limit,
@@ -133,10 +133,11 @@ async fn audit_logs_page(
        admin_user_id: nonempty(params.admin_user_id),
        target_id: nonempty(params.target_id),
        target_type: nonempty(params.target_type),
+        access: nonempty(params.access),
        sort_by: Some(params.sort_by.to_owned()),
        sort_order: Some(params.sort_order.to_owned()),
        limit,
-        offset: current_page * limit,
+        offset: u64::from(current_page) * u64::from(limit),
    };
    let result = client
        .search_audit_logs(&search_params)
@@ -220,6 +221,11 @@ async fn instance_config_page(
        .get_instance_config()
        .await
        .log_error("load instance config");
+    if let Some(instance_config) = &instance_config {
+        state.remember_premium_branding(crate::api::types::PremiumBranding::from_instance_config(
+            instance_config,
+        ));
+    }
    let limit_config = client
        .get_limit_config()
        .await
@@ -6,18 +6,20 @@ use crate::{
        types::{
            AppBrandingConfigUpdateRequest, AppLegalConfigUpdateRequest,
            AppPublicConfigUpdateRequest, AppRegistrationConfigUpdateRequest,
-            AppSetupConfigUpdateRequest, CreateRegistrationUrlRequest,
-            DeferredPhoneGateUpdateRequest, GatewayRolloutConfigUpdateRequest, GatewayRolloutMode,
-            InstanceAttachmentDecayUpdateRequest, InstanceBlueskyIntegrationUpdateRequest,
-            InstanceBlueskyKeyIntegrationUpdateRequest, InstanceCaptchaIntegrationUpdateRequest,
+            AppSetupConfigUpdateRequest, CAPTCHA_COST_RANGE, CAPTCHA_MAX_COUNTER_RANGE,
+            CaptchaConfigUpdateRequest, CreateRegistrationUrlRequest,
+            DomainMigrationConfigUpdateRequest, EXPERIMENT_MAX_TARGETED_USERS,
+            ExperimentDeliveryConfigUpdateRequest, GatewayRolloutConfigUpdateRequest,
+            GatewayRolloutMode, InstanceAttachmentDecayUpdateRequest,
+            InstanceBlueskyIntegrationUpdateRequest, InstanceBlueskyKeyIntegrationUpdateRequest,
            InstanceConfigUpdateRequest, InstanceEmailIntegrationUpdateRequest,
            InstanceEmailSmtpIntegrationUpdateRequest, InstanceEmailSmtpTestRequest,
            InstanceGifIntegrationUpdateRequest, InstanceIntegrationsUpdateRequest,
            InstanceMediaUpdateRequest, InstancePolicyUpdateRequest,
            InstanceRegistrationConfigUpdateRequest, InstanceServicesUpdateRequest,
            InstanceYoutubeIntegrationUpdateRequest, LimitConfigUpdateRequest, LimitRule,
-            LimitRuleFilters, PremiumMode, RegistrationMode, SsoConfigUpdateRequest,
-            VoiceE2eeScope,
+            LimitRuleFilters, PremiumMode, PushRelayConfigUpdateRequest, RegistrationMode,
+            SsoConfigUpdateRequest, VoiceE2eeScope,
        },
    },
    config::AdminConfig,
@@ -190,7 +192,9 @@ pub async fn instance_config_post(
        }
        "update_policy" => {
            let update = build_policy_update(&form);
-            instance_config_result(client.update_instance_config(&update).await)
+            let result = client.update_instance_config(&update).await;
+            remember_premium_branding(&state, &result);
+            instance_config_result(result)
        }
        "update_integrations" => {
            let update = build_integrations_update(&form);
@@ -200,6 +204,30 @@ pub async fn instance_config_post(
            let update = build_media_update(&form);
            instance_config_result(client.update_instance_config(&update).await)
        }
+        "update_billing" => match super::billing_actions::build_billing_update(&form) {
+            Ok(update) => {
+                let result = client.update_instance_config(&update).await;
+                remember_premium_branding(&state, &result);
+                super::billing_actions::billing_result(result)
+            }
+            Err(message) => FlashData::error(message),
+        },
+        "update_push_relay" => {
+            let update = build_push_relay_update(&form);
+            instance_config_result(client.update_instance_config(&update).await)
+        }
+        "update_domain_migration" => match build_domain_migration_update(&form) {
+            Ok(update) => instance_config_result(client.update_instance_config(&update).await),
+            Err(message) => FlashData::error(message),
+        },
+        "update_captcha" => match build_captcha_update(&form) {
+            Ok(update) => instance_config_result(client.update_instance_config(&update).await),
+            Err(message) => FlashData::error(message),
+        },
+        "update_experiment_delivery" => match build_experiment_delivery_update(&form) {
+            Ok(update) => instance_config_result(client.update_instance_config(&update).await),
+            Err(message) => FlashData::error(message),
+        },
        "test_smtp" => match build_smtp_test_request(&form) {
            Ok(request) => match client.test_instance_smtp_config(&request).await {
                Ok(response) if response.ok => FlashData::success("SMTP connection verified"),
@@ -323,6 +351,17 @@ pub async fn instance_config_post(
    redirect_back_with_flash(base, "/instance-config", flash, config.secure_cookies())
 }

+fn remember_premium_branding(
+    state: &AppState,
+    result: &Result<crate::api::types::InstanceConfigResponse, crate::api::client::ApiError>,
+) {
+    if let Ok(instance_config) = result {
+        state.remember_premium_branding(crate::api::types::PremiumBranding::from_instance_config(
+            instance_config,
+        ));
+    }
+}
+
 fn render_registration_url_list_response(
    config: &AdminConfig,
    csrf_token: &str,
@@ -401,12 +440,7 @@ fn build_sso_update(form: &MultiValueForm) -> InstanceConfigUpdateRequest {
            allowed_domains: Some(allowed),
            redirect_uri: None,
        }),
-        gateway_rollout: None,
-        registration: None,
-        app_public: None,
-        policy: None,
-        integrations: None,
-        media: None,
+        ..Default::default()
    }
 }

@@ -437,15 +471,191 @@ fn build_gateway_rollout_update(form: &MultiValueForm) -> InstanceConfigUpdateRe
                .parse_u64("gateway_rollout_max_concurrent_guild_starts"),
            voice_e2ee_scope,
        }),
-        sso: None,
-        registration: None,
-        app_public: None,
-        policy: None,
-        integrations: None,
-        media: None,
+        ..Default::default()
    }
 }

+const EXPERIMENT_ROLLOUT_BASIS_POINTS_MAX: u32 = 10_000;
+const EXPERIMENT_MAX_ROLLOUT_SALT_CHARS: usize = 64;
+const EXPERIMENT_MAX_SNOWFLAKE_LENGTH: usize = 20;
+const EXPERIMENT_MIN_POLL_INTERVAL_SECONDS: u64 = 60;
+const EXPERIMENT_MAX_POLL_INTERVAL_SECONDS: u64 = 86_400;
+const EXPERIMENT_MAX_POLL_JITTER_PERCENT: u32 = 50;
+
+fn parse_form_number<T>(
+    form: &MultiValueForm,
+    key: &str,
+    label: &str,
+    min: T,
+    max: T,
+) -> Result<Option<T>, String>
+where
+    T: std::str::FromStr + Ord + std::fmt::Display,
+{
+    let Some(raw) = form.first(key) else {
+        return Ok(None);
+    };
+    let invalid = || format!("{label} must be a whole number between {min} and {max}");
+    let value = raw.trim().parse::<T>().map_err(|_| invalid())?;
+    if value < min || value > max {
+        return Err(invalid());
+    }
+    Ok(Some(value))
+}
+
+fn parse_experiment_rollout_salt(
+    form: &MultiValueForm,
+    key: &str,
+) -> Result<Option<String>, String> {
+    let Some(raw) = form.first(key) else {
+        return Ok(None);
+    };
+    let salt = raw.trim();
+    if salt.is_empty() || salt.encode_utf16().count() > EXPERIMENT_MAX_ROLLOUT_SALT_CHARS {
+        return Err(format!(
+            "Rollout salt must be between 1 and {EXPERIMENT_MAX_ROLLOUT_SALT_CHARS} characters"
+        ));
+    }
+    if !salt
+        .bytes()
+        .all(|byte| byte.is_ascii_graphic() || byte == b' ')
+    {
+        return Err("Rollout salt must use printable ASCII".to_owned());
+    }
+    Ok(Some(salt.to_owned()))
+}
+
+fn is_experiment_snowflake(value: &str) -> bool {
+    !value.is_empty()
+        && value.len() <= EXPERIMENT_MAX_SNOWFLAKE_LENGTH
+        && value.bytes().all(|byte| byte.is_ascii_digit())
+}
+
+fn parse_experiment_user_ids(value: &str, label: &str) -> Result<Vec<String>, String> {
+    let mut ids: Vec<String> = Vec::new();
+    for (index, candidate) in value.split([',', '\n', '\r']).enumerate() {
+        let candidate = candidate.trim();
+        if candidate.is_empty() {
+            continue;
+        }
+        if !is_experiment_snowflake(candidate) {
+            return Err(format!(
+                "{label} entry {} must contain 1 to 20 decimal digits",
+                index + 1
+            ));
+        }
+        if ids.iter().any(|existing| existing == candidate) {
+            continue;
+        }
+        if ids.len() == EXPERIMENT_MAX_TARGETED_USERS {
+            return Err(format!(
+                "{label} must contain at most {EXPERIMENT_MAX_TARGETED_USERS} unique IDs"
+            ));
+        }
+        ids.push(candidate.to_owned());
+    }
+    Ok(ids)
+}
+
+fn build_push_relay_update(form: &MultiValueForm) -> InstanceConfigUpdateRequest {
+    InstanceConfigUpdateRequest {
+        push_relay: Some(PushRelayConfigUpdateRequest {
+            relay_consent_accepted: Some(form.bool_value("push_relay_consent_accepted")),
+        }),
+        ..Default::default()
+    }
+}
+
+fn build_domain_migration_update(
+    form: &MultiValueForm,
+) -> Result<InstanceConfigUpdateRequest, String> {
+    Ok(InstanceConfigUpdateRequest {
+        domain_migration: Some(DomainMigrationConfigUpdateRequest {
+            enabled: Some(form.bool_value("domain_migration_enabled")),
+            rollout_basis_points: parse_form_number(
+                form,
+                "domain_migration_rollout_basis_points",
+                "Rollout basis points",
+                0,
+                EXPERIMENT_ROLLOUT_BASIS_POINTS_MAX,
+            )?,
+            rollout_salt: parse_experiment_rollout_salt(form, "domain_migration_rollout_salt")?,
+            included_user_ids: Some(parse_experiment_user_ids(
+                form.first("domain_migration_included_user_ids")
+                    .unwrap_or_default(),
+                "Included user IDs",
+            )?),
+            included_guild_ids: Some(parse_experiment_user_ids(
+                form.first("domain_migration_included_guild_ids")
+                    .unwrap_or_default(),
+                "Included guild IDs",
+            )?),
+            include_premium_users: Some(form.bool_value("domain_migration_include_premium_users")),
+            excluded_user_ids: Some(parse_experiment_user_ids(
+                form.first("domain_migration_excluded_user_ids")
+                    .unwrap_or_default(),
+                "Excluded user IDs",
+            )?),
+            anonymous_rollout_basis_points: parse_form_number(
+                form,
+                "domain_migration_anonymous_rollout_basis_points",
+                "Anonymous rollout basis points",
+                0,
+                EXPERIMENT_ROLLOUT_BASIS_POINTS_MAX,
+            )?,
+            standalone_forwarding: Some(form.bool_value("domain_migration_standalone_forwarding")),
+        }),
+        ..Default::default()
+    })
+}
+
+fn build_captcha_update(form: &MultiValueForm) -> Result<InstanceConfigUpdateRequest, String> {
+    Ok(InstanceConfigUpdateRequest {
+        captcha: Some(CaptchaConfigUpdateRequest {
+            enabled: Some(form.bool_value("captcha_enabled")),
+            cost: parse_form_number(
+                form,
+                "captcha_cost",
+                "Cost",
+                *CAPTCHA_COST_RANGE.start(),
+                *CAPTCHA_COST_RANGE.end(),
+            )?,
+            max_counter: parse_form_number(
+                form,
+                "captcha_max_counter",
+                "Maximum counter",
+                *CAPTCHA_MAX_COUNTER_RANGE.start(),
+                *CAPTCHA_MAX_COUNTER_RANGE.end(),
+            )?,
+        }),
+        ..Default::default()
+    })
+}
+
+fn build_experiment_delivery_update(
+    form: &MultiValueForm,
+) -> Result<InstanceConfigUpdateRequest, String> {
+    Ok(InstanceConfigUpdateRequest {
+        experiment_delivery: Some(ExperimentDeliveryConfigUpdateRequest {
+            poll_interval_seconds: parse_form_number(
+                form,
+                "experiment_delivery_poll_interval_seconds",
+                "Poll interval",
+                EXPERIMENT_MIN_POLL_INTERVAL_SECONDS,
+                EXPERIMENT_MAX_POLL_INTERVAL_SECONDS,
+            )?,
+            poll_jitter_percent: parse_form_number(
+                form,
+                "experiment_delivery_poll_jitter_percent",
+                "Poll jitter",
+                0,
+                EXPERIMENT_MAX_POLL_JITTER_PERCENT,
+            )?,
+        }),
+        ..Default::default()
+    })
+}
+
 fn build_registration_update(form: &MultiValueForm) -> InstanceConfigUpdateRequest {
    let mode = match form.first("registration_mode") {
        Some("approval") => Some(RegistrationMode::Approval),
@@ -454,27 +664,19 @@ fn build_registration_update(form: &MultiValueForm) -> InstanceConfigUpdateReque
        _ => None,
    };
    InstanceConfigUpdateRequest {
-        gateway_rollout: None,
        registration: Some(InstanceRegistrationConfigUpdateRequest {
            mode,
            admin_registration_urls_enabled: Some(
                form.bool_value("admin_registration_urls_enabled"),
            ),
        }),
-        sso: None,
-        app_public: None,
-        policy: None,
-        integrations: None,
-        media: None,
+        ..Default::default()
    }
 }

 fn build_app_public_update(form: &MultiValueForm) -> InstanceConfigUpdateRequest {
    let optional = |key: &str| Some(form.clean(key));
    InstanceConfigUpdateRequest {
-        gateway_rollout: None,
-        registration: None,
-        sso: None,
        app_public: Some(AppPublicConfigUpdateRequest {
            branding: Some(AppBrandingConfigUpdateRequest {
                product_name: form.clean("app_product_name"),
@@ -484,6 +686,9 @@ fn build_app_public_update(form: &MultiValueForm) -> InstanceConfigUpdateRequest
                wordmark_url: optional("app_wordmark_url"),
                favicon_url: optional("app_favicon_url"),
                theme_color: optional("app_theme_color"),
+                status_page_url: optional("app_status_page_url"),
+                status_page_incident_history_url: optional("app_status_page_incident_history_url"),
+                ..Default::default()
            }),
            setup: Some(AppSetupConfigUpdateRequest {
                configured: Some(form.bool_value("app_setup_configured")),
@@ -491,18 +696,13 @@ fn build_app_public_update(form: &MultiValueForm) -> InstanceConfigUpdateRequest
            legal: None,
            registration: None,
        }),
-        policy: None,
-        integrations: None,
-        media: None,
+        ..Default::default()
    }
 }

 fn build_app_legal_update(form: &MultiValueForm) -> InstanceConfigUpdateRequest {
    let optional = |key: &str| Some(form.clean(key));
    InstanceConfigUpdateRequest {
-        gateway_rollout: None,
-        registration: None,
-        sso: None,
        app_public: Some(AppPublicConfigUpdateRequest {
            branding: None,
            setup: None,
@@ -512,17 +712,12 @@ fn build_app_legal_update(form: &MultiValueForm) -> InstanceConfigUpdateRequest
            }),
            registration: None,
        }),
-        policy: None,
-        integrations: None,
-        media: None,
+        ..Default::default()
    }
 }

 fn build_app_registration_update(form: &MultiValueForm) -> InstanceConfigUpdateRequest {
    InstanceConfigUpdateRequest {
-        gateway_rollout: None,
-        registration: None,
-        sso: None,
        app_public: Some(AppPublicConfigUpdateRequest {
            branding: None,
            setup: None,
@@ -531,9 +726,7 @@ fn build_app_registration_update(form: &MultiValueForm) -> InstanceConfigUpdateR
                collect_date_of_birth: Some(form.bool_value("app_collect_date_of_birth")),
            }),
        }),
-        policy: None,
-        integrations: None,
-        media: None,
+        ..Default::default()
    }
 }

@@ -541,55 +734,28 @@ fn build_policy_update(form: &MultiValueForm) -> InstanceConfigUpdateRequest {
    let direct_messages_disabled = form
        .first("policy_direct_messages_disabled")
        .map(|value| value == "true");
+    let guild_create_access = form
+        .first("policy_guild_create_access")
+        .map(|value| value == "true");
    let premium_mode = match form.first("policy_premium_mode") {
        Some("mirror") => Some(PremiumMode::Mirror),
        Some("everyone") => Some(PremiumMode::Everyone),
        _ => None,
    };
    let services = build_services_update(form);
-    let deferred_phone_gate = build_deferred_phone_gate_update(form);
    InstanceConfigUpdateRequest {
-        gateway_rollout: None,
-        registration: None,
-        sso: None,
-        app_public: None,
        policy: Some(InstancePolicyUpdateRequest {
            single_community_enabled: None,
            single_community_name: None,
            direct_messages_disabled,
+            guild_create_access,
            premium_mode,
            services,
-            deferred_phone_gate,
        }),
-        integrations: None,
-        media: None,
+        ..Default::default()
    }
 }

-fn build_deferred_phone_gate_update(
-    form: &MultiValueForm,
-) -> Option<DeferredPhoneGateUpdateRequest> {
-    let enabled = form
-        .first("policy_deferred_phone_gate_enabled")
-        .map(|value| value == "true");
-    let window_hours = form
-        .first("policy_deferred_phone_gate_window_hours")
-        .and_then(|value| value.parse::<f64>().ok())
-        .filter(|value| *value > 0.0);
-    let member_threshold = form
-        .first("policy_deferred_phone_gate_member_threshold")
-        .and_then(|value| value.parse::<i64>().ok())
-        .filter(|value| *value > 0);
-    if enabled.is_none() && window_hours.is_none() && member_threshold.is_none() {
-        return None;
-    }
-    Some(DeferredPhoneGateUpdateRequest {
-        enabled,
-        window_hours,
-        member_threshold,
-    })
-}
-
 fn build_services_update(form: &MultiValueForm) -> Option<InstanceServicesUpdateRequest> {
    let parse_tristate = |key: &str| match form.first(key) {
        Some("inherit") => Some(None),
@@ -626,11 +792,6 @@ fn build_integrations_update(form: &MultiValueForm) -> InstanceConfigUpdateReque
        _ => None,
    };
    InstanceConfigUpdateRequest {
-        gateway_rollout: None,
-        registration: None,
-        sso: None,
-        app_public: None,
-        policy: None,
        integrations: Some(InstanceIntegrationsUpdateRequest {
            gif: Some(InstanceGifIntegrationUpdateRequest {
                klipy_api_key: clean("integration_klipy_api_key"),
@@ -638,13 +799,6 @@ fn build_integrations_update(form: &MultiValueForm) -> InstanceConfigUpdateReque
            youtube: Some(InstanceYoutubeIntegrationUpdateRequest {
                api_key: clean("integration_youtube_api_key"),
            }),
-            captcha: Some(InstanceCaptchaIntegrationUpdateRequest {
-                provider: clean("integration_captcha_provider"),
-                hcaptcha_site_key: clean("integration_hcaptcha_site_key"),
-                hcaptcha_secret_key: clean("integration_hcaptcha_secret_key"),
-                turnstile_site_key: clean("integration_turnstile_site_key"),
-                turnstile_secret_key: clean("integration_turnstile_secret_key"),
-            }),
            email: Some(InstanceEmailIntegrationUpdateRequest {
                enabled: Some(form.bool_value("integration_email_enabled")),
                provider: Some("smtp".to_owned()),
@@ -671,7 +825,7 @@ fn build_integrations_update(form: &MultiValueForm) -> InstanceConfigUpdateReque
                keys: bluesky_keys,
            }),
        }),
-        media: None,
+        ..Default::default()
    }
 }

@@ -681,12 +835,6 @@ fn build_media_update(form: &MultiValueForm) -> InstanceConfigUpdateRequest {
            .and_then(|value| value.trim().parse::<f64>().ok())
    };
    InstanceConfigUpdateRequest {
-        gateway_rollout: None,
-        registration: None,
-        sso: None,
-        app_public: None,
-        policy: None,
-        integrations: None,
        media: Some(InstanceMediaUpdateRequest {
            attachment_decay: Some(InstanceAttachmentDecayUpdateRequest {
                enabled: Some(form.bool_value("media_attachment_decay_enabled")),
@@ -700,6 +848,7 @@ fn build_media_update(form: &MultiValueForm) -> InstanceConfigUpdateRequest {
                renew_window_days: form.parse_u32("media_attachment_decay_renew_window_days"),
            }),
        }),
+        ..Default::default()
    }
 }

@@ -728,20 +877,11 @@ fn build_smtp_test_request(form: &MultiValueForm) -> Result<InstanceEmailSmtpTes

 fn build_single_community_update(enabled: bool) -> InstanceConfigUpdateRequest {
    InstanceConfigUpdateRequest {
-        gateway_rollout: None,
-        registration: None,
-        sso: None,
-        app_public: None,
        policy: Some(InstancePolicyUpdateRequest {
            single_community_enabled: Some(enabled),
-            single_community_name: None,
-            direct_messages_disabled: None,
-            premium_mode: None,
-            services: None,
-            deferred_phone_gate: None,
+            ..Default::default()
        }),
-        integrations: None,
-        media: None,
+        ..Default::default()
    }
 }

@@ -1066,6 +1206,315 @@ mod tests {
        );
    }

+    #[test]
+    fn parse_experiment_user_ids_splits_newlines_and_commas() {
+        assert_eq!(
+            parse_experiment_user_ids("  1 ,2\n3\r\n 4 ,, 5 ", "Included user IDs")
+                .expect("valid IDs"),
+            vec![
+                "1".to_owned(),
+                "2".to_owned(),
+                "3".to_owned(),
+                "4".to_owned(),
+                "5".to_owned()
+            ]
+        );
+    }
+
+    #[test]
+    fn parse_experiment_user_ids_dedupes_preserving_order() {
+        assert_eq!(
+            parse_experiment_user_ids("20,10,20,10,30", "Included user IDs").expect("valid IDs"),
+            vec!["20".to_owned(), "10".to_owned(), "30".to_owned()]
+        );
+    }
+
+    #[test]
+    fn parse_experiment_user_ids_rejects_non_digit_and_overlong_values() {
+        for value in [
+            "abc",
+            "12a",
+            "-1",
+            "1.0",
+            "999999999999999999999",
+            "<script>",
+        ] {
+            assert_eq!(
+                parse_experiment_user_ids(&format!("123,{value}"), "Included user IDs")
+                    .expect_err("invalid ID"),
+                "Included user IDs entry 2 must contain 1 to 20 decimal digits",
+                "{value}"
+            );
+        }
+    }
+
+    #[test]
+    fn parse_experiment_user_ids_rejects_exceeding_the_cap() {
+        let value = (0..EXPERIMENT_MAX_TARGETED_USERS)
+            .map(|index| index.to_string())
+            .collect::<Vec<_>>()
+            .join("\n");
+        let ids = parse_experiment_user_ids(&format!("{value}\n999"), "Included user IDs")
+            .expect("valid IDs at cap");
+        assert_eq!(ids.len(), EXPERIMENT_MAX_TARGETED_USERS);
+        assert_eq!(ids.last(), Some(&"999".to_owned()));
+        assert_eq!(
+            parse_experiment_user_ids(&format!("{value}\n1000"), "Included user IDs")
+                .expect_err("too many IDs"),
+            "Included user IDs must contain at most 1000 unique IDs"
+        );
+    }
+
+    #[test]
+    fn build_domain_migration_update_reads_the_rollout_fields() {
+        let form = MultiValueForm::parse(
+            b"domain_migration_enabled=true&domain_migration_rollout_basis_points=%20250%20&domain_migration_rollout_salt=%20domain-migration-v2%20&domain_migration_included_user_ids=1500000000000000001%0A1500000000000000002&domain_migration_excluded_user_ids=1500000000000000003%2C%201500000000000000004&domain_migration_anonymous_rollout_basis_points=%20100%20&domain_migration_standalone_forwarding=true&domain_migration_included_guild_ids=1500000000000000005%0A1500000000000000006%2C1500000000000000005&domain_migration_include_premium_users=true",
+        );
+        let update = build_domain_migration_update(&form)
+            .expect("valid form")
+            .domain_migration
+            .expect("domain migration update");
+        assert_eq!(update.enabled, Some(true));
+        assert_eq!(update.rollout_basis_points, Some(250));
+        assert_eq!(update.rollout_salt, Some("domain-migration-v2".to_owned()));
+        assert_eq!(
+            update.included_user_ids,
+            Some(vec![
+                "1500000000000000001".to_owned(),
+                "1500000000000000002".to_owned()
+            ])
+        );
+        assert_eq!(
+            update.excluded_user_ids,
+            Some(vec![
+                "1500000000000000003".to_owned(),
+                "1500000000000000004".to_owned()
+            ])
+        );
+        assert_eq!(update.anonymous_rollout_basis_points, Some(100));
+        assert_eq!(update.standalone_forwarding, Some(true));
+        assert_eq!(update.include_premium_users, Some(true));
+        assert_eq!(
+            update.included_guild_ids,
+            Some(vec![
+                "1500000000000000005".to_owned(),
+                "1500000000000000006".to_owned()
+            ])
+        );
+    }
+
+    #[test]
+    fn build_domain_migration_update_leaves_the_feature_inert_when_nothing_is_submitted() {
+        let form = MultiValueForm::parse(b"_csrf=token");
+        let request = build_domain_migration_update(&form).expect("valid form");
+        assert_eq!(
+            serde_json::to_value(request).expect("serializable update"),
+            serde_json::json!({"domain_migration": {
+                "enabled": false,
+                "included_user_ids": [],
+                "included_guild_ids": [],
+                "include_premium_users": false,
+                "excluded_user_ids": [],
+                "standalone_forwarding": false,
+            }})
+        );
+    }
+
+    #[test]
+    fn build_domain_migration_update_rejects_invalid_rollout_fields() {
+        for (form, message) in [
+            (
+                "domain_migration_rollout_basis_points=10001",
+                "Rollout basis points must be a whole number between 0 and 10000",
+            ),
+            (
+                "domain_migration_anonymous_rollout_basis_points=10001",
+                "Anonymous rollout basis points must be a whole number between 0 and 10000",
+            ),
+            (
+                "domain_migration_anonymous_rollout_basis_points=abc",
+                "Anonymous rollout basis points must be a whole number between 0 and 10000",
+            ),
+            (
+                "domain_migration_rollout_salt=%20%20",
+                "Rollout salt must be between 1 and 64 characters",
+            ),
+            (
+                format!("domain_migration_rollout_salt={}", "x".repeat(65)).as_str(),
+                "Rollout salt must be between 1 and 64 characters",
+            ),
+            (
+                "domain_migration_rollout_salt=caf%C3%A9",
+                "Rollout salt must use printable ASCII",
+            ),
+            (
+                "domain_migration_included_user_ids=123%2Cinvalid",
+                "Included user IDs entry 2 must contain 1 to 20 decimal digits",
+            ),
+            (
+                "domain_migration_excluded_user_ids=123%2Cinvalid",
+                "Excluded user IDs entry 2 must contain 1 to 20 decimal digits",
+            ),
+        ] {
+            let form = MultiValueForm::parse(form.as_bytes());
+            assert_eq!(
+                build_domain_migration_update(&form).expect_err("invalid rollout field"),
+                message
+            );
+        }
+    }
+
+    #[test]
+    fn build_push_relay_update_reads_the_consent_checkbox() {
+        let unchecked = build_push_relay_update(&MultiValueForm::parse(b"_csrf=token"));
+        assert_eq!(
+            serde_json::to_value(&unchecked).expect("serialize update"),
+            serde_json::json!({"push_relay": {"relay_consent_accepted": false}})
+        );
+
+        let checked = build_push_relay_update(&MultiValueForm::parse(
+            b"_csrf=token&push_relay_consent_accepted=true",
+        ));
+        assert_eq!(
+            serde_json::to_value(&checked).expect("serialize update"),
+            serde_json::json!({"push_relay": {"relay_consent_accepted": true}})
+        );
+    }
+
+    #[test]
+    fn build_captcha_update_reads_the_switch_and_difficulty_fields() {
+        let form = MultiValueForm::parse(
+            b"captcha_enabled=true&captcha_cost=%202000%20&captcha_max_counter=400",
+        );
+        let update = build_captcha_update(&form)
+            .expect("valid form")
+            .captcha
+            .expect("captcha update");
+        assert_eq!(update.enabled, Some(true));
+        assert_eq!(update.cost, Some(2000));
+        assert_eq!(update.max_counter, Some(400));
+    }
+
+    #[test]
+    fn build_captcha_update_turns_the_check_off_when_the_box_is_unchecked() {
+        let form = MultiValueForm::parse(b"_csrf=token");
+        let request = build_captcha_update(&form).expect("valid form");
+        assert_eq!(
+            serde_json::to_value(request).expect("serializable update"),
+            serde_json::json!({"captcha": {"enabled": false}})
+        );
+    }
+
+    #[test]
+    fn build_captcha_update_rejects_difficulty_outside_the_supported_range() {
+        for (form, message) in [
+            (
+                "captcha_cost=999",
+                "Cost must be a whole number between 1000 and 20000",
+            ),
+            (
+                "captcha_cost=20001",
+                "Cost must be a whole number between 1000 and 20000",
+            ),
+            (
+                "captcha_max_counter=99",
+                "Maximum counter must be a whole number between 100 and 20000",
+            ),
+            (
+                "captcha_max_counter=20001",
+                "Maximum counter must be a whole number between 100 and 20000",
+            ),
+        ] {
+            let form = MultiValueForm::parse(form.as_bytes());
+            assert_eq!(
+                build_captcha_update(&form).expect_err("invalid field"),
+                message
+            );
+        }
+    }
+
+    #[test]
+    fn domain_migration_update_rejects_an_invalid_included_guild_id() {
+        let form = MultiValueForm::parse(
+            b"domain_migration_included_guild_ids=1500000000000000005%0Anot-a-guild",
+        );
+        assert_eq!(
+            build_domain_migration_update(&form).expect_err("invalid guild id"),
+            "Included guild IDs entry 2 must contain 1 to 20 decimal digits"
+        );
+    }
+
+    #[test]
+    fn build_experiment_delivery_update_leaves_both_fields_unchanged_when_absent() {
+        let form = MultiValueForm::parse(b"_csrf=token");
+        let request = build_experiment_delivery_update(&form).expect("valid form");
+        assert_eq!(
+            serde_json::to_value(request).expect("serializable update"),
+            serde_json::json!({"experiment_delivery": {}})
+        );
+    }
+
+    #[test]
+    fn build_experiment_delivery_update_rejects_invalid_numbers() {
+        for (key, message, below_min, above_max) in [
+            (
+                "experiment_delivery_poll_interval_seconds",
+                "Poll interval must be a whole number between 60 and 86400",
+                "59",
+                "86401",
+            ),
+            (
+                "experiment_delivery_poll_jitter_percent",
+                "Poll jitter must be a whole number between 0 and 50",
+                "-1",
+                "51",
+            ),
+        ] {
+            for value in [
+                "",
+                "%20%20",
+                "abc",
+                "-1",
+                "1.5",
+                "9999999999999999999999999",
+                below_min,
+                above_max,
+            ] {
+                let form = MultiValueForm::parse(format!("{key}={value}").as_bytes());
+                assert_eq!(
+                    build_experiment_delivery_update(&form).expect_err("invalid number"),
+                    message,
+                    "{key}={value}"
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn build_experiment_delivery_update_accepts_inclusive_bounds() {
+        for (interval, jitter) in [(60, 0), (86_400, 50)] {
+            let form = MultiValueForm::parse(format!("experiment_delivery_poll_interval_seconds={interval}&experiment_delivery_poll_jitter_percent={jitter}").as_bytes());
+            let request = build_experiment_delivery_update(&form).expect("valid form");
+            assert_eq!(
+                serde_json::to_value(request).expect("serializable update"),
+                serde_json::json!({"experiment_delivery": {"poll_interval_seconds": interval, "poll_jitter_percent": jitter}})
+            );
+        }
+    }
+
+    #[test]
+    fn build_experiment_delivery_update_accepts_padded_numbers() {
+        let form = MultiValueForm::parse(
+            b"experiment_delivery_poll_interval_seconds=%20900%20&experiment_delivery_poll_jitter_percent=%2025%20",
+        );
+        let update = build_experiment_delivery_update(&form)
+            .expect("valid form")
+            .experiment_delivery
+            .expect("experiment delivery update");
+        assert_eq!(update.poll_interval_seconds, Some(900));
+        assert_eq!(update.poll_jitter_percent, Some(25));
+    }
+
    #[test]
    fn update_limit_rule_values_reads_checked_limit_keys() {
        let form = MultiValueForm::parse(b"message_send=1&traits%5B%5D=trial");
@@ -1,7 +1,9 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

 use crate::{
-    admin_flags, api::client::AdminApiClient, middleware::flash::FlashData,
+    admin_flags,
+    api::client::{AdminApiClient, ApiError},
+    middleware::flash::FlashData,
    utils::forms::MultiValueForm,
 };
 use std::collections::HashSet;
@@ -60,7 +62,9 @@ pub async fn dispatch(
                    "Failed to update user flags",
                );
            }
-            let submitted = parse_u64_list(form, &["flags[]", "flags"]);
+            let Ok(submitted) = form.parse_list_values::<u64>(&["flags[]", "flags"]) else {
+                return DispatchOutcome::error("Invalid user flag value");
+            };
            let selected = submitted.iter().copied().collect::<HashSet<_>>();
            let user = match client.get_user_by_id(user_id).await {
                Ok(user) => user,
@@ -89,15 +93,22 @@ pub async fn dispatch(
        }
        "update_premium_flags" => {
            if has_legacy_flag_delta_fields(form) {
-                let add = parse_i32_list(form, &["add_flags[]", "add_flags"]);
-                let remove = parse_i32_list(form, &["remove_flags[]", "remove_flags"]);
+                let Ok(add) = form.parse_list_values::<i32>(&["add_flags[]", "add_flags"]) else {
+                    return DispatchOutcome::error("Invalid premium flag value to add");
+                };
+                let Ok(remove) = form.parse_list_values::<i32>(&["remove_flags[]", "remove_flags"])
+                else {
+                    return DispatchOutcome::error("Invalid premium flag value to remove");
+                };
                return DispatchOutcome::from_result(
                    client.update_premium_flags(user_id, &add, &remove).await,
                    "Premium flags updated successfully",
                    "Failed to update premium flags",
                );
            }
-            let submitted = parse_i32_list(form, &["flags[]", "flags"]);
+            let Ok(submitted) = form.parse_list_values::<i32>(&["flags[]", "flags"]) else {
+                return DispatchOutcome::error("Invalid premium flag value");
+            };
            let selected = submitted.iter().copied().collect::<HashSet<_>>();
            let user = match client.get_user_by_id(user_id).await {
                Ok(user) => user,
@@ -124,9 +135,12 @@ pub async fn dispatch(
            )
        }
        "update_suspicious_flags" => {
-            let flags = parse_i32_list(form, &["suspicious_flags[]", "suspicious_flags"])
-                .into_iter()
-                .fold(0, |acc, flag| acc | flag);
+            let Ok(submitted) =
+                form.parse_list_values::<i32>(&["suspicious_flags[]", "suspicious_flags"])
+            else {
+                return DispatchOutcome::error("Invalid suspicious activity flag value");
+            };
+            let flags = submitted.into_iter().fold(0, |acc, flag| acc | flag);
            DispatchOutcome::from_result(
                client.update_suspicious_flags(user_id, flags).await,
                "Suspicious activity flags updated successfully",
@@ -225,31 +239,49 @@ pub async fn dispatch(
            )
        }
        "temp_ban" => {
-            let dur = form
-                .parse_u32("duration_hours")
-                .or_else(|| form.parse_u32("duration"))
-                .unwrap_or(24);
+            let Ok(duration) = form.parse_value_any::<u32>(&["duration_hours", "duration"]) else {
+                return DispatchOutcome::error("Invalid ban duration");
+            };
            let reason = get("reason");
            let private = get("private_reason");
+            let notify_user = form.opt_out_value("notify_user");
            DispatchOutcome::from_result(
                client
-                    .temp_ban_user(user_id, dur, reason.as_deref(), private.as_deref())
+                    .temp_ban_user(
+                        user_id,
+                        duration.unwrap_or(24),
+                        reason.as_deref(),
+                        notify_user,
+                        private.as_deref(),
+                    )
                    .await,
                "User temporarily banned successfully",
                "Failed to temporarily ban user",
            )
        }
-        "unban" => DispatchOutcome::from_result(
-            client.unban_user(user_id).await,
-            "User unbanned successfully",
-            "Failed to unban user",
-        ),
+        "unban" => {
+            let public_reason = get("public_reason");
+            let private_reason = get("private_reason");
+            let notify_user = form.opt_out_value("notify_user");
+            DispatchOutcome::from_result(
+                client
+                    .unban_user(
+                        user_id,
+                        public_reason.as_deref(),
+                        notify_user,
+                        private_reason.as_deref(),
+                    )
+                    .await,
+                "User unbanned successfully",
+                "Failed to unban user",
+            )
+        }
        "ban_ip" => {
            let Some(ip) = get("ip") else {
                return DispatchOutcome::error("IP address is required");
            };
            DispatchOutcome::from_result(
-                client.ban_ip(&ip).await,
+                client.ban_ip(&ip, None).await,
                "IP banned successfully",
                "Failed to ban IP",
            )
@@ -259,28 +291,83 @@ pub async fn dispatch(
                return DispatchOutcome::error("Avatar hash is required");
            };
            DispatchOutcome::from_result(
-                client.ban_avatar_hash(&hash).await,
+                client.ban_avatar_hash(&hash, None).await,
                "Avatar hash banned successfully",
                "Failed to ban avatar hash",
            )
        }
        "schedule_deletion" => {
-            let reason_code = form.parse_i32("reason_code").unwrap_or(0);
+            let Ok(reason_code) = form.parse_value::<i32>("reason_code") else {
+                return DispatchOutcome::error("Invalid deletion reason code");
+            };
            let public_reason = get("public_reason");
-            let days = form.parse_u32("days_until_deletion").unwrap_or(60);
+            let private_reason = get("private_reason");
+            let Ok(days) = form.parse_value_any::<u32>(&["days_until_deletion", "days"]) else {
+                return DispatchOutcome::error("Invalid deletion delay");
+            };
+            let notify_user = form.opt_out_value("notify_user");
            DispatchOutcome::from_result(
                client
-                    .schedule_deletion(user_id, reason_code, public_reason.as_deref(), days)
+                    .schedule_deletion(
+                        user_id,
+                        reason_code.unwrap_or(0),
+                        public_reason.as_deref(),
+                        days.unwrap_or(60),
+                        notify_user,
+                        private_reason.as_deref(),
+                    )
                    .await,
                "User deletion scheduled successfully",
                "Failed to schedule user deletion",
            )
        }
-        "cancel_deletion" => DispatchOutcome::from_result(
-            client.cancel_deletion(user_id).await,
-            "User deletion cancelled successfully",
-            "Failed to cancel user deletion",
-        ),
+        "cancel_deletion" => {
+            let Some(expected) = get("expected_pending_deletion_at") else {
+                return DispatchOutcome::error(
+                    "The pending deletion is missing from the form. Reload and review.",
+                );
+            };
+            if !form.bool_value("confirm") {
+                return DispatchOutcome::error(
+                    "Confirm whose deletion you are cancelling before submitting",
+                );
+            }
+            let Some(private_reason) = get("private_reason") else {
+                return DispatchOutcome::error("A private reason is required to cancel a deletion");
+            };
+            let notify_user = form.bool_value("notify_user");
+            match client
+                .cancel_deletion(user_id, &expected, notify_user, Some(&private_reason))
+                .await
+            {
+                Ok(_) => DispatchOutcome::success("User deletion cancelled successfully"),
+                Err(ApiError::Http { status: 409, .. }) => DispatchOutcome::error(
+                    "The pending deletion changed since this page loaded. Reload and review.",
+                ),
+                Err(error) => {
+                    tracing::warn!(%error, user_id, "admin API request failed: cancel user deletion");
+                    DispatchOutcome::error("Failed to cancel user deletion")
+                }
+            }
+        }
+        "annotate_ban" => {
+            let Some(ban_audit_log_id) = get("ban_audit_log_id") else {
+                return DispatchOutcome::error("The ban audit log entry is missing from the form");
+            };
+            let Some(note) = get("note") else {
+                return DispatchOutcome::error("Note is required");
+            };
+            match client.annotate_ban(user_id, &ban_audit_log_id, &note).await {
+                Ok(()) => DispatchOutcome::success("Note added to the ban"),
+                Err(ApiError::Http { status: 409, .. }) => DispatchOutcome::error(
+                    "The ban changed since this page loaded. Reload and review.",
+                ),
+                Err(error) => {
+                    tracing::warn!(%error, user_id, "admin API request failed: annotate ban");
+                    DispatchOutcome::error("Failed to add the note to the ban")
+                }
+            }
+        }
        "change_dob" => {
            let Some(dob) = get("date_of_birth") else {
                return DispatchOutcome::error("Date of birth is required");
@@ -441,20 +528,6 @@ fn is_relationship_category(category: &str) -> bool {
    )
 }

-fn parse_u64_list(form: &MultiValueForm, keys: &[&str]) -> Vec<u64> {
-    form.list_values_any(keys)
-        .iter()
-        .filter_map(|value| value.parse().ok())
-        .collect()
-}
-
-fn parse_i32_list(form: &MultiValueForm, keys: &[&str]) -> Vec<i32> {
-    form.list_values_any(keys)
-        .iter()
-        .filter_map(|value| value.parse().ok())
-        .collect()
-}
-
 fn parse_dry_run(value: Option<&str>) -> bool {
    !matches!(value.map(|value| value.trim().to_ascii_lowercase()), Some(value) if value == "false" || value == "0")
 }
@@ -73,15 +73,11 @@ pub async fn render(
                .map(|r| r.sessions)
                .map_err(|error| tracing::warn!(%error, user_id, "admin API request failed: list user sessions"))
                .unwrap_or_default();
-            let webauthn_credentials = if u.authenticator_types.contains(&2) {
-                client
-                    .list_webauthn_credentials(user_id)
-                    .await
-                    .map_err(|error| tracing::warn!(%error, user_id, "admin API request failed: list webauthn credentials"))
-                    .unwrap_or_default()
-            } else {
-                Vec::new()
-            };
+            let webauthn_credentials = client
+                .list_webauthn_credentials(user_id)
+                .await
+                .map_err(|error| tracing::warn!(%error, user_id, "admin API request failed: list webauthn credentials"))
+                .unwrap_or_default();
            Some(tabs::account::account_tab(
                config,
                &u,
@@ -115,11 +111,47 @@ pub async fn render(
                query.delete_all_messages_channel_count.unwrap_or(0),
                query.delete_all_messages_message_count.unwrap_or(0),
            ));
+            let deletion_scheduler = match u.deletion_scheduled_by.as_deref() {
+                Some(scheduler_id) if u.pending_deletion_at.is_some() && scheduler_id != u.id => {
+                    client
+                        .get_user_by_id(scheduler_id)
+                        .await
+                        .log_error("load deletion scheduler")
+                }
+                _ => None,
+            };
+            let ban_logs = if u.temp_banned_until.is_some()
+                && acl::has_permission(admin_acls, acl::AUDIT_LOG_VIEW)
+            {
+                client
+                    .search_audit_logs(&SearchAuditLogsParams {
+                        query: None,
+                        admin_user_id: None,
+                        target_id: Some(user_id.to_owned()),
+                        target_type: Some("user".to_owned()),
+                        access: Some("write".to_owned()),
+                        sort_by: Some("created_at".to_owned()),
+                        sort_order: Some("desc".to_owned()),
+                        limit: 100,
+                        offset: 0,
+                    })
+                    .await
+                    .log_error("load ban audit logs")
+                    .map(|response| response.logs)
+                    .unwrap_or_default()
+            } else {
+                Vec::new()
+            };
+            let context = tabs::moderation::ModerationContext {
+                deletion_scheduler: deletion_scheduler.as_ref(),
+                current_ban: tabs::moderation::find_current_ban(&u, &ban_logs),
+            };
            Some(tabs::moderation::moderation_tab(
                config,
                &u,
                csrf_token,
                admin_acls,
+                &context,
                query.message_shred_job_id.as_deref(),
                message_shred_status.as_ref(),
                delete_all_messages_dry_run,
@@ -164,25 +196,29 @@ pub async fn render(
            Some(tabs::guilds::guilds_tab(config, user_id, &g))
        }
        "reports" => {
-            let lim = query.reports_limit.unwrap_or(25);
-            let sp = query.reports_sent_page.unwrap_or(0);
-            let rp = query.reports_received_page.unwrap_or(0);
+            let limit = query.reports_limit.unwrap_or(25);
+            let sent_page = query.reports_sent_page.unwrap_or(0);
+            let received_page = query.reports_received_page.unwrap_or(0);
            let sent = client
-                .search_reports_by_reporter(user_id, lim, sp * lim)
+                .search_reports_by_reporter(user_id, limit, u64::from(sent_page) * u64::from(limit))
                .await
                .log_error("load reports sent by user");
-            let recv = client
-                .search_reports_by_reported_user(user_id, lim, rp * lim)
+            let received = client
+                .search_reports_by_reported_user(
+                    user_id,
+                    limit,
+                    u64::from(received_page) * u64::from(limit),
+                )
                .await
                .log_error("load reports against user");
            Some(tabs::reports::reports_tab(
                config,
                user_id,
                sent.as_ref(),
-                recv.as_ref(),
-                sp,
-                rp,
-                lim,
+                received.as_ref(),
+                sent_page,
+                received_page,
+                limit,
            ))
        }
        "relationships" => {
@@ -240,11 +276,12 @@ pub async fn render(
                    query: None,
                    admin_user_id: None,
                    target_id: Some(user_id.to_owned()),
-                    target_type: Some("user".to_owned()),
+                    target_type: None,
+                    access: Some("write".to_owned()),
                    sort_by: Some("created_at".to_owned()),
                    sort_order: Some("desc".to_owned()),
                    limit,
-                    offset: page * limit,
+                    offset: u64::from(page) * u64::from(limit),
                })
                .await
                .log_error("load user admin audit logs")?;
@@ -4,7 +4,7 @@ use crate::{
    acl,
    api::{
        client::{AdminApiClient, ApiResult, ApiResultExt},
-        types::AdminUser,
+        types::{AdminUser, PremiumBranding},
    },
    middleware::{auth::AuthContext, csrf::CsrfToken, flash, htmx},
    routes::user_tabs,
@@ -22,6 +22,7 @@ use axum::{
 use serde::Deserialize;

 const USER_ID_LOOKUP_BATCH: usize = 100;
+const DEFAULT_PREMIUM_NAME: &str = "Premium";

 #[derive(Deserialize)]
 struct UserListQuery {
@@ -87,32 +88,47 @@ async fn users_list(
        .unwrap_or(&[]);
    let can_view_email = acl::has_permission(admin_acls, acl::USER_VIEW_EMAIL);
    let client = AdminApiClient::new(state.http_client(), config, &auth.0.session);
-    let results = if params.has_id_lookup() {
-        lookup_users_in_batches(&client, &params.requested_ids)
-            .await
-            .log_error("lookup users by ids")
-            .map(|users| (users, false))
-    } else if params.has_search() {
-        let offset = params.page.saturating_mul(params.limit);
-        client
-            .search_users(
-                params.search_query(),
-                params.email_query(),
-                params.ip_query(),
-                params.limit,
-                offset,
-            )
-            .await
-            .log_error("search users")
-            .map(|r| {
-                let has_more = u64::from(offset) + (r.users.len() as u64) < r.total;
-                (r.users, has_more)
-            })
-    } else {
-        None
+    let searching = params.has_id_lookup() || params.has_search();
+    let results = async {
+        if params.has_id_lookup() {
+            lookup_users_in_batches(&client, &params.requested_ids)
+                .await
+                .log_error("lookup users by ids")
+                .map(|users| (users, false))
+        } else if params.has_search() {
+            let offset = u64::from(params.page) * u64::from(params.limit);
+            client
+                .search_users(
+                    params.search_query(),
+                    params.email_query(),
+                    params.ip_query(),
+                    params.limit,
+                    offset,
+                )
+                .await
+                .log_error("search users")
+                .map(|r| {
+                    let has_more = (r.users.len() as u64) < r.total.saturating_sub(offset);
+                    (r.users, has_more)
+                })
+        } else {
+            None
+        }
    };
+    let badge = async {
+        if searching {
+            self_hosted_premium_badge_name(&state, &client).await
+        } else {
+            None
+        }
+    };
+    let (results, badge_name) = tokio::join!(results, badge);
    let result_users = results.as_ref().map(|r| r.0.as_slice());
    let has_more = results.as_ref().is_some_and(|r| r.1);
+    let premium_badge_name = match result_users {
+        Some(users) if !users.is_empty() => badge_name,
+        _ => None,
+    };
    let markup = templates::pages::users_list::users_list_page(
        config,
        &auth.0,
@@ -120,11 +136,34 @@ async fn users_list(
        result_users,
        has_more,
        can_view_email,
+        premium_badge_name.as_deref(),
        is_results_fragment,
    );
    Html(markup.into_string()).into_response()
 }

+async fn self_hosted_premium_badge_name(
+    state: &AppState,
+    client: &AdminApiClient,
+) -> Option<String> {
+    if !state.config().self_hosted {
+        return None;
+    }
+    premium_badge_name(state.premium_branding(client).await.as_ref())
+}
+
+fn premium_badge_name(branding: Option<&PremiumBranding>) -> Option<String> {
+    match branding {
+        Some(branding) => branding.premium_enabled.then(|| {
+            branding
+                .name
+                .clone()
+                .unwrap_or_else(|| DEFAULT_PREMIUM_NAME.to_owned())
+        }),
+        None => Some(DEFAULT_PREMIUM_NAME.to_owned()),
+    }
+}
+
 async fn lookup_users_in_batches(
    client: &AdminApiClient,
    user_ids: &[String],
@@ -148,10 +187,15 @@ async fn user_detail(
    let is_detail_fragment = htmx::targets(&headers, "main-content");
    let active_tab = query.tab.as_deref().unwrap_or("overview");
    let client = AdminApiClient::new(state.http_client(), config, &auth.0.session);
-    let user = client
-        .get_user_by_id(&user_id)
-        .await
-        .log_error("load user detail");
+    let (user, badge_name) = tokio::join!(
+        async {
+            client
+                .get_user_by_id(&user_id)
+                .await
+                .log_error("load user detail")
+        },
+        self_hosted_premium_badge_name(&state, &client)
+    );
    let tq = to_tab_query(&query);
    let admin_acls = auth
        .0
@@ -167,6 +211,7 @@ async fn user_detail(
    } else {
        None
    };
+    let premium_badge_name = user.as_ref().and(badge_name);
    let markup = templates::pages::user_detail::user_detail_with_tab(
        config,
        &auth.0,
@@ -174,6 +219,7 @@ async fn user_detail(
        &user_id,
        active_tab,
        tab_body,
+        premium_badge_name.as_deref(),
        is_detail_fragment,
    );
    Html(markup.into_string()).into_response()
@@ -275,18 +321,29 @@ async fn user_peek(
 ) -> Response {
    let config = state.config();
    let client = AdminApiClient::new(state.http_client(), config, &auth.0.session);
-    let user = client
-        .get_user_by_id(&user_id)
-        .await
-        .log_error("load user peek");
+    let (user, badge_name) = tokio::join!(
+        async {
+            client
+                .get_user_by_id(&user_id)
+                .await
+                .log_error("load user peek")
+        },
+        self_hosted_premium_badge_name(&state, &client)
+    );
    let admin_acls = auth
        .0
        .admin_user
        .as_ref()
        .map(|user| user.acls.as_slice())
        .unwrap_or(&[]);
+    let premium_badge_name = user.as_ref().and(badge_name);
    let markup = match user {
-        Some(ref u) => templates::pages::user_peek::user_peek_fragment(config, u, admin_acls),
+        Some(ref u) => templates::pages::user_peek::user_peek_fragment(
+            config,
+            u,
+            admin_acls,
+            premium_badge_name.as_deref(),
+        ),
        None => maud::html! {
            div class="p-4 text-red-600 text-sm" { "User not found." }
        },
@@ -319,3 +376,31 @@ fn append_query_params(url: &mut String, params: &[(String, String)]) {
        url.push_str(&urlencoding::encode(value));
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn badge_name_follows_the_cached_branding_and_falls_back_to_the_default() {
+        let gold = PremiumBranding {
+            name: Some("Gold".to_owned()),
+            premium_enabled: true,
+        };
+        assert_eq!(premium_badge_name(Some(&gold)).as_deref(), Some("Gold"));
+        let unnamed = PremiumBranding {
+            name: None,
+            premium_enabled: true,
+        };
+        assert_eq!(
+            premium_badge_name(Some(&unnamed)).as_deref(),
+            Some("Premium")
+        );
+        let everyone = PremiumBranding {
+            name: Some("Gold".to_owned()),
+            premium_enabled: false,
+        };
+        assert_eq!(premium_badge_name(Some(&everyone)), None);
+        assert_eq!(premium_badge_name(None).as_deref(), Some("Premium"));
+    }
+}
@@ -49,19 +49,26 @@ pub(crate) fn build_region_body(form: &MultiValueForm) -> serde_json::Value {
    }
    body.insert("is_default".into(), form.bool_value("is_default").into());
    body.insert("vip_only".into(), form.bool_value("vip_only").into());
-    body.insert(
-        "required_guild_features".into(),
-        form.list_values_any(&["required_guild_features[]", "required_guild_features"])
-            .into(),
-    );
-    body.insert(
-        "allowed_guild_ids".into(),
-        form.list_values_any(&["allowed_guild_ids[]", "allowed_guild_ids"])
-            .into(),
-    );
+    insert_submitted_list(&mut body, form, "required_guild_features");
+    insert_submitted_list(&mut body, form, "allowed_guild_ids");
    serde_json::Value::Object(body)
 }

+fn insert_submitted_list(
+    body: &mut serde_json::Map<String, serde_json::Value>,
+    form: &MultiValueForm,
+    field: &str,
+) {
+    let repeated = format!("{field}[]");
+    if !form.contains_key(&repeated) && !form.contains_key(field) {
+        return;
+    }
+    body.insert(
+        field.to_owned(),
+        form.list_values_any(&[repeated.as_str(), field]).into(),
+    );
+}
+
 pub(crate) fn build_server_body(form: &MultiValueForm) -> serde_json::Value {
    let mut body = serde_json::Map::new();
    if let Some(v) = form.clean("region_id") {
@@ -103,16 +110,8 @@ pub(crate) fn build_server_body(form: &MultiValueForm) -> serde_json::Value {
        }
    }
    body.insert("vip_only".into(), form.bool_value("vip_only").into());
-    body.insert(
-        "required_guild_features".into(),
-        form.list_values_any(&["required_guild_features[]", "required_guild_features"])
-            .into(),
-    );
-    body.insert(
-        "allowed_guild_ids".into(),
-        form.list_values_any(&["allowed_guild_ids[]", "allowed_guild_ids"])
-            .into(),
-    );
+    insert_submitted_list(&mut body, form, "required_guild_features");
+    insert_submitted_list(&mut body, form, "allowed_guild_ids");
    serde_json::Value::Object(body)
 }

@@ -265,6 +264,45 @@ mod tests {
        assert_eq!(body["allowed_guild_ids"], serde_json::json!(["1", "2"]));
    }

+    #[test]
+    fn build_server_body_clears_restriction_lists_the_form_submitted_empty() {
+        let form = MultiValueForm::parse(
+            b"region_id=us-east&server_id=s1&required_guild_features=&allowed_guild_ids=",
+        );
+        let body = build_server_body(&form);
+        assert_eq!(body["required_guild_features"], serde_json::json!([]));
+        assert_eq!(body["allowed_guild_ids"], serde_json::json!([]));
+    }
+
+    #[test]
+    fn build_server_body_leaves_restriction_lists_alone_when_the_form_omits_them() {
+        let form = MultiValueForm::parse(
+            b"region_id=us-east&server_id=s1&endpoint=wss%3A%2F%2Fvoice.example&is_active=false&vip_only=true",
+        );
+        let body = build_server_body(&form);
+        let object = body.as_object().unwrap();
+        assert!(!object.contains_key("required_guild_features"));
+        assert!(!object.contains_key("allowed_guild_ids"));
+        assert_eq!(body["is_active"], serde_json::json!(false));
+    }
+
+    #[test]
+    fn build_region_body_clears_restriction_lists_the_form_submitted_empty() {
+        let form = MultiValueForm::parse(b"id=us-east&required_guild_features=&allowed_guild_ids=");
+        let body = build_region_body(&form);
+        assert_eq!(body["required_guild_features"], serde_json::json!([]));
+        assert_eq!(body["allowed_guild_ids"], serde_json::json!([]));
+    }
+
+    #[test]
+    fn build_region_body_leaves_restriction_lists_alone_when_the_form_omits_them() {
+        let form = MultiValueForm::parse(b"id=us-east&name=US%20East");
+        let body = build_region_body(&form);
+        let object = body.as_object().unwrap();
+        assert!(!object.contains_key("required_guild_features"));
+        assert!(!object.contains_key("allowed_guild_ids"));
+    }
+
    #[test]
    fn build_server_body_sets_soft_connection_limit_from_a_positive_value() {
        let form =
@@ -1,7 +1,18 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::config::AdminConfig;
-use std::sync::Arc;
+use crate::{
+    api::{
+        client::{AdminApiClient, ApiResultExt},
+        types::PremiumBranding,
+    },
+    config::AdminConfig,
+};
+use std::{
+    sync::{Arc, Mutex},
+    time::{Duration, Instant},
+};
+
+const PREMIUM_BRANDING_TTL: Duration = Duration::from_secs(60);

 #[derive(Clone)]
 pub struct AppState {
@@ -11,6 +22,7 @@ pub struct AppState {
 struct AppStateInner {
    pub config: AdminConfig,
    pub http_client: reqwest::Client,
+    premium_branding: Mutex<Option<(Instant, PremiumBranding)>>,
 }

 impl AppState {
@@ -23,6 +35,7 @@ impl AppState {
            inner: Arc::new(AppStateInner {
                config,
                http_client,
+                premium_branding: Mutex::new(None),
            }),
        }
    }
@@ -34,6 +47,40 @@ impl AppState {
    pub fn http_client(&self) -> &reqwest::Client {
        &self.inner.http_client
    }
+
+    pub fn cached_premium_branding(&self) -> Option<PremiumBranding> {
+        let cache = self
+            .inner
+            .premium_branding
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner());
+        cache
+            .as_ref()
+            .filter(|(fetched_at, _)| fetched_at.elapsed() < PREMIUM_BRANDING_TTL)
+            .map(|(_, branding)| branding.clone())
+    }
+
+    pub fn remember_premium_branding(&self, branding: PremiumBranding) {
+        *self
+            .inner
+            .premium_branding
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner()) = Some((Instant::now(), branding));
+    }
+
+    pub async fn premium_branding(&self, client: &AdminApiClient) -> Option<PremiumBranding> {
+        if let Some(branding) = self.cached_premium_branding() {
+            return Some(branding);
+        }
+        let branding = PremiumBranding::from_discovery(
+            &client
+                .get_instance_premium_discovery()
+                .await
+                .log_error("load premium branding")?,
+        );
+        self.remember_premium_branding(branding.clone());
+        Some(branding)
+    }
 }

 impl axum::extract::FromRef<AppState> for AdminConfig {
@@ -238,3 +238,28 @@ input:disabled + .checkbox-custom {
  border: 2px solid transparent;
  background-clip: content-box;
 }
+
+:target {
+  padding: 0.5rem;
+  border-radius: 0.25rem;
+  scroll-margin-top: 6rem;
+  animation: target-pulse 700ms ease-in-out 3;
+}
+
+@keyframes target-pulse {
+  0%,
+  100% {
+    background-color: transparent;
+  }
+
+  50% {
+    background-color: hsl(242 70% 55% / 0.18);
+  }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  :target {
+    background-color: hsl(242 70% 55% / 0.12);
+    animation: none;
+  }
+}
@@ -41,17 +41,14 @@ pub fn archives_tab(
    }
 }

-fn status_text(archive: &Archive) -> String {
+fn status_text(archive: &Archive) -> &str {
    if archive.failed_at.is_some() {
-        return "Failed".to_owned();
+        return "Failed";
    }
    if archive.completed_at.is_some() {
-        return "Completed".to_owned();
+        return "Completed";
    }
-    archive
-        .progress_step
-        .clone()
-        .unwrap_or_else(|| "In Progress".to_owned())
+    archive.progress_step.as_deref().unwrap_or("In Progress")
 }

 fn archives_table(base: &str, archives: &[Archive]) -> Markup {
@@ -66,9 +66,15 @@ pub fn audit_logs_for_target(
 ) -> Markup {
    let has_previous = current_page > 0;
    let offset = (current_page as u64) * (PAGE_SIZE as u64);
-    let has_next = offset + (entries.len() as u64) < total;
-    let total_pages = ((total as f64) / (PAGE_SIZE as f64)).ceil().max(1.0) as u64;
-    let all_logs_href = format!("{base_path}/audit-logs?target_id={target_id}");
+    let next_page = current_page
+        .checked_add(1)
+        .filter(|_| offset + (entries.len() as u64) < total);
+    let total_pages = total.div_ceil(u64::from(PAGE_SIZE)).max(1);
+    let page_number = u64::from(current_page) + 1;
+    let all_logs_href = format!(
+        "{base_path}/audit-logs?target_id={}&access=write",
+        urlencoding::encode(target_id)
+    );

    html! {
        div class="rounded-lg bg-white transition-all border border-neutral-200 p-6" {
@@ -88,7 +94,7 @@ pub fn audit_logs_for_target(
                    }
                }
                @if entries.is_empty() {
-                    (empty_state("No admin actions have been recorded against this entity."))
+                    (empty_state("No admin write actions have been recorded against this entity."))
                } @else {
                    (table_container(html! {
                        (table(html! {
@@ -108,7 +114,7 @@ pub fn audit_logs_for_target(
                        }))
                    }))
                }
-                @if has_previous || has_next {
+                @if has_previous || next_page.is_some() {
                    div class="flex items-center justify-center gap-2" {
                        @if has_previous {
                            a href={(tab_href_base) "&audit_logs_page=" (current_page - 1)}
@@ -119,10 +125,10 @@ pub fn audit_logs_for_target(
                            }
                        }
                        span class="text-sm text-neutral-500" {
-                            "Page " (current_page + 1) " of " (total_pages)
+                            "Page " (page_number) " of " (total_pages)
                        }
-                        @if has_next {
-                            a href={(tab_href_base) "&audit_logs_page=" (current_page + 1)}
+                        @if let Some(page) = next_page {
+                            a href={(tab_href_base) "&audit_logs_page=" (page)}
                                class="inline-flex items-center justify-center gap-2 font-medium \
                                       rounded-lg bg-neutral-50 text-neutral-700 border \
                                       border-neutral-300 px-3 py-1.5 text-sm" {
@@ -227,6 +227,13 @@ pub fn checkbox(name: &str, value: &str, label: &str, checked: bool, enabled: bo
    }
 }

+pub fn opt_out_checkbox(name: &str, label: &str) -> Markup {
+    html! {
+        input type="hidden" name={(name) "_present"} value="1";
+        (checkbox(name, "true", label, true, true))
+    }
+}
+
 pub fn secondary_button_link(label: &str, href: &str) -> Markup {
    html! {
        a href=(href) role="button"
@@ -81,20 +81,15 @@ pub fn guild_asset_url(
 }

 pub fn initials(name: &str) -> String {
-    let parts = name
-        .split_whitespace()
-        .filter(|part| !part.is_empty())
-        .collect::<Vec<_>>();
-    match parts.as_slice() {
-        [] => "?".to_owned(),
-        [part] => part.chars().next().unwrap_or('?').to_uppercase().collect(),
-        [first, .., last] => {
-            let mut value = String::new();
-            value.extend(first.chars().next().unwrap_or('?').to_uppercase());
-            value.extend(last.chars().next().unwrap_or('?').to_uppercase());
-            value
-        }
-    }
+    let mut parts = name.split_whitespace();
+    let Some(first) = parts.next() else {
+        return "?".to_owned();
+    };
+    std::iter::once(first)
+        .chain(parts.next_back())
+        .flat_map(|part| part.chars().take(1))
+        .flat_map(char::to_uppercase)
+        .collect()
 }

 fn media_asset_url(
@@ -0,0 +1,236 @@
+use std::cmp::Ordering;
+
+use serde_json::Value;
+
+#[derive(Debug, PartialEq)]
+pub struct Attachment {
+    pub id: String,
+    pub url: String,
+    pub filename: String,
+    pub nsfw: Option<bool>,
+    pub content_type: Option<String>,
+    pub width: Option<u32>,
+    pub height: Option<u32>,
+    pub size: Option<u64>,
+    pub ncmec_status: String,
+    pub ncmec_report_id: Option<String>,
+    pub ncmec_failure_reason: Option<String>,
+}
+
+#[derive(Debug, PartialEq)]
+pub struct Message {
+    pub id: String,
+    pub content: String,
+    pub timestamp: String,
+    pub author_id: String,
+    pub author_username: String,
+    pub author_global_name: Option<String>,
+    pub author_discriminator: String,
+    pub author_avatar: Option<String>,
+    pub channel_id: String,
+    pub channel_nsfw: Option<bool>,
+    pub channel_content_warning_level: Option<i32>,
+    pub channel_content_warning_text: Option<String>,
+    pub guild_nsfw: Option<bool>,
+    pub attachments: Vec<Attachment>,
+}
+
+pub fn ordered_messages(values: &[Value]) -> Vec<Message> {
+    let mut messages: Vec<Message> = values.iter().map(message_from_value).collect();
+    messages.sort_by(compare_message_ids);
+    messages
+}
+
+fn message_from_value(value: &Value) -> Message {
+    let attachments = value["attachments"]
+        .as_array()
+        .into_iter()
+        .flatten()
+        .map(attachment_from_value)
+        .collect();
+    Message {
+        id: value_id(&value["id"]).unwrap_or_default(),
+        content: value["content"].as_str().unwrap_or("").to_owned(),
+        timestamp: value["timestamp"].as_str().unwrap_or("").to_owned(),
+        author_id: value_id(&value["author_id"]).unwrap_or_default(),
+        author_username: value["author_username"]
+            .as_str()
+            .unwrap_or("Unknown")
+            .to_owned(),
+        author_global_name: value["author_global_name"].as_str().map(ToOwned::to_owned),
+        author_discriminator: value_id(&value["author_discriminator"])
+            .unwrap_or_else(|| "0000".to_owned()),
+        author_avatar: value["author_avatar"].as_str().map(ToOwned::to_owned),
+        channel_id: value_id(&value["channel_id"]).unwrap_or_default(),
+        channel_nsfw: value["channel_nsfw"].as_bool(),
+        channel_content_warning_level: value["channel_content_warning_level"]
+            .as_i64()
+            .map(|n| n as i32),
+        channel_content_warning_text: value["channel_content_warning_text"]
+            .as_str()
+            .map(ToOwned::to_owned),
+        guild_nsfw: value["guild_nsfw"].as_bool(),
+        attachments,
+    }
+}
+
+fn attachment_from_value(value: &Value) -> Attachment {
+    Attachment {
+        id: value_id(&value["id"]).unwrap_or_default(),
+        url: value["url"].as_str().unwrap_or("").to_owned(),
+        filename: value["filename"].as_str().unwrap_or("").to_owned(),
+        nsfw: value["nsfw"].as_bool(),
+        content_type: value["content_type"].as_str().map(ToOwned::to_owned),
+        width: value["width"].as_u64().map(|n| n as u32),
+        height: value["height"].as_u64().map(|n| n as u32),
+        size: value["size"].as_u64(),
+        ncmec_status: value["ncmec_status"]
+            .as_str()
+            .unwrap_or("not_submitted")
+            .to_owned(),
+        ncmec_report_id: value["ncmec_report_id"].as_str().map(ToOwned::to_owned),
+        ncmec_failure_reason: value["ncmec_failure_reason"]
+            .as_str()
+            .map(ToOwned::to_owned),
+    }
+}
+
+pub(crate) fn value_id(value: &Value) -> Option<String> {
+    match value {
+        Value::String(s) => Some(s.clone()),
+        Value::Number(n) => Some(n.to_string()),
+        _ => None,
+    }
+}
+
+fn compare_message_ids(left: &Message, right: &Message) -> Ordering {
+    match (left.id.parse::<u128>(), right.id.parse::<u128>()) {
+        (Ok(l), Ok(r)) => l.cmp(&r),
+        _ => left.id.cmp(&right.id),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn maps_message_and_attachment_fields() {
+        let value = json!({
+            "id": "9007199254740993",
+            "content": "Message content",
+            "timestamp": "2026-09-11T12:00:00Z",
+            "author_id": 42,
+            "author_username": "alice",
+            "author_global_name": "Alice",
+            "author_discriminator": 1234,
+            "author_avatar": "avatar-hash",
+            "channel_id": "100",
+            "channel_nsfw": false,
+            "channel_content_warning_level": 2,
+            "channel_content_warning_text": "Content warning",
+            "guild_nsfw": true,
+            "attachments": [{
+                "id": 9007199254740993_u64,
+                "url": "https://cdn.example.com/image.png",
+                "filename": "image.png",
+                "nsfw": true,
+                "content_type": "image/png",
+                "width": 640,
+                "height": 480,
+                "size": 4096,
+                "ncmec_status": "submitted",
+                "ncmec_report_id": "report-id",
+                "ncmec_failure_reason": "previous failure"
+            }]
+        });
+
+        assert_eq!(
+            message_from_value(&value),
+            Message {
+                id: "9007199254740993".into(),
+                content: "Message content".into(),
+                timestamp: "2026-09-11T12:00:00Z".into(),
+                author_id: "42".into(),
+                author_username: "alice".into(),
+                author_global_name: Some("Alice".into()),
+                author_discriminator: "1234".into(),
+                author_avatar: Some("avatar-hash".into()),
+                channel_id: "100".into(),
+                channel_nsfw: Some(false),
+                channel_content_warning_level: Some(2),
+                channel_content_warning_text: Some("Content warning".into()),
+                guild_nsfw: Some(true),
+                attachments: vec![Attachment {
+                    id: "9007199254740993".into(),
+                    url: "https://cdn.example.com/image.png".into(),
+                    filename: "image.png".into(),
+                    nsfw: Some(true),
+                    content_type: Some("image/png".into()),
+                    width: Some(640),
+                    height: Some(480),
+                    size: Some(4096),
+                    ncmec_status: "submitted".into(),
+                    ncmec_report_id: Some("report-id".into()),
+                    ncmec_failure_reason: Some("previous failure".into()),
+                }],
+            }
+        );
+    }
+
+    #[test]
+    fn retains_display_defaults_for_incomplete_snapshots() {
+        let message = message_from_value(&json!({"attachments": [{}]}));
+
+        assert_eq!(message.author_username, "Unknown");
+        assert_eq!(message.author_discriminator, "0000");
+        assert_eq!(message.content, "");
+        assert_eq!(message.author_global_name, None);
+        assert_eq!(message.channel_nsfw, None);
+        assert_eq!(
+            message.attachments,
+            vec![Attachment {
+                id: String::new(),
+                url: String::new(),
+                filename: String::new(),
+                nsfw: None,
+                content_type: None,
+                width: None,
+                height: None,
+                size: None,
+                ncmec_status: "not_submitted".into(),
+                ncmec_report_id: None,
+                ncmec_failure_reason: None,
+            }]
+        );
+    }
+
+    #[test]
+    fn orders_string_and_numeric_snowflakes_without_rounding() {
+        let values = vec![
+            json!({"id": "9007199254740993"}),
+            json!({"id": "10"}),
+            json!({"id": 2}),
+            json!({"id": 9007199254740992_u64}),
+        ];
+        let messages = ordered_messages(&values);
+        let ids: Vec<&str> = messages.iter().map(|message| message.id.as_str()).collect();
+
+        assert_eq!(ids, ["2", "10", "9007199254740992", "9007199254740993"]);
+        assert_eq!(values[0]["id"], "9007199254740993");
+        assert!(ordered_messages(&[]).is_empty());
+    }
+
+    #[test]
+    fn preserves_message_order_when_ids_are_equal() {
+        let values = [
+            json!({"id": "10", "content": "first"}),
+            json!({"id": 10, "content": "second"}),
+        ];
+        let messages = ordered_messages(&values);
+
+        assert_eq!(messages[0].content, "first");
+        assert_eq!(messages[1].content, "second");
+    }
+}
@@ -9,36 +9,7 @@ use super::user_display::format_user_display;
 use crate::config::AdminConfig;
 use crate::routes::auth::json_string;

-pub struct Attachment {
-    pub id: String,
-    pub url: String,
-    pub filename: String,
-    pub nsfw: Option<bool>,
-    pub content_type: Option<String>,
-    pub width: Option<u32>,
-    pub height: Option<u32>,
-    pub size: Option<u64>,
-    pub ncmec_status: String,
-    pub ncmec_report_id: Option<String>,
-    pub ncmec_failure_reason: Option<String>,
-}
-
-pub struct Message {
-    pub id: String,
-    pub content: String,
-    pub timestamp: String,
-    pub author_id: String,
-    pub author_username: String,
-    pub author_global_name: Option<String>,
-    pub author_discriminator: String,
-    pub author_avatar: Option<String>,
-    pub channel_id: String,
-    pub channel_nsfw: Option<bool>,
-    pub channel_content_warning_level: Option<i32>,
-    pub channel_content_warning_text: Option<String>,
-    pub guild_nsfw: Option<bool>,
-    pub attachments: Vec<Attachment>,
-}
+use super::message_data::{Attachment, Message};

 fn is_image(att: &Attachment) -> bool {
    att.content_type
@@ -74,8 +45,8 @@ fn ncmec_badge(att: &Attachment) -> Markup {
 }

 fn render_image_attachments(msg: &Message, include_delete: bool) -> Markup {
-    let images: Vec<&Attachment> = msg.attachments.iter().filter(|a| is_image(a)).collect();
-    if images.is_empty() {
+    let mut images = msg.attachments.iter().filter(|a| is_image(a)).peekable();
+    if images.peek().is_none() {
        return html! {};
    }
    let spacer = if !msg.content.is_empty() {
@@ -85,7 +56,7 @@ fn render_image_attachments(msg: &Message, include_delete: bool) -> Markup {
    };
    html! {
        div class=(spacer) {
-            @for att in &images {
+            @for att in images {
                div class="max-w-xl overflow-hidden rounded-xl border border-neutral-200 bg-neutral-50" {
                    a href=(att.url) target="_blank" rel="noopener noreferrer"
                      class="block overflow-hidden bg-neutral-100" {
@@ -145,8 +116,8 @@ fn render_image_attachments(msg: &Message, include_delete: bool) -> Markup {
 }

 fn render_other_attachments(msg: &Message, has_content_or_images: bool) -> Markup {
-    let others: Vec<&Attachment> = msg.attachments.iter().filter(|a| !is_image(a)).collect();
-    if others.is_empty() {
+    let mut others = msg.attachments.iter().filter(|a| !is_image(a)).peekable();
+    if others.peek().is_none() {
        return html! {};
    }
    let spacer = if has_content_or_images {
@@ -156,7 +127,7 @@ fn render_other_attachments(msg: &Message, has_content_or_images: bool) -> Marku
    };
    html! {
        div class=(spacer) {
-            @for att in &others {
+            @for att in others {
                div class="flex flex-wrap items-center gap-2 text-xs" {
                    (paperclip_icon("text-neutral-400"))
                    a href=(att.url) target="_blank" rel="noopener noreferrer"
@@ -13,14 +13,15 @@ pub mod error_display;
 pub mod form;
 pub mod icons;
 pub mod media;
+pub mod message_data;
 pub mod message_list;
 pub mod nsfw_indicators;
 pub mod page_container;
-pub mod pagination;
 pub mod resource_link;
 pub mod section_card;
 pub mod stack;
 pub mod table;
+pub mod tooltip;
 pub mod typography;
 pub mod user_display;
 pub mod user_profile_badges;
@@ -19,7 +19,7 @@ pub fn adult_content_badge(is_adult: bool, label: Option<&str>) -> Markup {
 }

 fn truncate(text: &str, max: usize) -> String {
-    if text.len() <= max {
+    if text.chars().nth(max).is_none() {
        text.to_owned()
    } else {
        let boundary = max.saturating_sub(1);
@@ -29,10 +29,7 @@ fn truncate(text: &str, max: usize) -> String {
 }

 pub fn content_warning_badge(level: Option<i32>, text: Option<&str>, inline_text: bool) -> Markup {
-    let Some(lvl) = level else {
-        return html! {};
-    };
-    if lvl != CONTENT_WARNING_LEVEL {
+    if level != Some(CONTENT_WARNING_LEVEL) {
        return html! {};
    }
    let default_text = "This contains sensitive content.";
@@ -82,13 +79,8 @@ fn resolve_nsfw_source(

 fn source_label(source: NsfwSource, explicit: Option<bool>) -> &'static str {
    match source {
-        NsfwSource::Channel => {
-            if explicit == Some(true) {
-                "(override on)"
-            } else {
-                "(override off)"
-            }
-        }
+        NsfwSource::Channel if explicit == Some(true) => "(override on)",
+        NsfwSource::Channel => "(override off)",
        NsfwSource::Category => "(from category)",
        NsfwSource::Community => "(from community)",
        NsfwSource::None => "",
@@ -110,11 +102,7 @@ pub fn channel_nsfw_state_badge(
    }
    let has_context =
        nsfw_override.is_some() || category_override.is_some() || guild_nsfw.is_some();
-    let (source, explicit) = if has_context {
-        resolve_nsfw_source(nsfw_override, category_override, guild_nsfw)
-    } else {
-        (NsfwSource::None, None)
-    };
+    let (source, explicit) = resolve_nsfw_source(nsfw_override, category_override, guild_nsfw);
    html! {
        span class="inline-flex flex-wrap items-center gap-1" {
            @if is_nsfw {
@@ -1,34 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-use maud::{Markup, PreEscaped, html};
-
-pub fn pagination(base_url: &str, current_page: u32, has_more: bool, extra_params: &str) -> Markup {
-    let sep = if base_url.contains('?') { "&" } else { "?" };
-    let has_previous = current_page > 1;
-    html! {
-        div class="mt-4 flex items-center justify-between" {
-            @if has_previous {
-                p class="text-sm font-normal text-neutral-500" {
-                    a href={
-                        (base_url) (sep) "page=" (current_page - 1) (extra_params)
-                    } class="text-neutral-900 underline decoration-neutral-300 hover:text-neutral-600 hover:decoration-neutral-500 hover:text-neutral-900" {
-                        (PreEscaped("&larr; Previous"))
-                    }
-                }
-            } @else {
-                span {}
-            }
-            @if has_more {
-                p class="text-sm font-normal text-neutral-500" {
-                    a href={
-                        (base_url) (sep) "page=" (current_page + 1) (extra_params)
-                    } class="text-neutral-900 underline decoration-neutral-300 hover:text-neutral-600 hover:decoration-neutral-500 hover:text-neutral-900" {
-                        (PreEscaped("Next &rarr;"))
-                    }
-                }
-            } @else {
-                span {}
-            }
-        }
-    }
-}
@@ -12,8 +12,6 @@ const RESOURCE_LINK_CLASS: &str = "text-neutral-900 underline decoration-neutral
                      hover:text-neutral-600 hover:decoration-neutral-500 text-sm";
 const NAV_LINK_CLASS: &str = "label rounded-lg border border-neutral-300 bg-white \
                      px-3 py-2 text-neutral-700 transition-colors hover:bg-neutral-50";
-const TEXT_LINK_CLASS: &str = "text-neutral-900 underline decoration-neutral-300 \
-         hover:text-neutral-600 hover:decoration-neutral-500";

 impl ResourceType {
    fn path_segment(self) -> &'static str {
@@ -91,18 +89,3 @@ pub fn nav_link(href: &str, content: Markup) -> Markup {
        a href=(href) class=(NAV_LINK_CLASS) { (content) }
    }
 }
-
-pub fn text_link(href: &str, content: Markup, external: bool, _mono: bool) -> Markup {
-    if external {
-        html! {
-            a href=(href) class=(TEXT_LINK_CLASS)
-              target="_blank" rel="noopener noreferrer" {
-                (content)
-            }
-        }
-    } else {
-        html! {
-            a href=(href) class=(TEXT_LINK_CLASS) { (content) }
-        }
-    }
-}
@@ -0,0 +1,93 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+use super::icons::paperclip_icon;
+use maud::{Markup, html};
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+static HINT_TOGGLE_ID: AtomicUsize = AtomicUsize::new(0);
+
+pub struct HintLink<'a> {
+    href: &'a str,
+    label: &'a str,
+}
+
+impl<'a> HintLink<'a> {
+    pub fn new(href: &'a str, label: &'a str) -> Self {
+        debug_assert!(
+            href.starts_with('/'),
+            "hint link href must be admin-absolute: {href:?}"
+        );
+        debug_assert!(
+            href.contains('#'),
+            "hint link href should point at an anchor: {href:?}"
+        );
+        debug_assert!(!label.trim().is_empty(), "hint link needs a label");
+        Self { href, label }
+    }
+}
+
+pub struct Hint<'a> {
+    pub name: Option<&'a str>,
+    pub body: &'a str,
+    pub link: Option<HintLink<'a>>,
+}
+
+pub fn info(base: &str, hint: &Hint<'_>) -> Markup {
+    let aria_label = match hint.name {
+        Some(name) => format!("About {name}"),
+        None => "More information".to_owned(),
+    };
+    let toggle_id = format!(
+        "hint-toggle-{}",
+        HINT_TOGGLE_ID.fetch_add(1, Ordering::Relaxed)
+    );
+    html! {
+        span class="group relative inline-flex items-center" {
+            input type="checkbox" id=(toggle_id) class="peer sr-only";
+            label for=(toggle_id) tabindex="0" aria-label=(aria_label)
+                class="flex h-4 w-4 shrink-0 cursor-pointer items-center justify-center rounded-full \
+                       font-semibold text-brand-primary leading-none active:scale-97 \
+                       hover:text-brand-primary-dark" {
+                "?"
+            }
+            label for=(toggle_id) aria-hidden="true"
+                class="invisible fixed inset-0 z-20 cursor-default peer-checked:visible" {}
+            div class="invisible absolute bottom-full left-2 z-30 w-64 pb-3 pl-2 opacity-0 \
+                      transition-[opacity,visibility] duration-200 ease-out motion-reduce:transition-none \
+                      group-hover:visible group-hover:opacity-100 \
+                      group-focus-within:visible group-focus-within:opacity-100 \
+                      peer-checked:visible peer-checked:opacity-100" {
+                div class="rounded-lg border border-neutral-200 bg-white p-3 text-neutral-600 \
+                          text-xs shadow-lg" {
+                    @if let Some(name) = hint.name {
+                        p class="font-semibold text-neutral-900" { (name) }
+                    }
+                    p class=[hint.name.is_some().then_some("mt-1")] { (hint.body) }
+                    @if let Some(link) = &hint.link {
+                        a href={(base) (link.href)} hx-boost="false"
+                            class="mt-2 inline-flex items-center gap-1 text-blue-600 hover:underline" {
+                            (paperclip_icon(""))(link.label)
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::HintLink;
+
+    #[test]
+    #[should_panic(expected = "anchor")]
+    fn rejects_a_link_that_points_at_no_anchor() {
+        let _ = HintLink::new("/instance-config", "Instance policy");
+    }
+
+    #[test]
+    #[should_panic(expected = "label")]
+    fn rejects_a_link_with_no_label() {
+        let _ = HintLink::new("/instance-config#community-creation", "  ");
+    }
+}
@@ -13,12 +13,39 @@ struct BadgeDef {
    tooltip: String,
 }

+fn premium_tooltip(
+    premium_type: i32,
+    premium_since: Option<&str>,
+    is_self_hosted: bool,
+    self_hosted_premium_name: Option<&str>,
+) -> Option<String> {
+    if is_self_hosted {
+        let name = self_hosted_premium_name?;
+        return Some(match premium_since {
+            Some(since) => format!("{name} subscriber since {since}"),
+            None => name.to_owned(),
+        });
+    }
+    Some(if premium_type == premium_types::LIFETIME {
+        match premium_since {
+            Some(since) => format!("Fluxer Visionary since {since}"),
+            None => "Fluxer Visionary".into(),
+        }
+    } else {
+        match premium_since {
+            Some(since) => format!("Fluxer Plutonium subscriber since {since}"),
+            None => "Fluxer Plutonium".into(),
+        }
+    })
+}
+
 pub fn user_profile_badges(
    static_cdn_endpoint: &str,
    flags: u64,
    premium_type: Option<i32>,
    premium_since: Option<&str>,
    is_self_hosted: bool,
+    self_hosted_premium_name: Option<&str>,
    size_sm: bool,
 ) -> Markup {
    let cdn = static_cdn_endpoint.trim_end_matches('/');
@@ -42,23 +69,11 @@ pub fn user_profile_badges(
            tooltip: "Fluxer Bug Hunter".into(),
        });
    }
-    if !is_self_hosted
-        && let Some(pt) = premium_type
+    if let Some(pt) = premium_type
        && pt != premium_types::NONE
+        && let Some(tooltip) =
+            premium_tooltip(pt, premium_since, is_self_hosted, self_hosted_premium_name)
    {
-        let tooltip = if pt == premium_types::LIFETIME {
-            match premium_since {
-                Some(since) => format!("Fluxer Visionary since {since}"),
-                None => "Fluxer Visionary".into(),
-            }
-        } else {
-            match premium_since {
-                Some(since) => {
-                    format!("Fluxer Plutonium subscriber since {since}")
-                }
-                None => "Fluxer Plutonium".into(),
-            }
-        };
        badges.push(BadgeDef {
            icon_url: format!("{cdn}/badges/plutonium.svg"),
            tooltip,
@@ -84,3 +99,38 @@ pub fn user_profile_badges(
        }
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn render(self_hosted: bool, name: Option<&str>, premium_type: i32) -> String {
+        user_profile_badges(
+            "https://static.example.com",
+            0,
+            Some(premium_type),
+            Some("2026-01-01"),
+            self_hosted,
+            name,
+            false,
+        )
+        .into_string()
+    }
+
+    #[test]
+    fn hosted_premium_badges_keep_their_fluxer_labels() {
+        assert!(
+            render(false, Some("Gold"), 1).contains("Fluxer Plutonium subscriber since 2026-01-01")
+        );
+        assert!(render(false, None, 2).contains("Fluxer Visionary since 2026-01-01"));
+    }
+
+    #[test]
+    fn self_hosted_premium_badges_use_the_configured_name() {
+        let markup = render(true, Some("Gold"), 1);
+        assert!(markup.contains("Gold subscriber since 2026-01-01"));
+        assert!(!markup.contains("Plutonium"));
+        assert!(render(true, Some("Gold"), 2).contains("Gold subscriber since"));
+        assert!(!render(true, None, 1).contains("img"));
+    }
+}
--- a/Show More
+++ b/Show More