style: fixed EOF

fix: simplified comparison logic
feat: token expiration improvement
2026-07-06 09:11:37 +00:00 · 2026-06-03 22:31:34 -04:00 · 2026-06-03 22:31:34 -04:00 · 2026-06-03 22:31:34 -04:00
293 changed files with 18269 additions and 23724 deletions
@@ -71,7 +71,7 @@ runs:

    - name: Install timelord-cli and git-warp-time
      if: steps.check-binaries.outputs.need-install == 'true'
-      uses: https://github.com/taiki-e/install-action@9e1e5806d4a4822de933115878265be9aaa786d9 # v2
+      uses: https://github.com/taiki-e/install-action@e49978b799e49ff429d162b7a30601a569ab6538 # v2
      with:
        tool: git-warp-time,timelord-cli@3.0.1

@@ -10,7 +10,7 @@ on:
      - "v*.*.*"
  workflow_dispatch:
  schedule:
-    - cron: '30 0 * * 1'
+    - cron: '30 0 * * *'

 jobs:
  build:
@@ -41,9 +41,20 @@ jobs:
      #    else
      #      echo "No workaround needed for llvm-project#153385"
      #    fi
+      - name: Pick compatible clang version
+        id: clang-version
+        run: |
+          # both latest need to use clang-23, but oldstable and previous can just use clang
+          if [[ "${{ matrix.container }}" == "ubuntu-latest" ]]; then
+            echo "Using clang-23 package for ${{ matrix.container }}"
+            echo "version=clang-23" >> $GITHUB_OUTPUT
+          else
+            echo "Using default clang package for ${{ matrix.container }}"
+            echo "version=clang" >> $GITHUB_OUTPUT
+          fi

      - name: Checkout repository with full history
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          ref: ${{ github.ref_name }}
@@ -82,10 +93,10 @@ jobs:
          # VERSION is the package version, COMPONENT is used in
          # apt's repository config like a git repo branch
          VERSION=$BASE_VERSION
-          if [[ ${{ forge.ref_name }} =~ ^v+[0-9]+\.+[0-9]+\.+[0-9]+$ ]]; then
+          if [[ ${{ forge.ref_name }} =~ ^v+[0-9]\.+[0-9]\.+[0-9]$ ]]; then
            # Use the "stable" component for tagged semver releases
            COMPONENT="stable"
-          elif [[ ${{ forge.ref_name }} =~ ^v+[0-9]+\.+[0-9]+\.+[0-9]+ ]]; then
+          elif [[ ${{ forge.ref_name }} =~ ^v+[0-9]\.+[0-9]\.+[0-9] ]]; then
            # Use the "unstable" component for tagged semver pre-releases
            COMPONENT="unstable"
          else
@@ -119,7 +130,7 @@ jobs:
        run: |
          apt-get update -y
          # Build dependencies for rocksdb
-          apt-get install -y liburing-dev clang
+          apt-get install -y liburing-dev ${{ steps.clang-version.outputs.version }}

      - name: Run cargo-deb
        id: cargo-deb
@@ -16,7 +16,7 @@ on:
    #   - '.forgejo/workflows/build-fedora.yml'
  workflow_dispatch:
  schedule:
-    - cron: '30 0 * * 2'
+    - cron: '30 0 * * *'

 jobs:
  build:
@@ -30,7 +30,7 @@ jobs:
          echo "Fedora version: $VERSION"

      - name: Checkout repository with full history
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          ref: ${{ github.ref_name }}
@@ -1,71 +0,0 @@
-name: Build / Static via Nix
-
-concurrency:
-  group: "build-nix-${{ forge.ref }}"
-  cancel-in-progress: true
-
-on:
-  push:
-    tags:
-      - "v*.*.*"
-  workflow_dispatch:
-  schedule:
-    - cron: '30 0 * * 3'
-
-jobs:
-  build:
-    name: "Build ${{ matrix.filename }} Binary"
-    runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        include:
-          - package: default-static-x86_64
-            filename: conduwuit-linux-static-amd64
-          - package: default-static-aarch64
-            filename: conduwuit-linux-static-arm64
-
-          - package: max-perf-static-aarch64
-            filename: conduwuit-linux-static-arm64-maxperf
-          - package: max-perf-haswell-static-x86_64
-            filename: conduwuit-haswell-linux-static-amd64-maxperf
-
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
-
-      - name: Install Lix
-        uses: https://github.com/samueldr/lix-gha-installer-action@a0fee77b2a98bb7c5c0ed7ae6d6ad4903dbdad0d
-        with:
-          extra_nix_config: experimental-features = nix-command flakes flake-self-attrs
-
-      - name: Build static binary
-        run: |
-          nix build .#${{ matrix.package }}
-          install -D result/bin/conduwuit /tmp/binaries/${{ matrix.filename }}
-
-      - name: Upload binary artifact
-        uses: forgejo/upload-artifact@v4
-        with:
-          name: ${{ matrix.filename }}
-          path: /tmp/binaries/${{ matrix.filename }}
-
-  release-binaries:
-    name: "Release Binaries"
-    runs-on: ubuntu-latest
-    needs:
-      - build
-    permissions:
-      contents: write
-    if: startsWith(github.ref, 'refs/tags/')
-    steps:
-      - name: Download binary artifacts
-        uses: forgejo/download-artifact@v4
-        with:
-          pattern: conduwuit*
-          path: binaries
-          merge-multiple: true
-      - name: Create Release and Upload
-        uses: https://github.com/softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
-        with:
-          draft: true
-          files: binaries/*
@@ -14,19 +14,23 @@ jobs:
    name: Check changelog is added
    runs-on: ubuntu-latest
    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+          sparse-checkout: .
+
      - name: Check for changelog entry
        id: check_files
        run: |
-          AUTH=$(echo -n "x-access-token:${{ secrets.GITHUB_TOKEN }}" | base64 -w 0)
-          git config --global http.${{ github.server_url }}/.extraheader "Authorization: basic $AUTH"
-          git clone "${{ github.event.repository.clone_url }}" repo.git --bare
-
-          git -C repo.git fetch origin pull/${{ github.event.pull_request.number }}/head
+          git fetch origin ${GITHUB_BASE_REF}

          # Check for Added (A) or Modified (M) files in changelog.d
-          CHANGELOG_CHANGES=$(git -C repo.git diff --name-status ${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }} -- changelog.d/)
+          CHANGELOG_CHANGES=$(git diff --name-status origin/${GITHUB_BASE_REF}...HEAD -- changelog.d/)

-          SRC_CHANGES=$(git -C repo.git diff --name-status ${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }} -- src/)
+          SRC_CHANGES=$(git diff --name-status origin/${GITHUB_BASE_REF}...HEAD -- src/)

          echo "Changes in changelog.d/:"
          echo "$CHANGELOG_CHANGES"
@@ -21,7 +21,7 @@ jobs:

    steps:
      - name: Sync repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false
          fetch-depth: 0
@@ -41,7 +41,7 @@ jobs:
      DOCKER_MIRROR_TOKEN: ${{ secrets.DOCKER_MIRROR_TOKEN }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

@@ -55,7 +55,7 @@ jobs:
      #     repositories: continuwuity

      - name: Install regsync
-        uses: https://github.com/regclient/actions/regsync-installer@4b4db1dcc7dad75ad67a788a380f75a20cc8a040 # main
+        uses: https://github.com/regclient/actions/regsync-installer@c70ad64367908075211b10dcd2ab9fad4bfa1816 # main

      - name: Check what images need mirroring
        run: |
@@ -17,7 +17,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

@@ -48,7 +48,7 @@ jobs:
      rust: ${{ steps.filter.outputs.rust }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

@@ -70,7 +70,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

@@ -46,7 +46,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false
      - name: Prepare Docker build environment
@@ -100,7 +100,7 @@ jobs:
    needs: build-release
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false
      - name: Create multi-platform manifest
@@ -133,7 +133,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false
      - name: Prepare max-perf Docker build environment
@@ -187,7 +187,7 @@ jobs:
    needs: build-maxperf
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false
      - name: Create max-perf manifest
@@ -216,7 +216,7 @@ jobs:
          path: binaries
          merge-multiple: true
      - name: Create Release and Upload
-        uses: https://github.com/softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
+        uses: https://github.com/softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
        with:
          draft: true
          files: binaries/*
@@ -43,11 +43,11 @@ jobs:
    name: Renovate
    runs-on: ubuntu-latest
    container:
-      image: ghcr.io/renovatebot/renovate:43.246.1@sha256:5965c08f8ca5baff8dc9bf3a32c44ca71fef843ad94880e9696d46e1d722b0fa
+      image: ghcr.io/renovatebot/renovate:43.205.3@sha256:38fdc6d337a0f830131660aab4654ff2805828ca60b03fbfc89eb425bdcd560c
      options: --tmpfs /tmp:exec
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          show-progress: false

@@ -14,7 +14,7 @@ jobs:
  update-flake-hashes:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: true
          token: ${{ secrets.FORGEJO_TOKEN }}
@@ -27,7 +27,7 @@ jobs:
      - name: Get new toolchain hash
        run: |
          # Set the current sha256 to an empty hash to make `nix build` calculate a new one
-          awk '/fromToolchainName *\{/{found=1; print; next} found && /sha256 =/{sub(/sha256 = .*/, "sha256 = lib.fakeSha256;"); found=0} 1' nix/rust.nix > temp.nix
+          awk '/fromToolchainFile *\{/{found=1; print; next} found && /sha256 =/{sub(/sha256 = .*/, "sha256 = lib.fakeSha256;"); found=0} 1' nix/rust.nix > temp.nix
          mv temp.nix nix/rust.nix

          # Build continuwuity and filter for the new hash
@@ -39,7 +39,7 @@ jobs:
          sed -i "s|lib.fakeSha256|\"$new_hash\"|" nix/rust.nix

          echo "New hash:"
-          awk -F'"' '/fromToolchainName/{found=1; next} found && /sha256 =/{print $2; found=0}' nix/rust.nix
+          awk -F'"' '/fromToolchainFile/{found=1; next} found && /sha256 =/{print $2; found=0}' nix/rust.nix
          echo "Expected new hash:"
          cat new_toolchain_hash.txt

@@ -24,7 +24,7 @@ repos:
        - id: check-added-large-files

  - repo: https://github.com/crate-ci/typos
-    rev: v1.47.2
+    rev: v1.47.0
    hooks:
      - id: typos
      - id: typos
@@ -12,7 +12,7 @@ license = "Apache-2.0"
 # See also `rust-toolchain.toml`
 readme = "README.md"
 repository = "https://forgejo.ellis.link/continuwuation/continuwuity"
-version = "26.6.0-alpha.1"
+version = "0.5.9"

 [workspace.metadata.crane]
 name = "conduwuit"
@@ -124,7 +124,7 @@ default-features = false
 features = ["util"]

 [workspace.dependencies.tower-http]
-version = "0.7.0"
+version = "0.6.8"
 default-features = false
 features = [
    "add-extension",
@@ -164,7 +164,7 @@ features = ["raw_value"]

 # Used for appservice registration files
 [workspace.dependencies.serde-saphyr]
-version = "0.0.28"
+version = "0.0.26"

 # Used to load forbidden room/user regex from config
 [workspace.dependencies.serde_regex]
@@ -296,7 +296,7 @@ default-features = false
 features = ["env", "toml"]

 [workspace.dependencies.hickory-resolver]
-version = "0.26.0"
+version = "0.25.2"
 default-features = false
 features = [
    "serde",
@@ -316,7 +316,7 @@ default-features = false

 # Used to make working with iterators easier, was already a transitive depdendency
 [workspace.dependencies.itertools]
-version = "0.15.0"
+version = "0.14.0"

 # to parse user-friendly time durations in admin commands
 #TODO: overlaps chrono?
@@ -559,9 +559,6 @@ features = ["std"]
 [workspace.dependencies.nonzero_ext]
 version = "0.3.0"

-[workspace.dependencies.serde_urlencoded]
-version = "0.7.1"
-
 #
 # Patches
 #
@@ -23,7 +23,6 @@ ### Responsible Disclosure
 1. **Contact members of the team directly** over E2EE private message.
   - [@jade:ellis.link](https://matrix.to/#/@jade:ellis.link)
   - [@nex:nexy7574.co.uk](https://matrix.to/#/@nex:nexy7574.co.uk)
-   - [@ginger:gingershaped.computer](https://matrix.to/#/@ginger:gingershaped.computer)
 2. **Email the security team** at [security@continuwuity.org](mailto:security@continuwuity.org). This is not E2EE, so don't include sensitive details.
 3. **Do not disclose the vulnerability publicly** until it has been addressed
 4. **Provide detailed information** about the vulnerability, including:
@@ -1 +0,0 @@
-Users may now be forbidden from deactivating their own accounts with the new `allow_deactivation` config option. Contributed by @ginger.
@@ -1 +0,0 @@
-Added support for Matrix 1.16's `state_after` feature, allowing clients which understand it to sync room state changes more reliably. Contributed by @ginger.
@@ -1 +0,0 @@
-Added support for authenticating clients using the new OAuth 2.0 login API. Contributed by @ginger.
@@ -1 +0,0 @@
-Added example configuration using caddy-docker-proxy in the livekit setup section of the docs. Contributed by @Cease
@@ -1 +0,0 @@
-Fixed admin commands being ignored when they had leading whitespace before admin commands. Contributed by @kitvonsnookerz.
@@ -1 +0,0 @@
-Added static builds using Nix, allowing for Continuwuity on musl. During this, we also introduced a `max-perf-haswell` package, separating it from `max-perf`, so you may want to swap to this if you are on NixOS. Contributed by @Henry-Hiles (QuadRadical).
@@ -1 +0,0 @@
-Added support for MSC4380 invite blocking, which has become part of the Matrix specification in v1.18. Contributed by @nex.
@@ -1 +0,0 @@
-Added `!admin debug get-state-at` command
@@ -1 +0,0 @@
-Adjusted legacy sync logic to no longer use the `roomsynctoken_shortstatehash` database column. Once this change has been confirmed to be stable and reliable, a future update will remove it entirely, significantly decreasing database sizes. Contributed by @ginger.
@@ -521,15 +521,17 @@
 #
 #recaptcha_private_site_key =

-# Controls whether users are allowed to deactivate their own accounts
-# through the account management panel or their Matrix clients. Server
-# admins can always deactivate users using the relevant admin commands.
+# Policy documents, such as terms and conditions or a privacy policy,
+# which users must agree to when registering an account.
 #
-# Note that, in some jurisdictions, you may be legally required to honor
-# users who request to deactivate their accounts if you set this option
-# to `false`.
+# Example:
+# ```ignore
+# [global.registration_terms.privacy_policy]
+# en = { name = "Privacy Policy", url = "https://homeserver.example/en/privacy_policy.html" }
+# es = { name = "Política de Privacidad", url = "https://homeserver.example/es/privacy_policy.html" }
+# ```
 #
-#allow_deactivation = true
+#registration_terms = {}

 # Controls whether encrypted rooms and events are allowed.
 #
@@ -1985,33 +1987,3 @@
 # `require_email_for_registration`.
 #
 #require_email_for_token_registration = false
-
-#[global.registration_terms]
-
-# The language code to provide to clients along with the policy documents.
-#
-#language = "en"
-
-# Policy documents, such as terms and conditions or a privacy policy,
-# which users must agree to when registering an account.
-#
-# Example:
-# ```ignore
-# [global.registration_terms.documents]
-# privacy_policy = { name = "Privacy Policy", url = "https://homeserver.example/en/privacy_policy.html" }
-# ```
-#
-#documents =
-
-#[global.oauth]
-
-# The compatibility mode to use for OAuth.
-#
-# - "disabled": OAuth will be unavailable. Users will only be able to log
-#   in using legacy authentication.
-# - "hybrid": OAuth and legacy authentication will both be available. Some
-#   clients may only use one or the other.
-# - "exclusive": Only OAuth will be available. Clients which require
-#   legacy authentication will be unable to log in.
-#
-#compatibility_mode = "hybrid"
@@ -50,7 +50,7 @@ EOF

 # Developer tool versions
 # renovate: datasource=github-releases depName=cargo-bins/cargo-binstall
-ENV BINSTALL_VERSION=1.20.1
+ENV BINSTALL_VERSION=1.19.1
 # renovate: datasource=github-releases depName=psastras/sbom-rs
 ENV CARGO_SBOM_VERSION=0.9.1
 # renovate: datasource=crate depName=lddtree
@@ -18,7 +18,7 @@ RUN --mount=type=cache,target=/etc/apk/cache apk add \

 # Developer tool versions
 # renovate: datasource=github-releases depName=cargo-bins/cargo-binstall
-ENV BINSTALL_VERSION=1.20.1
+ENV BINSTALL_VERSION=1.19.1
 # renovate: datasource=github-releases depName=psastras/sbom-rs
 ENV CARGO_SBOM_VERSION=0.9.1
 # renovate: datasource=crate depName=lddtree
@@ -187,75 +187,6 @@ ### 4. Configure your Reverse Proxy
    ```

 </details>
-<details>
-   <summary>Example docker compose file with caddy-docker-proxy labels</summary>
-   ```yaml
-   # This setup assumes all containers share the same bridge network
-   services:
-    lk-jwt-service:
-        image: ghcr.io/element-hq/lk-jwt-service:latest
-        container_name: lk-jwt-service
-        # lk-jwt-service environment config here..
-        labels:
-            caddy: livekit.example.com
-            caddy.@lk-jwt-service.path: "/sfu/get* /healthz* /get_token*"
-            caddy.reverse_proxy: "@lk-jwt-service {{upstreams 8081}}"
-
-
-    livekit:
-        image: livekit/livekit-server:latest
-        container_name: livekit
-        command: --config /etc/livekit.yaml
-        restart: unless-stopped
-        labels:
-            caddy: livekit.example.com
-            caddy.reverse_proxy: "{{upstreams 7880}}"
-        volumes:
-            - ./livekit.yaml:/etc/livekit.yaml:ro
-        ports:
-            - "127.0.0.1:7880:7880/tcp"
-            - "7881:7881/tcp"
-            - "50100-50200:50100-50200/udp"
-
-
-    caddy:
-        image: lucaslorentz/caddy-docker-proxy:ci-alpine
-        ports:
-            - 80:80
-            - 443:443
-        environment:
-            - CADDY_INGRESS_NETWORKS=caddy
-        volumes:
-            - /var/run/docker.sock:/var/run/docker.sock
-            - ./data:/data
-        restart: unless-stopped
-        labels:
-            # If you already configured `[global.well_known]` with Continuwuity,
-            # comment out the *_respond labels and add this line
-            # caddy.reverse_proxy: /.well-known/matrix/* homeserver:8008
-            caddy.1_respond: /.well-known/matrix/server {"m.server":"matrix.example.com:443"}
-            caddy.2_respond: /.well-known/matrix/client {"m.server":{"base_url":"https://matrix.example.com"},"m.homeserver":{"base_url":"https://matrix.example.com"},"org.matrix.msc4143.rtc_foci":[{"type":"livekit","livekit_service_url":"https://livekit.example.com"}]}
-
-            # If you are having problems with continuwuity serving headers uncomment
-            # the header section below.
-
-            # caddy: example.com
-            # caddy.0_header: "*"
-            # caddy.0_header.Access-Control-Allow-Origin: "*"
-            # caddy.0_header.Access-Control-Allow-Methods: "GET, POST, OPTIONS"
-            # caddy.0_header.Access-Control-Allow-Headers: "Authorization"
-            # caddy.0_header.Content-Type: "application/json"
-
-    homeserver:
-        image: forgejo.ellis.link/continuwuation/continuwuity:latest
-        restart: unless-stopped
-        # add additional environment, volume, and network config here...
-        labels:
-            caddy: matrix.example.com
-            caddy.reverse_proxy: "{{upstreams 8008}}"
-
-    ```
-</details>


 ### 6. Start Everything
@@ -47,15 +47,9 @@ #### Performance-optimised builds

 ### Nix

-If you wish to generate a static binary, you can do so using Nix: `nix build git+https://forgejo.ellis.link/continuwuation/continuwuity#packageName`, where `packageName` is one of:
+Theres a Nix package defined in our flake, available for Linux and MacOS. Add continuwuity as an input to your flake, and use `inputs.continuwuity.packages.${system}.default` to get a working Continuwuity package.

- `default-static-x86_64`
- `default-static-aarch64`
- `max-perf-static-x86_64`
- `max-perf-haswell-static-x86_64`
- `max-perf-static-aarch64`
-
-`max-perf` takes longer to build, but has more runtime optimizations. Haswell builds are optimized for modern CPUs.
+If you simply wish to generate a binary using Nix, you can run `nix build git+https://forgejo.ellis.link/continuwuation/continuwuity` to generate a binary in `result/bin/conduwuit`.

 ### Compiling

@@ -47,16 +47,9 @@ ### Available options
 - `extraEnvironment`: Extra environment variables to pass to the Continuwuity server
 - `package`: The Continuwuity package to use, defaults to `pkgs.matrix-continuwuity`
    - You may want to override this to be from our flake, for faster updates and unstable versions:
-
    ```nix
-    package = inputs.continuwuity.packages.${pkgs.stdenv.hostPlatform.system}.packageName;
+    package = inputs.continuwuity.packages.${pkgs.stdenv.hostPlatform.system}.default;
    ```
-
-    Where `packageName` is one of:
-    - `default`
-    - `max-perf`: Takes longer to build, but has more runtime optimizations
-    - `max-perf-haswell`: Optimized for modern CPUs, don't use if your CPU is not Haswell or later.
-
 - `admin.enable`: Whether to add the `conduwuit` binary to `PATH` for administration (enabled by default)
 - `settings`: The Continuwuity configuration

@@ -6,10 +6,10 @@
            "message": "Welcome to Continuwuity! Important announcements about the project will appear here."
        },
        {
-            "id": 14,
+            "id": 13,
            "mention_room": true,
-            "date": "2026-06-20",
-            "message": "[v0.5.10](https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v0.5.10) has been released. It is a security release, so we suggest you update as soon as possible. Don't forget to also join [our announcements room](https://matrix.to/#/!jIdNjSM5X-V5JVx2h2kAhUZIIQ08GyzPL55NFZAH1vM/%24K1ISNKIqfNiZzsNVCaTt2E7ZtNeP6Dsy6sbz9l3rO0A?via=ellis.link&via=gingershaped.computer&via=matrix.org)."
+            "date": "2026-05-08",
+            "message": "[v0.5.9](https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v0.5.9) has been released, fixing a few low-severity federation-related vulnerabilities. It is recommended you read the changelog and update as soon as possible. There are no new features or other changes in this release, only related bugfixes. Deployments tracking the main branch should also update to the latest commit."
        }
    ]
 }
@@ -10,7 +10,7 @@ ## Continuwuity issues

 ### Slow joins to rooms

-Some slowness is to be expected if you're the first person on your homeserver to join a room (which will
+Some slowness is to be expected if you're the first person on your homserver to join a room (which will
 always be the case for single-user homeservers). In this situation, your homeserver has to verify the signatures of
 all of the state events sent by other servers before your join. To make this process as fast as possible, make sure you have
 multiple fast, trusted servers listed in `trusted_servers` in your configuration, and ensure
@@ -3,11 +3,11 @@
    "advisory-db": {
      "flake": false,
      "locked": {
-        "lastModified": 1781566179,
-        "narHash": "sha256-Tqv8I586fYzWpEW/Smq/JqESFa3DVVzVWsnAMtvhy/I=",
+        "lastModified": 1779575509,
+        "narHash": "sha256-wXKYURZz76ZC5lbuDA1oVQA/MxSB3pSJ1raF1HG0oIc=",
        "owner": "rustsec",
        "repo": "advisory-db",
-        "rev": "74e084413d979d52d2f93b1d93b1ab7b9ee648f5",
+        "rev": "831c50f4a4304068f125e603add6a8839f08b3eb",
        "type": "github"
      },
      "original": {
@@ -18,11 +18,11 @@
    },
    "crane": {
      "locked": {
-        "lastModified": 1780532242,
-        "narHash": "sha256-D+BsdpxmtUwtqGoY0IXPhHgTlmqgcZKCEo1oMyn7ep0=",
+        "lastModified": 1779130139,
+        "narHash": "sha256-BLrtr42azquO7MdGFU5a7KiMl3YpFlTeIXqy1fT5GlQ=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "59a82a1222dd3b2080b5cc52a1a2e8d5f1b77f37",
+        "rev": "edb38893982a3338972bb4a2ec7ce7c29ba10fd9",
        "type": "github"
      },
      "original": {
@@ -39,11 +39,11 @@
        "rust-analyzer-src": "rust-analyzer-src"
      },
      "locked": {
-        "lastModified": 1781527054,
-        "narHash": "sha256-1fX9ev2Fh5QoKQ41G9dYutjo5j/jywu6tZse5Eb1Ck4=",
+        "lastModified": 1779612045,
+        "narHash": "sha256-+7lfNVnmXJDkiRYHd5NoNwYoyUcc0LcXPaIJqjO7VWM=",
        "owner": "nix-community",
        "repo": "fenix",
-        "rev": "8c2e51dffefc040a21975da7abf6f252c8c9b783",
+        "rev": "d7be747f0a65af378de515fc3cee131bf99a008f",
        "type": "github"
      },
      "original": {
@@ -89,11 +89,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1781074563,
-        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
+        "lastModified": 1779508470,
+        "narHash": "sha256-Ap9KJX+5xHIn3bPIpfNgT6MEXdAECECwo4/rmlQD74M=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
+        "rev": "29916453413845e54a65b8a1cf996842300cd299",
        "type": "github"
      },
      "original": {
@@ -132,11 +132,11 @@
    "rust-analyzer-src": {
      "flake": false,
      "locked": {
-        "lastModified": 1781453968,
-        "narHash": "sha256-+V3nK4pCngbmgyVGXY6Kkrlevp4ocPkJJLf2aqwkDNA=",
+        "lastModified": 1779569060,
+        "narHash": "sha256-NSnk5D+3KEfRdbgPijs33N2RAKSG6A74SwfnynLcouo=",
        "owner": "rust-lang",
        "repo": "rust-analyzer",
-        "rev": "cc272809a173c2c11d0e479d639c811c1eacf049",
+        "rev": "987ea33645ab1c709b1df6823038abcb2fe8973e",
        "type": "github"
      },
      "original": {
@@ -153,11 +153,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1780220602,
-        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
+        "lastModified": 1775636079,
+        "narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
+        "rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
        "type": "github"
      },
      "original": {
@@ -0,0 +1,14 @@
+{ inputs, ... }:
+{
+  perSystem =
+    {
+      pkgs,
+      self',
+      ...
+    }:
+    {
+      _module.args.craneLib = (inputs.crane.mkLib pkgs).overrideToolchain (
+        pkgs: self'.packages.stable-toolchain
+      );
+    };
+}
@@ -1,6 +1,7 @@
 {
  imports = [
    ./rust.nix
+    ./crane.nix
    ./packages
    ./devshell.nix
    ./fmt.nix
@@ -1,6 +1,7 @@
-{ inputs, ... }: {
+{
  perSystem =
    {
+      craneLib,
      self',
      lib,
      pkgs,
@@ -8,36 +9,34 @@
    }:
    {
      # basic nix shell containing all things necessary to build continuwuity in all flavors manually (on x86_64-linux)
-      devShells.default =
-        (inputs.crane.mkLib pkgs).overrideToolchain (pkgs: self'.packages.stable-toolchain).devShell
-          {
-            packages = [
-              self'.packages.rocksdb
-              pkgs.nodejs
-              pkgs.pkg-config
+      devShells.default = craneLib.devShell {
+        packages = [
+          self'.packages.rocksdb
+          pkgs.nodejs
+          pkgs.pkg-config
+        ]
+        ++ lib.optionals pkgs.stdenv.isLinux [
+          pkgs.liburing
+          pkgs.rust-jemalloc-sys-unprefixed
+        ];
+
+        env = {
+          LIBCLANG_PATH = lib.makeLibraryPath [ pkgs.llvmPackages.libclang.lib ];
+          LD_LIBRARY_PATH = lib.makeLibraryPath (
+            [
+              pkgs.stdenv.cc.cc.lib
            ]
            ++ lib.optionals pkgs.stdenv.isLinux [
              pkgs.liburing
-              pkgs.rust-jemalloc-sys-unprefixed
-            ];
-
-            env = {
-              LIBCLANG_PATH = lib.makeLibraryPath [ pkgs.llvmPackages.libclang.lib ];
-              LD_LIBRARY_PATH = lib.makeLibraryPath (
-                [
-                  pkgs.stdenv.cc.cc.lib
-                ]
-                ++ lib.optionals pkgs.stdenv.isLinux [
-                  pkgs.liburing
-                  pkgs.jemalloc
-                ]
-              );
-            }
-            // lib.optionalAttrs pkgs.stdenv.isLinux {
-              PKG_CONFIG_PATH = lib.makeSearchPath "lib/pkgconfig" [
-                pkgs.liburing.dev
-              ];
-            };
-          };
+              pkgs.jemalloc
+            ]
+          );
+        }
+        // lib.optionalAttrs pkgs.stdenv.isLinux {
+          PKG_CONFIG_PATH = lib.makeSearchPath "lib/pkgconfig" [
+            pkgs.liburing.dev
+          ];
+        };
+      };
    };
 }
@@ -2,14 +2,14 @@
  lib,
  self,
  stdenv,
-  rocksdb,
+  liburing,
  craneLib,
  pkg-config,
-  liburing,
  rustPlatform,
  cargoExtraArgs ? "",
  rustflags ? "",
  target_cpu ? null,
+  rocksdb,
  profile ? "release",
 }:
 let
@@ -28,26 +28,18 @@ let
  };

  attrs = {
-    __structuredAttrs = true;
-    strictDeps = true;
-
    inherit src;
-
    nativeBuildInputs = [
      pkg-config
      rustPlatform.bindgenHook
    ];
-
    buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ liburing ];
-
    env = {
+      ROCKSDB_INCLUDE_DIR = "${rocksdb}/include";
+      ROCKSDB_LIB_DIR = "${rocksdb}/lib";
      CARGO_PROFILE = profile;
      RUSTFLAGS = rustflags;
    }
-    // (lib.optionalAttrs (rocksdb != null) {
-      ROCKSDB_INCLUDE_DIR = "${rocksdb}/include";
-      ROCKSDB_LIB_DIR = "${rocksdb}/lib";
-    })
    // (lib.optionalAttrs (target_cpu != null) {
      TARGET_CPU = target_cpu;
    });
@@ -59,7 +51,7 @@ craneLib.buildPackage (
    cargoArtifacts = craneLib.buildDepsOnly attrs;

    # Needed to make continuwuity link to rocksdb
-    postFixup = lib.optionalString (stdenv.hostPlatform.isLinux && rocksdb != null) ''
+    postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
      old_rpath="$(patchelf --print-rpath $out/bin/conduwuit)"
      extra_rpath="${
        lib.makeLibraryPath [
@@ -1,5 +1,4 @@
 {
-  inputs,
  self,
  ...
 }:
@@ -7,84 +6,32 @@
  perSystem =
    {
      self',
-      lib,
      pkgs,
-      inputs',
-      system,
      craneLib,
-      mkToolchain,
      ...
    }:
    {
-      packages =
-        let
-          mkPackages =
-            pkgs:
-            let
-              fnx = inputs'.fenix.packages;
+      packages = {
+        rocksdb = pkgs.callPackage ./rocksdb.nix { };
+        default = pkgs.callPackage ./continuwuity.nix {
+          inherit self craneLib;
+          inherit (self'.packages) rocksdb;
+          # extra features via `cargoExtraArgs`
+          cargoExtraArgs = "-F http3";
+          # extra RUSTFLAGS via `rustflags`
+          # the stuff below is required for http3
+          rustflags = "--cfg reqwest_unstable";
+        };
+        # users may also override this with other cargo profiles to build for other feature sets
+        # for features configuration see `default` package which enables http3 by default

-              isStatic = pkgs.stdenv.hostPlatform.isMusl;
-
-              craneLib = (inputs.crane.mkLib pkgs).overrideToolchain (
-                _:
-                if isStatic then
-                  fnx.combine [
-                    self'.packages.stable-toolchain
-                    (mkToolchain fnx.targets.${pkgs.stdenv.hostPlatform.config}).rust-std
-                  ]
-                else
-                  self'.packages.stable-toolchain
-              );
-
-              default = pkgs.callPackage ./continuwuity.nix {
-                inherit self craneLib;
-
-                liburing = (if isStatic then pkgs.pkgsStatic else pkgs).liburing;
-                rocksdb = if isStatic then null else self'.packages.rocksdb;
-
-                # extra features via `cargoExtraArgs`
-                cargoExtraArgs = "-F http3";
-                # extra RUSTFLAGS via `rustflags`
-                # the stuff below is required for http3
-                rustflags = "--cfg reqwest_unstable";
-              };
-
-              # users may also override this with other cargo profiles to build for other feature sets
-              # for features configuration see `default` package which enables http3 by default
-
-              max-perf = default.override {
-                # compiles slower but with more thorough optimizations
-                profile = "release-max-perf";
-              };
-
-              max-perf-haswell = max-perf.override {
-                # compiles explicitly for haswell arch cpus
-                target_cpu = "haswell";
-              };
-            in
-            {
-              inherit default max-perf max-perf-haswell;
-            };
-        in
-        {
-          rocksdb = pkgs.callPackage ./rocksdb.nix { };
-        }
-        // (mkPackages pkgs)
-        // (lib.mapAttrs' (name: value: lib.nameValuePair "${name}-static-x86_64" value) (
-          mkPackages (
-            import inputs.nixpkgs {
-              localSystem = system;
-              crossSystem = "x86_64-unknown-linux-musl";
-            }
-          )
-        ))
-        // (lib.mapAttrs' (name: value: lib.nameValuePair "${name}-static-aarch64" value) (
-          mkPackages (
-            import inputs.nixpkgs {
-              localSystem = system;
-              crossSystem = "aarch64-unknown-linux-musl";
-            }
-          )
-        ));
+        # example: different compilation profile and different target_cpu
+        max-perf-haswell = self'.packages.default.override {
+          # compiles explicitly for haswell arch cpus
+          target_cpu = "haswell";
+          # compiles slower but with more thorough optimizations
+          profile = "release-max-perf";
+        };
+      };
    };
 }
@@ -2,26 +2,22 @@
 {
  perSystem =
    {
+      system,
      lib,
-      inputs',
      pkgs,
      ...
    }:
-    let
-      mkToolchain =
-        target:
-        target.fromToolchainName {
-          name = (lib.importTOML "${inputs.self}/rust-toolchain.toml").toolchain.channel;
-          sha256 = "sha256-mvUGEOHYJpn3ikC5hckneuGixaC+yGrkMM/liDIDgoU=";
-        };
-    in
    {
-      _module.args = { inherit mkToolchain; };
-
      packages =
        let
-          fnx = inputs'.fenix.packages;
-          stable-toolchain = (mkToolchain fnx).toolchain;
+          fnx = inputs.fenix.packages.${system};
+
+          stable-toolchain = fnx.fromToolchainFile {
+            file = inputs.self + "/rust-toolchain.toml";
+
+            # See also `rust-toolchain.toml`
+            sha256 = "sha256-mvUGEOHYJpn3ikC5hckneuGixaC+yGrkMM/liDIDgoU=";
+          };
        in
        {
          inherit stable-toolchain;
@@ -125,14 +125,14 @@
      }
    },
    "node_modules/@rsbuild/core": {
-      "version": "2.0.15",
-      "resolved": "https://registry.npmjs.org/@rsbuild/core/-/core-2.0.15.tgz",
-      "integrity": "sha512-O8vmMhZu1YImO6jOqt/K/vlJSvkq7UtSq5YM1DIlcEd9LW8Gf6/dkQ1B2KPI6F+hSMFBnTTTumdcIowSLCw97g==",
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/@rsbuild/core/-/core-2.0.7.tgz",
+      "integrity": "sha512-LsBONEzsjzOAqO72ot39eI7g53zSfF9QuDXTu4ks8IUX+EZsxRSniQfc+1zVA6a6y3b9KUUtG96avoMLKbWklQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@rspack/core": "~2.0.8",
-        "@swc/helpers": "^0.5.23"
+        "@rspack/core": "~2.0.4",
+        "@swc/helpers": "^0.5.21"
      },
      "bin": {
        "rsbuild": "bin/rsbuild.js"
@@ -150,9 +150,9 @@
      }
    },
    "node_modules/@rsbuild/plugin-react": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@rsbuild/plugin-react/-/plugin-react-2.0.1.tgz",
-      "integrity": "sha512-n5m3VxEm6m3Dv1VkI0WnxsildySJ6M+QjGIzkZDy5UebRCIJ1Q/hlQVyhofBL6C+AcsF9fGjlHQkeiteXJSr3Q==",
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@rsbuild/plugin-react/-/plugin-react-2.0.0.tgz",
+      "integrity": "sha512-/1gzt39EGUSFEqB83g46QoOwsgv172HI18i6au1b6lgIaX4sv9stuX4ijdHbHCp8PqYEq+MyQ99jIQMO6I+etg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -169,28 +169,28 @@
      }
    },
    "node_modules/@rspack/binding": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/binding/-/binding-2.0.8.tgz",
-      "integrity": "sha512-3uZ+y8aQxq33ty2srMxg2Nu0XuBI6vVrG50rkDaXqwWqOohfgGUSfFuQK7EnSUNy4aFUQlCG6NHialQHJov0wg==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/binding/-/binding-2.0.4.tgz",
+      "integrity": "sha512-/QeJDPUw/lWkBJESG264KA9u6/rAjvoJhKncU4rkTi5Ap45kue5HTgOzr0ufxKdd2Xl72fjFBuqlKmtFDD5LiQ==",
      "dev": true,
      "license": "MIT",
      "optionalDependencies": {
-        "@rspack/binding-darwin-arm64": "2.0.8",
-        "@rspack/binding-darwin-x64": "2.0.8",
-        "@rspack/binding-linux-arm64-gnu": "2.0.8",
-        "@rspack/binding-linux-arm64-musl": "2.0.8",
-        "@rspack/binding-linux-x64-gnu": "2.0.8",
-        "@rspack/binding-linux-x64-musl": "2.0.8",
-        "@rspack/binding-wasm32-wasi": "2.0.8",
-        "@rspack/binding-win32-arm64-msvc": "2.0.8",
-        "@rspack/binding-win32-ia32-msvc": "2.0.8",
-        "@rspack/binding-win32-x64-msvc": "2.0.8"
+        "@rspack/binding-darwin-arm64": "2.0.4",
+        "@rspack/binding-darwin-x64": "2.0.4",
+        "@rspack/binding-linux-arm64-gnu": "2.0.4",
+        "@rspack/binding-linux-arm64-musl": "2.0.4",
+        "@rspack/binding-linux-x64-gnu": "2.0.4",
+        "@rspack/binding-linux-x64-musl": "2.0.4",
+        "@rspack/binding-wasm32-wasi": "2.0.4",
+        "@rspack/binding-win32-arm64-msvc": "2.0.4",
+        "@rspack/binding-win32-ia32-msvc": "2.0.4",
+        "@rspack/binding-win32-x64-msvc": "2.0.4"
      }
    },
    "node_modules/@rspack/binding-darwin-arm64": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-arm64/-/binding-darwin-arm64-2.0.8.tgz",
-      "integrity": "sha512-vCgbgH7B7qom+uID+RCZsTCOYFb9wC4/4+1U6rMfytrXGVJ72eNQs2tbdjOl0lb18CT3N/n+VkWynUiLk84GwA==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-arm64/-/binding-darwin-arm64-2.0.4.tgz",
+      "integrity": "sha512-0Q1QXFEsZfDc4opiDnb8q50KlBbC2VovViDaYlMJZBzvjAo325mh3itXPfz7YZ31M+TxRE7TUiJXH3ltiV1Hdg==",
      "cpu": [
        "arm64"
      ],
@@ -202,9 +202,9 @@
      ]
    },
    "node_modules/@rspack/binding-darwin-x64": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-x64/-/binding-darwin-x64-2.0.8.tgz",
-      "integrity": "sha512-satPm2PD4B7jDTVlVAdvMVdUszwLvWUEnUDzLb77mvVkezKNDZmuhb+e8s+FfKs8hJpNbZ9VAejuA2rr8o985w==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-x64/-/binding-darwin-x64-2.0.4.tgz",
+      "integrity": "sha512-oO5J2QYf7+H+aYRj85EiGrDOoDEE9EDDl7NgXv46iWvIF0wXowEHXqnjMFxHxRq2Vf6scT+0yYQX9blWcvMWAA==",
      "cpu": [
        "x64"
      ],
@@ -216,9 +216,9 @@
      ]
    },
    "node_modules/@rspack/binding-linux-arm64-gnu": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-2.0.8.tgz",
-      "integrity": "sha512-pSI+npPQE/uDtiboqvcOIRJbEV2+B+H1xffmko/gw50la92oTUW60kVULFwsb6L0+GVCzIcwX3yq60GtYIn+Ug==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-2.0.4.tgz",
+      "integrity": "sha512-BEk6mIYBK4BihW9qXXITJORrVXecTlkRjrqhgefili4xjXtLdcUnxAm9sN/2oJ8m378n2h33qDh4gr2orPBFWQ==",
      "cpu": [
        "arm64"
      ],
@@ -233,9 +233,9 @@
      ]
    },
    "node_modules/@rspack/binding-linux-arm64-musl": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-musl/-/binding-linux-arm64-musl-2.0.8.tgz",
-      "integrity": "sha512-igjJ43yxWQ72GZqjDDZSSHax9/Vg+6rLMmOvFglTJUkQpB4Tyvu/YjW+WRjYj2xRw6blOjLxUSJWASvuSqqlvg==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-musl/-/binding-linux-arm64-musl-2.0.4.tgz",
+      "integrity": "sha512-Hyt3z1RwNcSMIoaoWLN4Hb/696/O5JPukf8rXQASvf2UkC+X3ij7tr+8lMSYi3Zysi1QL375CnT4fNoABEW0JA==",
      "cpu": [
        "arm64"
      ],
@@ -250,9 +250,9 @@
      ]
    },
    "node_modules/@rspack/binding-linux-x64-gnu": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-gnu/-/binding-linux-x64-gnu-2.0.8.tgz",
-      "integrity": "sha512-zrkoEOnqj1hOEBO5T2I/2Ts2HSJsYFh1qXwMpK4dMJFGGNWDfNeUa6/LF5uq3VINF3JUl7RL47AgrucoSZJXPA==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-gnu/-/binding-linux-x64-gnu-2.0.4.tgz",
+      "integrity": "sha512-xHorBPBZAg0Pn9Q0k9dWZ9euowieDxcSOzQ9JhTCmhDY6wZH5M/kCBFlCs/OQeW5/NUArW3x3MwEdO/0QJHMxg==",
      "cpu": [
        "x64"
      ],
@@ -267,9 +267,9 @@
      ]
    },
    "node_modules/@rspack/binding-linux-x64-musl": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-musl/-/binding-linux-x64-musl-2.0.8.tgz",
-      "integrity": "sha512-6CtDaGZjNDvJd9TBp7a9zABbrPORO21W96+3ZcGBn0YNUPUk4ARxIxrTTpeJ/1F41QDM8AYIkGDdqEYMqTYBsA==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-musl/-/binding-linux-x64-musl-2.0.4.tgz",
+      "integrity": "sha512-QLxEGUXofF0kVNU12Y2NT3Qi9lGs+WbnYpapVeb+2IXtrAXJfU7Rhy7lAp5GLMzYMQNrKKL9SVnTWKbODbNW9Q==",
      "cpu": [
        "x64"
      ],
@@ -284,9 +284,9 @@
      ]
    },
    "node_modules/@rspack/binding-wasm32-wasi": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-wasm32-wasi/-/binding-wasm32-wasi-2.0.8.tgz",
-      "integrity": "sha512-Yf4SiqTUroT5Ju+te0YAY2xxKOb35tECsO21v7hYyGa705wrgoAK/MmF7enOvs9GR1iZIqgiLD/wxsIxl8GjJw==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-wasm32-wasi/-/binding-wasm32-wasi-2.0.4.tgz",
+      "integrity": "sha512-YhN8HkiH46ONU9tm5dyoXDImDWGpU7E4SPqGI4OyAVF0445uIChurIUmTIOYcD6cg81GGeIjozWJOcb635Dcqw==",
      "cpu": [
        "wasm32"
      ],
@@ -300,9 +300,9 @@
      }
    },
    "node_modules/@rspack/binding-win32-arm64-msvc": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-2.0.8.tgz",
-      "integrity": "sha512-8NCuiQsAhXrwRBy57QZoypqrws/zLBkaQVGiB8hksr6v++8hNigNjqpQARLbd0iyMuHsQQ++8+auGk6xlDXmzw==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-2.0.4.tgz",
+      "integrity": "sha512-MUlYIz82xQRN0aoiXXyEBrNVUwiOSSFRi7nuCgUKduaSdlbPWzCY31IdtOygZ06LVp5JIGUEtyqSrjQq4FrMRw==",
      "cpu": [
        "arm64"
      ],
@@ -314,9 +314,9 @@
      ]
    },
    "node_modules/@rspack/binding-win32-ia32-msvc": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-ia32-msvc/-/binding-win32-ia32-msvc-2.0.8.tgz",
-      "integrity": "sha512-bxiekytbX7V9KFAra+HkwtNWC6pYfHEBBZFpiT0xUs3mCFOmAAFVBsBSQsoCP9AdCEXoMAvNdnrHNw3iov4OZw==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-ia32-msvc/-/binding-win32-ia32-msvc-2.0.4.tgz",
+      "integrity": "sha512-D7UcIFMzlY2yhhyuW4Ej15gBWmTwUM5DxuObl3Kv31qRv/pmV3MsqUeG5m2dqLbUxzqPH87qnp0cArbkJQ1b+w==",
      "cpu": [
        "ia32"
      ],
@@ -328,9 +328,9 @@
      ]
    },
    "node_modules/@rspack/binding-win32-x64-msvc": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-x64-msvc/-/binding-win32-x64-msvc-2.0.8.tgz",
-      "integrity": "sha512-7zPs8YCe/ZVJTwd+5lpB0CP0tkn2pONf/T1ycmVY76u21Nrwt8mXQGc/2yH2eWP4B7fikYBr3hGr7mpR2fajqQ==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-x64-msvc/-/binding-win32-x64-msvc-2.0.4.tgz",
+      "integrity": "sha512-MnYKPfdrAEbtpKg/1SZ6cNtzreIRyQJK4APbxLLPXENdTH5QXQkaTjLMKEeJcJ51FRhI/+yNpOUm2oTHdCQ1Og==",
      "cpu": [
        "x64"
      ],
@@ -342,20 +342,20 @@
      ]
    },
    "node_modules/@rspack/core": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/core/-/core-2.0.8.tgz",
-      "integrity": "sha512-+NLGJf8gZxihDmMFzjlly3toc2SMjeDmuvz0/Cai9AMdV4F+Pqcnt2BA9V4e3SY2jmhJQtPwgyyLtR1RiJO77g==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/core/-/core-2.0.4.tgz",
+      "integrity": "sha512-OuxdQeeKWQpNvFBRDOcnoSaQvp6E4APM/6JJMM/k0p6oL1TEFQVGdNu3VGY4mRAsebnNBXapMVMhj+v66Bn2pg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@rspack/binding": "2.0.8"
+        "@rspack/binding": "2.0.4"
      },
      "engines": {
        "node": "^20.19.0 || >=22.12.0"
      },
      "peerDependencies": {
        "@module-federation/runtime-tools": "^0.24.1 || ^2.0.0",
-        "@swc/helpers": "^0.5.23"
+        "@swc/helpers": ">=0.5.1"
      },
      "peerDependenciesMeta": {
        "@module-federation/runtime-tools": {
@@ -383,18 +383,18 @@
      }
    },
    "node_modules/@rspress/core": {
-      "version": "2.0.15",
-      "resolved": "https://registry.npmjs.org/@rspress/core/-/core-2.0.15.tgz",
-      "integrity": "sha512-epLmUXYscNRw/GtQZx2oknoBE9wKbCrUGEOrQEDI4Qq8X32GdM4d7itzuHsliY7q3IbffKx8rMVbvlmygEocTQ==",
+      "version": "2.0.13",
+      "resolved": "https://registry.npmjs.org/@rspress/core/-/core-2.0.13.tgz",
+      "integrity": "sha512-lbaBA5eqh7wKdH98TUQEI+SfS3Z6YgaNCup3X+ttrYVLOrxN8PJvbedo6fFAcl+wP3XLy6D0pcnnzAgu8y3tdg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@mdx-js/mdx": "^3.1.1",
        "@mdx-js/react": "^3.1.1",
-        "@rsbuild/core": "^2.0.15",
-        "@rsbuild/plugin-react": "~2.0.1",
-        "@rspress/shared": "2.0.15",
-        "@shikijs/rehype": "^4.2.0",
+        "@rsbuild/core": "^2.0.7",
+        "@rsbuild/plugin-react": "~2.0.0",
+        "@rspress/shared": "2.0.13",
+        "@shikijs/rehype": "^4.0.2",
        "@types/unist": "^3.0.3",
        "@unhead/react": "^2.1.15",
        "body-scroll-lock": "4.0.0-beta.0",
@@ -407,22 +407,22 @@
        "mdast-util-mdxjs-esm": "^2.0.1",
        "medium-zoom": "1.1.0",
        "nprogress": "^0.2.0",
-        "react": "^19.2.7",
-        "react-dom": "^19.2.7",
+        "react": "^19.2.6",
+        "react-dom": "^19.2.6",
        "react-lazy-with-preload": "^2.2.1",
        "react-reconciler": "0.33.0",
        "react-render-to-markdown": "19.1.0",
        "react-router-dom": "^7.15.1",
        "rehype-external-links": "^3.0.0",
        "rehype-raw": "^7.0.0",
-        "remark-cjk-friendly": "^2.3.1",
-        "remark-cjk-friendly-gfm-strikethrough": "^2.1.0",
+        "remark-cjk-friendly": "^2.0.1",
+        "remark-cjk-friendly-gfm-strikethrough": "^2.0.1",
        "remark-gfm": "^4.0.1",
        "remark-mdx": "^3.1.1",
        "remark-parse": "^11.0.0",
        "remark-stringify": "^11.0.0",
        "scroll-into-view-if-needed": "^3.1.0",
-        "shiki": "^4.2.0",
+        "shiki": "^4.0.2",
        "unified": "^11.0.5",
        "unist-util-remove": "^4.0.0",
        "unist-util-visit": "^5.1.0",
@@ -436,9 +436,9 @@
      }
    },
    "node_modules/@rspress/plugin-client-redirects": {
-      "version": "2.0.15",
-      "resolved": "https://registry.npmjs.org/@rspress/plugin-client-redirects/-/plugin-client-redirects-2.0.15.tgz",
-      "integrity": "sha512-bPf/KIHH7Y6huLTtK6JXwRfxM7zKjksoxm46+IBsF1wisw0doKkEKR9HwJydxWnykyKBbA2cuZOaoT4h174Z1w==",
+      "version": "2.0.13",
+      "resolved": "https://registry.npmjs.org/@rspress/plugin-client-redirects/-/plugin-client-redirects-2.0.13.tgz",
+      "integrity": "sha512-dP753ASTvH6eDtSEulcqq2lE/kTSdOWSCw0nzvXG+7atTWTHDp6z47uH3CGD8E78cBuKyEi4OH+U7V0EtCTc0Q==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -449,9 +449,9 @@
      }
    },
    "node_modules/@rspress/plugin-sitemap": {
-      "version": "2.0.15",
-      "resolved": "https://registry.npmjs.org/@rspress/plugin-sitemap/-/plugin-sitemap-2.0.15.tgz",
-      "integrity": "sha512-z1hbyGP79ZXdSGJxiWw7ZjmX8qW0q9nXMDxr14cVEg/wdj7ToVzGtZHw0wvTPE0YiKG3BMiGkVNfE1rdOaPXiQ==",
+      "version": "2.0.13",
+      "resolved": "https://registry.npmjs.org/@rspress/plugin-sitemap/-/plugin-sitemap-2.0.13.tgz",
+      "integrity": "sha512-JtkNlxNuA7BzknKIrLvLQkSk0XVi7OXzrE76ma/cLvleccNWr8LGrHtrac4IrDr+HauK4WKTM2JaHGGHUdOUKw==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -462,26 +462,26 @@
      }
    },
    "node_modules/@rspress/shared": {
-      "version": "2.0.15",
-      "resolved": "https://registry.npmjs.org/@rspress/shared/-/shared-2.0.15.tgz",
-      "integrity": "sha512-o8aYwEzNuTmWnmKe91ntPv+34u3RbtAe+rcK9XC5MANOlgncwOaCs3bUa8/B1/llwyLoNgrpi+VB9bEiU11ZRQ==",
+      "version": "2.0.13",
+      "resolved": "https://registry.npmjs.org/@rspress/shared/-/shared-2.0.13.tgz",
+      "integrity": "sha512-LmDfr7+MDNWRBbxcNoWkW68A35oRonpDJq2Jlx3L8GCzG4sAsyd6Yw0DebTWAxx7hVOXGMf37nEf1J4aOLEZfg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@rsbuild/core": "^2.0.15",
-        "@shikijs/rehype": "^4.2.0",
+        "@rsbuild/core": "^2.0.7",
+        "@shikijs/rehype": "^4.0.2",
        "unified": "^11.0.5"
      }
    },
    "node_modules/@shikijs/core": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/core/-/core-4.2.0.tgz",
-      "integrity": "sha512-Hc87Ab1Ld/vEbZRCbwx344I5v+4RU8CVToUTRkqXL1+TjbuOp9U5Xa0M23V4GEWHxVn+yO5otb+HkQVm3ptWQQ==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/@shikijs/core/-/core-4.1.0.tgz",
+      "integrity": "sha512-jLJtSJeuFffqX6/inRE1zqU5aFv2hrszvYgq3OjbAgFRZiWv7abKMDdQzYxuSDfmUPQozZvI/kuy6VMTvnvqTQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/primitive": "4.2.0",
-        "@shikijs/types": "4.2.0",
+        "@shikijs/primitive": "4.1.0",
+        "@shikijs/types": "4.1.0",
        "@shikijs/vscode-textmate": "^10.0.2",
        "@types/hast": "^3.0.4",
        "hast-util-to-html": "^9.0.5"
@@ -491,13 +491,13 @@
      }
    },
    "node_modules/@shikijs/engine-javascript": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/engine-javascript/-/engine-javascript-4.2.0.tgz",
-      "integrity": "sha512-fjETeq1k5ffyXqRgS6+3hpvqseLalp1kjNfRbXpUgWR8FpZ1CmQfiNHovc5lncYjt/Vg5JK/WJEmLahjwMa0og==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/@shikijs/engine-javascript/-/engine-javascript-4.1.0.tgz",
+      "integrity": "sha512-YquhawCUgaBfhsS72e2Y/dI59gCBNPHu3fEO/tvLaXrTssxZrY5ddjtNLTwndrMgPo8b3IscE+xoICDzpTmlFQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.1.0",
        "@shikijs/vscode-textmate": "^10.0.2",
        "oniguruma-to-es": "^4.3.6"
      },
@@ -506,13 +506,13 @@
      }
    },
    "node_modules/@shikijs/engine-oniguruma": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/engine-oniguruma/-/engine-oniguruma-4.2.0.tgz",
-      "integrity": "sha512-hTorK1dffPkpbMUk6Z+828PgRo7d07HbnizoP0hNPFjhxMHctj0Px/qoHeGMYafc6ju+u9iMldN4JbVzNQM++g==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/@shikijs/engine-oniguruma/-/engine-oniguruma-4.1.0.tgz",
+      "integrity": "sha512-axLpjVs45YBvvINa+dJF+NPW+KtFkNXsFr4SDw2BMj9GdeMnGxVB9PQb2xXlJYovslt/nz6giedAyOANkfc7hg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.1.0",
        "@shikijs/vscode-textmate": "^10.0.2"
      },
      "engines": {
@@ -520,26 +520,26 @@
      }
    },
    "node_modules/@shikijs/langs": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/langs/-/langs-4.2.0.tgz",
-      "integrity": "sha512-bwrVRlJ0wUhZxAbVdvBbv2TTC9yLsh4C/IO5Ofz0T8MQntgDvyVnkbjw9vi50r1kx7RCIJdnJnjZAwmAsXFLZQ==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/@shikijs/langs/-/langs-4.1.0.tgz",
+      "integrity": "sha512-nwOMruEkbgdZfQ/b8CgpNBVOpvG1k0N5tbmgiFeqsan401+x3ILqlzZJowSla4Agmq4hG2Uf2wh5jLTEhR8VSg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0"
+        "@shikijs/types": "4.1.0"
      },
      "engines": {
        "node": ">=20"
      }
    },
    "node_modules/@shikijs/primitive": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/primitive/-/primitive-4.2.0.tgz",
-      "integrity": "sha512-NOq+DtUkVBJtZMVXL5A0vI0Xk8nvDYaXetFHSJFlOqjDZIVhIPRYFdGkSoElDqNuegikcc3A76SNUa8dTqtAYA==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/@shikijs/primitive/-/primitive-4.1.0.tgz",
+      "integrity": "sha512-zx2/2Uwj2q9X3KSyYREEhXO23xBw5WUhP4orK2lE4r+t9JGITmEe0JH+wPmJhqHpOT2bRRs6lAL945+LDvOAGw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.1.0",
        "@shikijs/vscode-textmate": "^10.0.2",
        "@types/hast": "^3.0.4"
      },
@@ -548,16 +548,16 @@
      }
    },
    "node_modules/@shikijs/rehype": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/rehype/-/rehype-4.2.0.tgz",
-      "integrity": "sha512-ST3EWye/dwF1gWskczJNBnwFtDzEQ9ceytXZtyc/GfwR5V0qJrkoSGZO55O3SAKDDsXkTDcsfwd9pVe7ROlAHg==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/@shikijs/rehype/-/rehype-4.1.0.tgz",
+      "integrity": "sha512-HQwltCcO2/UiFz44/8whyji4rP1VghLu++MgvQn+lQA8/gvuycGkay8DH8o8VAOvLBDKGOkBEw7cC1Cm33GObQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.1.0",
        "@types/hast": "^3.0.4",
        "hast-util-to-string": "^3.0.1",
-        "shiki": "4.2.0",
+        "shiki": "4.1.0",
        "unified": "^11.0.5",
        "unist-util-visit": "^5.1.0"
      },
@@ -566,22 +566,22 @@
      }
    },
    "node_modules/@shikijs/themes": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/themes/-/themes-4.2.0.tgz",
-      "integrity": "sha512-RX8IHYeLv8Cu2W6ruc3RxUqWn0IYCqSrMBzi/uRGAmfyDNOnNO5BF/Px7o97n4XTpmFTo5GbRaazuOWj+2ak2w==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/@shikijs/themes/-/themes-4.1.0.tgz",
+      "integrity": "sha512-emCcTnUM7yO2wltYbaxm+yLvcCI4+h8XBKc4KmJ7EZUXoSGjcCHifkI//R4OFit9ewpg7H2/9tjOuXrT2v/Knw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0"
+        "@shikijs/types": "4.1.0"
      },
      "engines": {
        "node": ">=20"
      }
    },
    "node_modules/@shikijs/types": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/types/-/types-4.2.0.tgz",
-      "integrity": "sha512-VT/MKtlpOhEPZloSH3Pb9WCZEBDoQVMa9jedp5UAwmJOar1DVc9DRODAxmYPW9M93IK4ryuqRejFfmlvlVDemw==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/@shikijs/types/-/types-4.1.0.tgz",
+      "integrity": "sha512-3EQWX54fMpniOrDblzAhiwiJwpiTMW6+B9DWyUd9ska483tbayFYuw47UxwuPknI31bKnySfVQ/QW+jFL4rFdA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -600,9 +600,9 @@
      "license": "MIT"
    },
    "node_modules/@swc/helpers": {
-      "version": "0.5.23",
-      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.23.tgz",
-      "integrity": "sha512-5lSsMOTXURePglDfvuAQUqkGek9Hg2kksOYay2m0+XR++b2NWYL/4sWyuvVBIs8oKnJaxkdi9whaL/sqN13afw==",
+      "version": "0.5.21",
+      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.21.tgz",
+      "integrity": "sha512-jI/VAmtdjB/RnI8GTnokyX7Ug8c+g+ffD6QRLa6XQewtnGyukKkKSk3wLTM3b5cjt1jNh9x0jfVlagdN2gDKQg==",
      "dev": true,
      "license": "Apache-2.0",
      "dependencies": {
@@ -668,9 +668,9 @@
      }
    },
    "node_modules/@types/mdx": {
-      "version": "2.0.14",
-      "resolved": "https://registry.npmjs.org/@types/mdx/-/mdx-2.0.14.tgz",
-      "integrity": "sha512-T48PeuJtvLosNTPVhfnIp3i/n3a4g4Bad7YCq5k64D4u7NwDrAotikQ+5+sjtUvBmxCMlbo3dVL+C2dP0rWHzg==",
+      "version": "2.0.13",
+      "resolved": "https://registry.npmjs.org/@types/mdx/-/mdx-2.0.13.tgz",
+      "integrity": "sha512-+OWZQfAYyio6YkJb3HLxDrvnx6SWWDbC0zVPfBRzUk0/nqoDyf6dNxQi3eArPe8rJ473nobTMQ/8Zk+LxJ+Yuw==",
      "dev": true,
      "license": "MIT"
    },
@@ -682,9 +682,9 @@
      "license": "MIT"
    },
    "node_modules/@types/react": {
-      "version": "19.2.17",
-      "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.17.tgz",
-      "integrity": "sha512-MXfmqaVPEVgkBT/aY0aGCkRWWtByiYQXo3xdQ8r5RzuFrPiRn8Gar2tQdXSUQ2GKV3bkXckek89V8wQBY2Q/Aw==",
+      "version": "19.2.15",
+      "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.15.tgz",
+      "integrity": "sha512-eRwcGNHve+E8qtEQSSRl6urh+rFop4v8gm6O8rGv25CodbvFdLjA1vVQ1KkiFE0w0UPOnb8tDiFKL5lp0rtY5Q==",
      "dev": true,
      "license": "MIT",
      "peer": true,
@@ -723,9 +723,9 @@
      }
    },
    "node_modules/acorn": {
-      "version": "8.17.0",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.17.0.tgz",
-      "integrity": "sha512-xRQbDb9BnwDafYNn6Vwl839DYVjqXYb1XVGtWAZ1kcDc6iwAL4hg3B1dZlRiuENFeO2H53gFG3in621AdERVAg==",
+      "version": "8.16.0",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.16.0.tgz",
+      "integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==",
      "dev": true,
      "license": "MIT",
      "bin": {
@@ -1821,53 +1821,6 @@
        "url": "https://opencollective.com/unified"
      }
    },
-    "node_modules/mdast-util-to-markdown-cjk-friendly": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/mdast-util-to-markdown-cjk-friendly/-/mdast-util-to-markdown-cjk-friendly-1.0.0.tgz",
-      "integrity": "sha512-BoaAm8mlJ+LAYz0Qs532Y3ciTuQYgBUPZcSFbvC/ZKmEMAKgulw84YvQK1gI34t/vL2euSfuaWlqczkTBgamkw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "mdast-util-to-markdown": "^2.1.2",
-        "micromark-extension-cjk-friendly-util": "3.0.1",
-        "micromark-util-symbol": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "peerDependencies": {
-        "@types/mdast": "*"
-      },
-      "peerDependenciesMeta": {
-        "@types/mdast": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/mdast-util-to-markdown-cjk-friendly-gfm-strikethrough": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/mdast-util-to-markdown-cjk-friendly-gfm-strikethrough/-/mdast-util-to-markdown-cjk-friendly-gfm-strikethrough-1.0.0.tgz",
-      "integrity": "sha512-1ePVfB4P/vz3xSsm6H3D32r6VYGErxclnuLLFK02/2ReF+UdEKm7caulK6Vm0LBIp5gPRtB2Z1OYDznCkX3k2w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "mdast-util-gfm-strikethrough": "^2.0.0",
-        "mdast-util-to-markdown": "^2.1.2",
-        "micromark-extension-cjk-friendly-util": "3.0.1",
-        "micromark-util-symbol": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "peerDependencies": {
-        "@types/mdast": "*"
-      },
-      "peerDependenciesMeta": {
-        "@types/mdast": {
-          "optional": true
-        }
-      }
-    },
    "node_modules/mdast-util-to-string": {
      "version": "4.0.0",
      "resolved": "https://registry.npmjs.org/mdast-util-to-string/-/mdast-util-to-string-4.0.0.tgz",
@@ -2789,9 +2742,9 @@
      }
    },
    "node_modules/property-information": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/property-information/-/property-information-7.2.0.tgz",
-      "integrity": "sha512-IAtzIB6sUiWaJYrX9smp3V46pBGbBeLFRGdh25kg1334VcBlD8HzhPeNIWQH9zhGmo2itIe25EHt9dQP7G5hmg==",
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/property-information/-/property-information-7.1.0.tgz",
+      "integrity": "sha512-TwEZ+X+yCJmYfL7TPUOcvBZ4QfoT5YenQiJuX//0th53DE6w0xxLEtfK3iyryQFddXuvkIk51EEgrJQ0WJkOmQ==",
      "dev": true,
      "license": "MIT",
      "funding": {
@@ -2800,9 +2753,9 @@
      }
    },
    "node_modules/react": {
-      "version": "19.2.7",
-      "resolved": "https://registry.npmjs.org/react/-/react-19.2.7.tgz",
-      "integrity": "sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==",
+      "version": "19.2.6",
+      "resolved": "https://registry.npmjs.org/react/-/react-19.2.6.tgz",
+      "integrity": "sha512-sfWGGfavi0xr8Pg0sVsyHMAOziVYKgPLNrS7ig+ivMNb3wbCBw3KxtflsGBAwD3gYQlE/AEZsTLgToRrSCjb0Q==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -2810,16 +2763,16 @@
      }
    },
    "node_modules/react-dom": {
-      "version": "19.2.7",
-      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.7.tgz",
-      "integrity": "sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ==",
+      "version": "19.2.6",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.6.tgz",
+      "integrity": "sha512-0prMI+hvBbPjsWnxDLxlCGyM8PN6UuWjEUCYmZhO67xIV9Xasa/r/vDnq+Xyq4Lo27g8QSbO5YzARu0D1Sps3g==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "scheduler": "^0.27.0"
      },
      "peerDependencies": {
-        "react": "^19.2.7"
+        "react": "^19.2.6"
      }
    },
    "node_modules/react-lazy-with-preload": {
@@ -2869,9 +2822,9 @@
      }
    },
    "node_modules/react-router": {
-      "version": "7.17.0",
-      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.17.0.tgz",
-      "integrity": "sha512-FDELK7rTMlCHO5+reyXsPlmfr7N1F91lPHsWYfMEGQm/KQ+F4JFM8jGoeQDmDvdTs93Fw9aSilH+uKRb4/jXvQ==",
+      "version": "7.15.1",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.15.1.tgz",
+      "integrity": "sha512-R8rl9HhgikFYoPJymnUtPXWbnDb3oget6lQnfIoupbt61aT9aOhRkDsY2XRhZRyX1Z/8a5sL74fXmFNm3NRK5A==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -2892,13 +2845,13 @@
      }
    },
    "node_modules/react-router-dom": {
-      "version": "7.17.0",
-      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.17.0.tgz",
-      "integrity": "sha512-fyU2yjGups/hE6Xz0I5ZYbVL8Gx29eCjgpHaRaTaVU+OOAdfRX05KsvyRm0GO8YQwOkhpU3MurW1jyMUJn+zSw==",
+      "version": "7.15.1",
+      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.15.1.tgz",
+      "integrity": "sha512-AzF62gjY6U9rkMq4RfP/r2EVtQ7DMfNMjyOp/flLTCrtRylLiK4wT4pSq6O8rOXZ2eXdZYJPEYe+ifomiv+Igg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "react-router": "7.17.0"
+        "react-router": "7.15.1"
      },
      "engines": {
        "node": ">=20.0.0"
@@ -3058,13 +3011,12 @@
      }
    },
    "node_modules/remark-cjk-friendly": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/remark-cjk-friendly/-/remark-cjk-friendly-2.3.1.tgz",
-      "integrity": "sha512-f+pKZRxCRwNEGFBKNRAZAqU91GIK1SAo3ZyFHWRUgC9zcxRR0BXKd6YwqgSsxtW0rNpUDtONj7H5nje2WL3fcA==",
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/remark-cjk-friendly/-/remark-cjk-friendly-2.0.1.tgz",
+      "integrity": "sha512-6WwkoQyZf/4j5k53zdFYrR8Ca+UVn992jXdLUSBDZR4eBpFhKyVxmA4gUHra/5fesjGIxrDhHesNr/sVoiiysA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "mdast-util-to-markdown-cjk-friendly": "1.0.0",
        "micromark-extension-cjk-friendly": "2.0.1"
      },
      "engines": {
@@ -3081,13 +3033,12 @@
      }
    },
    "node_modules/remark-cjk-friendly-gfm-strikethrough": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/remark-cjk-friendly-gfm-strikethrough/-/remark-cjk-friendly-gfm-strikethrough-2.1.0.tgz",
-      "integrity": "sha512-3Kyq2hjY7V7eU8MbVbWW6QQLN81pjJcIvKHvPxr8hZZmcq/9wqm3MJ3iUG34Ch9QTM4WHN+a1JVAVC1fSi5mig==",
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/remark-cjk-friendly-gfm-strikethrough/-/remark-cjk-friendly-gfm-strikethrough-2.0.1.tgz",
+      "integrity": "sha512-pWKj25O2eLXIL1aBupayl1fKhco+Brw8qWUWJPVB9EBzbQNd7nGLj0nLmJpggWsGLR5j5y40PIdjxby9IEYTuA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "mdast-util-to-markdown-cjk-friendly-gfm-strikethrough": "1.0.0",
        "micromark-extension-cjk-friendly-gfm-strikethrough": "2.0.1"
      },
      "engines": {
@@ -3213,18 +3164,18 @@
      "license": "MIT"
    },
    "node_modules/shiki": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/shiki/-/shiki-4.2.0.tgz",
-      "integrity": "sha512-hjNax6o/ylDy9lefQEaSDtzaT3iVNtZ3WmpQnbuQNoG4xvnSKf2kSKbihZVO4JRG1TTMejs7CmNRYlWgAL66pQ==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/shiki/-/shiki-4.1.0.tgz",
+      "integrity": "sha512-l/ABZPUR5v70jI10EzqfMS/I96vjSGv2y0ihUV+WYFzv0EfvW4s54m0Lg8wCrrL+2IkwBzFTuxkZjPf8b2NX9Q==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/core": "4.2.0",
-        "@shikijs/engine-javascript": "4.2.0",
-        "@shikijs/engine-oniguruma": "4.2.0",
-        "@shikijs/langs": "4.2.0",
-        "@shikijs/themes": "4.2.0",
-        "@shikijs/types": "4.2.0",
+        "@shikijs/core": "4.1.0",
+        "@shikijs/engine-javascript": "4.1.0",
+        "@shikijs/engine-oniguruma": "4.1.0",
+        "@shikijs/langs": "4.1.0",
+        "@shikijs/themes": "4.1.0",
+        "@shikijs/types": "4.1.0",
        "@shikijs/vscode-textmate": "^10.0.2",
        "@types/hast": "^3.0.4"
      },
@@ -16,7 +16,7 @@
 };

 #[derive(Debug, Parser)]
-#[command(name = conduwuit_core::BRANDING, version = conduwuit_core::version())]
+#[command(name = conduwuit_core::name(), version = conduwuit_core::version())]
 pub enum AdminCommand {
 	#[command(subcommand)]
 	/// Commands for managing appservices
@@ -1,76 +1,80 @@
 use conduwuit::{Err, Result, checked};
 use futures::{FutureExt, StreamExt, TryFutureExt};

-impl crate::Context<'_> {
-	pub(super) async fn register(&self) -> Result {
-		let body = &self.body;
-		let body_len = self.body.len();
-		if body_len < 2
-			|| !body[0].trim().starts_with("```")
-			|| body.last().unwrap_or(&"").trim() != "```"
-		{
-			return Err!("Expected code block in command body. Add --help for details.");
-		}
+use crate::admin_command;

-		let range = 1..checked!(body_len - 1)?;
-		let appservice_config_body = body[range].join("\n");
-		let parsed_config = serde_saphyr::from_str(&appservice_config_body);
-		match parsed_config {
-			| Err(e) => return Err!("Could not parse appservice config as YAML: {e}"),
-			| Ok(registration) => match self
-				.services
-				.appservice
-				.register_appservice(&registration, &appservice_config_body)
-				.await
-				.map(|()| registration.id)
-			{
-				| Err(e) => return Err!("Failed to register appservice: {e}"),
-				| Ok(id) => write!(self, "Appservice registered with ID: {id}"),
-			},
-		}
-		.await
+#[admin_command]
+pub(super) async fn register(&self) -> Result {
+	let body = &self.body;
+	let body_len = self.body.len();
+	if body_len < 2
+		|| !body[0].trim().starts_with("```")
+		|| body.last().unwrap_or(&"").trim() != "```"
+	{
+		return Err!("Expected code block in command body. Add --help for details.");
 	}

-	pub(super) async fn unregister(&self, appservice_identifier: String) -> Result {
-		match self
+	let range = 1..checked!(body_len - 1)?;
+	let appservice_config_body = body[range].join("\n");
+	let parsed_config = serde_saphyr::from_str(&appservice_config_body);
+	match parsed_config {
+		| Err(e) => return Err!("Could not parse appservice config as YAML: {e}"),
+		| Ok(registration) => match self
 			.services
 			.appservice
-			.unregister_appservice(&appservice_identifier)
+			.register_appservice(&registration, &appservice_config_body)
 			.await
+			.map(|()| registration.id)
 		{
-			| Err(e) => return Err!("Failed to unregister appservice: {e}"),
-			| Ok(()) => write!(self, "Appservice unregistered."),
-		}
-		.await
-	}
-
-	pub(super) async fn show_appservice_config(&self, appservice_identifier: String) -> Result {
-		match self
-			.services
-			.appservice
-			.get_registration(&appservice_identifier)
-			.await
-		{
-			| None => return Err!("Appservice does not exist."),
-			| Some(config) => {
-				let config_str = serde_saphyr::to_string(&config)?;
-				write!(self, "Config for {appservice_identifier}:\n\n```yaml\n{config_str}\n```")
-			},
-		}
-		.await
-	}
-
-	pub(super) async fn list_registered(&self) -> Result {
-		self.services
-			.appservice
-			.iter_ids()
-			.collect()
-			.map(Ok)
-			.and_then(|appservices: Vec<_>| {
-				let len = appservices.len();
-				let list = appservices.join(", ");
-				write!(self, "Appservices ({len}): {list}")
-			})
-			.await
+			| Err(e) => return Err!("Failed to register appservice: {e}"),
+			| Ok(id) => write!(self, "Appservice registered with ID: {id}"),
+		},
 	}
+	.await
+}
+
+#[admin_command]
+pub(super) async fn unregister(&self, appservice_identifier: String) -> Result {
+	match self
+		.services
+		.appservice
+		.unregister_appservice(&appservice_identifier)
+		.await
+	{
+		| Err(e) => return Err!("Failed to unregister appservice: {e}"),
+		| Ok(()) => write!(self, "Appservice unregistered."),
+	}
+	.await
+}
+
+#[admin_command]
+pub(super) async fn show_appservice_config(&self, appservice_identifier: String) -> Result {
+	match self
+		.services
+		.appservice
+		.get_registration(&appservice_identifier)
+		.await
+	{
+		| None => return Err!("Appservice does not exist."),
+		| Some(config) => {
+			let config_str = serde_saphyr::to_string(&config)?;
+			write!(self, "Config for {appservice_identifier}:\n\n```yaml\n{config_str}\n```")
+		},
+	}
+	.await
+}
+
+#[admin_command]
+pub(super) async fn list_registered(&self) -> Result {
+	self.services
+		.appservice
+		.iter_ids()
+		.collect()
+		.map(Ok)
+		.and_then(|appservices: Vec<_>| {
+			let len = appservices.len();
+			let list = appservices.join(", ");
+			write!(self, "Appservices ({len}): {list}")
+		})
+		.await
 }
@@ -1,23 +1,23 @@
 use conduwuit::Result;
+use conduwuit_macros::implement;
 use futures::StreamExt;

 use crate::Context;

-impl Context<'_> {
-	pub(super) async fn check_all_users(&self) -> Result {
-		let timer = tokio::time::Instant::now();
-		let users = self.services.users.stream().collect::<Vec<_>>().await;
-		let query_time = timer.elapsed();
+#[implement(Context, params = "<'_>")]
+pub(super) async fn check_all_users(&self) -> Result {
+	let timer = tokio::time::Instant::now();
+	let users = self.services.users.stream().collect::<Vec<_>>().await;
+	let query_time = timer.elapsed();

-		let total = users.len();
-		let err_count = users.iter().filter(|_user| false).count();
-		let ok_count = users.iter().filter(|_user| true).count();
+	let total = users.len();
+	let err_count = users.iter().filter(|_user| false).count();
+	let ok_count = users.iter().filter(|_user| true).count();

-		self.write_str(&format!(
-			"Database query completed in {query_time:?}:\n\n```\nTotal entries: \
-			 {total:?}\nFailure/Invalid user count: {err_count:?}\nSuccess/Valid user count: \
-			 {ok_count:?}\n```"
-		))
-		.await
-	}
+	self.write_str(&format!(
+		"Database query completed in {query_time:?}:\n\n```\nTotal entries: \
+		 {total:?}\nFailure/Invalid user count: {err_count:?}\nSuccess/Valid user count: \
+		 {ok_count:?}\n```"
+	))
+	.await
 }
@@ -95,14 +95,6 @@ pub enum DebugCommand {
 		room_id: OwnedRoomOrAliasId,
 	},

-	/// Gets all the room state events at the specified event.
-	///
-	/// State at event might not be available for some PDUs, such as rejected
-	/// ones.
-	GetStateAt {
-		event_id: OwnedEventId,
-	},
-
 	/// Get and display signing keys from local cache or remote server.
 	GetSigningKeys {
 		server_name: Option<OwnedServerName>,
@@ -1,6 +1,6 @@
 use conduwuit::{Err, Result};

-use crate::admin_command_dispatch;
+use crate::{admin_command, admin_command_dispatch};

 #[admin_command_dispatch]
 #[derive(Debug, clap::Subcommand)]
@@ -11,32 +11,37 @@ pub enum TesterCommand {
 	Timer,
 }

-impl crate::Context<'_> {
-	#[rustfmt::skip]
-	async fn panic(&self) -> Result {
-		panic!("panicked")
-	}
+#[rustfmt::skip]
+#[admin_command]
+async fn panic(&self) -> Result {

-	#[rustfmt::skip]
-	async fn failure(&self) -> Result {
-		Err!("failed")
-	}
+	panic!("panicked")
+}

-	#[inline(never)]
-	#[rustfmt::skip]
-	async fn tester(&self) -> Result {
-		self.write_str("Ok").await
-	}
+#[rustfmt::skip]
+#[admin_command]
+async fn failure(&self) -> Result {

-	#[inline(never)]
-	#[rustfmt::skip]
-	async fn timer(&self) -> Result {
-		let started = std::time::Instant::now();
-		timed(self.body);
+	Err!("failed")
+}

-		let elapsed = started.elapsed();
-		self.write_str(&format!("completed in {elapsed:#?}")).await
-	}
+#[inline(never)]
+#[rustfmt::skip]
+#[admin_command]
+async fn tester(&self) -> Result {
+
+	self.write_str("Ok").await
+}
+
+#[inline(never)]
+#[rustfmt::skip]
+#[admin_command]
+async fn timer(&self) -> Result {
+	let started = std::time::Instant::now();
+	timed(self.body);
+
+	let elapsed = started.elapsed();
+	self.write_str(&format!("completed in {elapsed:#?}")).await
 }

 #[inline(never)]
@@ -4,131 +4,127 @@
 use futures::StreamExt;
 use ruma::{OwnedRoomId, OwnedServerName, OwnedUserId};

-use crate::get_room_info;
+use crate::{admin_command, get_room_info};

-impl crate::Context<'_> {
-	pub(super) async fn disable_room(&self, room_id: OwnedRoomId) -> Result {
-		self.bail_restricted()?;
-		self.services.rooms.metadata.disable_room(&room_id, true);
-		self.write_str("Room disabled.").await
-	}
+#[admin_command]
+pub(super) async fn disable_room(&self, room_id: OwnedRoomId) -> Result {
+	self.bail_restricted()?;
+	self.services.rooms.metadata.disable_room(&room_id, true);
+	self.write_str("Room disabled.").await
+}

-	pub(super) async fn enable_room(&self, room_id: OwnedRoomId) -> Result {
-		self.bail_restricted()?;
-		self.services.rooms.metadata.disable_room(&room_id, false);
-		self.write_str("Room enabled.").await
-	}
+#[admin_command]
+pub(super) async fn enable_room(&self, room_id: OwnedRoomId) -> Result {
+	self.bail_restricted()?;
+	self.services.rooms.metadata.disable_room(&room_id, false);
+	self.write_str("Room enabled.").await
+}

-	pub(super) async fn incoming_federation(&self) -> Result {
-		let msg = {
-			let map = self
-				.services
-				.rooms
-				.event_handler
-				.federation_handletime
-				.read();
-
-			let mut msg = format!(
-				"Handling {} incoming PDUs across {} active transactions:\n",
-				map.len(),
-				self.services.transactions.txn_active_handle_count()
-			);
-			for (r, (e, i)) in map.iter() {
-				let elapsed = i.elapsed();
-				writeln!(
-					msg,
-					"{} {}: {}m{}s",
-					r,
-					e,
-					elapsed.as_secs() / 60,
-					elapsed.as_secs() % 60
-				)?;
-			}
-			msg
-		};
-
-		self.write_str(&msg).await
-	}
-
-	pub(super) async fn fetch_support_well_known(&self, server_name: OwnedServerName) -> Result {
-		let response = self
-			.services
-			.client
-			.default
-			.get(format!("https://{server_name}/.well-known/matrix/support"))
-			.send()
-			.await?;
-
-		let text = response
-			.limit_read_text(
-				self.services
-					.config
-					.max_request_size
-					.try_into()
-					.expect("u64 fits into usize"),
-			)
-			.await?;
-
-		if text.is_empty() {
-			return Err!("Response text/body is empty.");
-		}
-
-		if text.len() > 1500 {
-			return Err!(
-				"Response text/body is over 1500 characters, assuming no support well-known.",
-			);
-		}
-
-		let json: serde_json::Value = match serde_json::from_str(&text) {
-			| Ok(json) => json,
-			| Err(_) => {
-				return Err!("Response text/body is not valid JSON.",);
-			},
-		};
-
-		let pretty_json: String = match serde_json::to_string_pretty(&json) {
-			| Ok(json) => json,
-			| Err(_) => {
-				return Err!("Response text/body is not valid JSON.",);
-			},
-		};
-
-		self.write_str(&format!("Got JSON response:\n\n```json\n{pretty_json}\n```"))
-			.await
-	}
-
-	pub(super) async fn remote_user_in_rooms(&self, user_id: OwnedUserId) -> Result {
-		if user_id.server_name() == self.services.server.name {
-			return Err!(
-				"User belongs to our server, please use `list-joined-rooms` user admin command \
-				 instead.",
-			);
-		}
-
-		let mut rooms: Vec<(OwnedRoomId, u64, String)> = self
+#[admin_command]
+pub(super) async fn incoming_federation(&self) -> Result {
+	let msg = {
+		let map = self
 			.services
 			.rooms
-			.state_cache
-			.rooms_joined(&user_id)
-			.then(async |room_id| get_room_info(self.services, &room_id).await)
-			.collect()
-			.await;
+			.event_handler
+			.federation_handletime
+			.read();

-		if rooms.is_empty() {
-			return Err!("User is not in any rooms.");
+		let mut msg = format!(
+			"Handling {} incoming PDUs across {} active transactions:\n",
+			map.len(),
+			self.services.transactions.txn_active_handle_count()
+		);
+		for (r, (e, i)) in map.iter() {
+			let elapsed = i.elapsed();
+			writeln!(msg, "{} {}: {}m{}s", r, e, elapsed.as_secs() / 60, elapsed.as_secs() % 60)?;
 		}
+		msg
+	};

-		rooms.sort_by_key(|r| r.1);
-		rooms.reverse();
-
-		let num = rooms.len();
-		let body = rooms
-			.iter()
-			.map(|(id, members, name)| format!("{id} | Members: {members} | Name: {name}"))
-			.collect::<Vec<_>>()
-			.join("\n");
-
-		self.write_str(&format!("Rooms {user_id} shares with us ({num}):\n```\n{body}\n```"))
-			.await
-	}
+	self.write_str(&msg).await
+}
+
+#[admin_command]
+pub(super) async fn fetch_support_well_known(&self, server_name: OwnedServerName) -> Result {
+	let response = self
+		.services
+		.client
+		.default
+		.get(format!("https://{server_name}/.well-known/matrix/support"))
+		.send()
+		.await?;
+
+	let text = response
+		.limit_read_text(
+			self.services
+				.config
+				.max_request_size
+				.try_into()
+				.expect("u64 fits into usize"),
+		)
+		.await?;
+
+	if text.is_empty() {
+		return Err!("Response text/body is empty.");
+	}
+
+	if text.len() > 1500 {
+		return Err!(
+			"Response text/body is over 1500 characters, assuming no support well-known.",
+		);
+	}
+
+	let json: serde_json::Value = match serde_json::from_str(&text) {
+		| Ok(json) => json,
+		| Err(_) => {
+			return Err!("Response text/body is not valid JSON.",);
+		},
+	};
+
+	let pretty_json: String = match serde_json::to_string_pretty(&json) {
+		| Ok(json) => json,
+		| Err(_) => {
+			return Err!("Response text/body is not valid JSON.",);
+		},
+	};
+
+	self.write_str(&format!("Got JSON response:\n\n```json\n{pretty_json}\n```"))
+		.await
+}
+
+#[admin_command]
+pub(super) async fn remote_user_in_rooms(&self, user_id: OwnedUserId) -> Result {
+	if user_id.server_name() == self.services.server.name {
+		return Err!(
+			"User belongs to our server, please use `list-joined-rooms` user admin command \
+			 instead.",
+		);
+	}
+
+	let mut rooms: Vec<(OwnedRoomId, u64, String)> = self
+		.services
+		.rooms
+		.state_cache
+		.rooms_joined(&user_id)
+		.then(async |room_id| get_room_info(self.services, &room_id).await)
+		.collect()
+		.await;
+
+	if rooms.is_empty() {
+		return Err!("User is not in any rooms.");
+	}
+
+	rooms.sort_by_key(|r| r.1);
+	rooms.reverse();
+
+	let num = rooms.len();
+	let body = rooms
+		.iter()
+		.map(|(id, members, name)| format!("{id} | Members: {members} | Name: {name}"))
+		.collect::<Vec<_>>()
+		.join("\n");
+
+	self.write_str(&format!("Rooms {user_id} shares with us ({num}):\n```\n{body}\n```"))
+		.await
 }
@@ -9,403 +9,401 @@
 use ruma::{OwnedEventId, OwnedMxcUri, OwnedServerName};
 use service::media::mxc::Mxc;

-use crate::utils::parse_local_user_id;
+use crate::{admin_command, utils::parse_local_user_id};

-impl crate::Context<'_> {
-	pub(super) async fn delete(
-		&self,
-		mxc: Option<OwnedMxcUri>,
-		event_id: Option<OwnedEventId>,
-	) -> Result {
-		self.bail_restricted()?;
+#[admin_command]
+pub(super) async fn delete(
+	&self,
+	mxc: Option<OwnedMxcUri>,
+	event_id: Option<OwnedEventId>,
+) -> Result {
+	self.bail_restricted()?;

-		if event_id.is_some() && mxc.is_some() {
-			return Err!("Please specify either an MXC or an event ID, not both.",);
-		}
+	if event_id.is_some() && mxc.is_some() {
+		return Err!("Please specify either an MXC or an event ID, not both.",);
+	}

-		if let Some(mxc) = mxc {
-			trace!("Got MXC URL: {mxc}");
-			self.services
-				.media
-				.delete(&mxc.as_str().try_into()?)
-				.await?;
+	if let Some(mxc) = mxc {
+		trace!("Got MXC URL: {mxc}");
+		self.services
+			.media
+			.delete(&mxc.as_str().try_into()?)
+			.await?;

-			return self
-				.write_str("Deleted the MXC from our database and on our filesystem.")
-				.await;
-		}
+		return self
+			.write_str("Deleted the MXC from our database and on our filesystem.")
+			.await;
+	}

-		if let Some(event_id) = event_id {
-			trace!("Got event ID to delete media from: {event_id}");
+	if let Some(event_id) = event_id {
+		trace!("Got event ID to delete media from: {event_id}");

-			let mut mxc_urls = Vec::with_capacity(4);
+		let mut mxc_urls = Vec::with_capacity(4);

-			// parsing the PDU for any MXC URLs begins here
-			match self.services.rooms.timeline.get_pdu_json(&event_id).await {
-				| Ok(event_json) => {
-					if let Some(content_key) = event_json.get("content") {
-						debug!("Event ID has \"content\".");
-						let content_obj = content_key.as_object();
+		// parsing the PDU for any MXC URLs begins here
+		match self.services.rooms.timeline.get_pdu_json(&event_id).await {
+			| Ok(event_json) => {
+				if let Some(content_key) = event_json.get("content") {
+					debug!("Event ID has \"content\".");
+					let content_obj = content_key.as_object();

-						if let Some(content) = content_obj {
-							// 1. attempts to parse the "url" key
-							debug!("Attempting to go into \"url\" key for main media file");
-							if let Some(url) = content.get("url") {
-								debug!("Got a URL in the event ID {event_id}: {url}");
+					if let Some(content) = content_obj {
+						// 1. attempts to parse the "url" key
+						debug!("Attempting to go into \"url\" key for main media file");
+						if let Some(url) = content.get("url") {
+							debug!("Got a URL in the event ID {event_id}: {url}");

-								if url.to_string().starts_with("\"mxc://") {
-									debug!("Pushing URL {url} to list of MXCs to delete");
-									let final_url = url.to_string().replace('"', "");
-									mxc_urls.push(final_url);
+							if url.to_string().starts_with("\"mxc://") {
+								debug!("Pushing URL {url} to list of MXCs to delete");
+								let final_url = url.to_string().replace('"', "");
+								mxc_urls.push(final_url);
+							} else {
+								info!(
+									"Found a URL in the event ID {event_id} but did not start \
+									 with mxc://, ignoring"
+								);
+							}
+						}
+
+						// 2. attempts to parse the "info" key
+						debug!("Attempting to go into \"info\" key for thumbnails");
+						if let Some(info_key) = content.get("info") {
+							debug!("Event ID has \"info\".");
+							let info_obj = info_key.as_object();
+
+							if let Some(info) = info_obj {
+								if let Some(thumbnail_url) = info.get("thumbnail_url") {
+									debug!("Found a thumbnail_url in info key: {thumbnail_url}");
+
+									if thumbnail_url.to_string().starts_with("\"mxc://") {
+										debug!(
+											"Pushing thumbnail URL {thumbnail_url} to list of \
+											 MXCs to delete"
+										);
+										let final_thumbnail_url =
+											thumbnail_url.to_string().replace('"', "");
+										mxc_urls.push(final_thumbnail_url);
+									} else {
+										info!(
+											"Found a thumbnail URL in the event ID {event_id} \
+											 but did not start with mxc://, ignoring"
+										);
+									}
 								} else {
 									info!(
-										"Found a URL in the event ID {event_id} but did not \
-										 start with mxc://, ignoring"
+										"No \"thumbnail_url\" key in \"info\" key, assuming no \
+										 thumbnails."
 									);
 								}
 							}
+						}

-							// 2. attempts to parse the "info" key
-							debug!("Attempting to go into \"info\" key for thumbnails");
-							if let Some(info_key) = content.get("info") {
-								debug!("Event ID has \"info\".");
-								let info_obj = info_key.as_object();
+						// 3. attempts to parse the "file" key
+						debug!("Attempting to go into \"file\" key");
+						if let Some(file_key) = content.get("file") {
+							debug!("Event ID has \"file\".");
+							let file_obj = file_key.as_object();

-								if let Some(info) = info_obj {
-									if let Some(thumbnail_url) = info.get("thumbnail_url") {
-										debug!(
-											"Found a thumbnail_url in info key: {thumbnail_url}"
-										);
+							if let Some(file) = file_obj {
+								if let Some(url) = file.get("url") {
+									debug!("Found url in file key: {url}");

-										if thumbnail_url.to_string().starts_with("\"mxc://") {
-											debug!(
-												"Pushing thumbnail URL {thumbnail_url} to list \
-												 of MXCs to delete"
-											);
-											let final_thumbnail_url =
-												thumbnail_url.to_string().replace('"', "");
-											mxc_urls.push(final_thumbnail_url);
-										} else {
-											info!(
-												"Found a thumbnail URL in the event ID \
-												 {event_id} but did not start with mxc://, \
-												 ignoring"
-											);
-										}
+									if url.to_string().starts_with("\"mxc://") {
+										debug!("Pushing URL {url} to list of MXCs to delete");
+										let final_url = url.to_string().replace('"', "");
+										mxc_urls.push(final_url);
 									} else {
-										info!(
-											"No \"thumbnail_url\" key in \"info\" key, assuming \
-											 no thumbnails."
+										warn!(
+											"Found a URL in the event ID {event_id} but did not \
+											 start with mxc://, ignoring"
 										);
 									}
+								} else {
+									error!("No \"url\" key in \"file\" key.");
 								}
 							}
-
-							// 3. attempts to parse the "file" key
-							debug!("Attempting to go into \"file\" key");
-							if let Some(file_key) = content.get("file") {
-								debug!("Event ID has \"file\".");
-								let file_obj = file_key.as_object();
-
-								if let Some(file) = file_obj {
-									if let Some(url) = file.get("url") {
-										debug!("Found url in file key: {url}");
-
-										if url.to_string().starts_with("\"mxc://") {
-											debug!("Pushing URL {url} to list of MXCs to delete");
-											let final_url = url.to_string().replace('"', "");
-											mxc_urls.push(final_url);
-										} else {
-											warn!(
-												"Found a URL in the event ID {event_id} but did \
-												 not start with mxc://, ignoring"
-											);
-										}
-									} else {
-										error!("No \"url\" key in \"file\" key.");
-									}
-								}
-							}
-						} else {
-							return Err!(
-								"Event ID does not have a \"content\" key or failed parsing the \
-								 event ID JSON.",
-							);
 						}
 					} else {
 						return Err!(
-							"Event ID does not have a \"content\" key, this is not a message or \
-							 an event type that contains media.",
+							"Event ID does not have a \"content\" key or failed parsing the \
+							 event ID JSON.",
 						);
 					}
-				},
-				| _ => {
-					return Err!("Event ID does not exist or is not known to us.",);
-				},
-			}
-
-			if mxc_urls.is_empty() {
-				return Err!("Parsed event ID but found no MXC URLs.",);
-			}
-
-			let mut mxc_deletion_count: usize = 0;
-
-			for mxc_url in mxc_urls {
-				match self
-					.services
-					.media
-					.delete(&mxc_url.as_str().try_into()?)
-					.await
-				{
-					| Ok(()) => {
-						debug_info!(
-							"Successfully deleted {mxc_url} from filesystem and database"
-						);
-						mxc_deletion_count = mxc_deletion_count.saturating_add(1);
-					},
-					| Err(e) => {
-						debug_warn!(
-							"Failed to delete {mxc_url}, ignoring error and skipping: {e}"
-						);
-						continue;
-					},
+				} else {
+					return Err!(
+						"Event ID does not have a \"content\" key, this is not a message or an \
+						 event type that contains media.",
+					);
 				}
-			}
-
-			return self
-				.write_str(&format!(
-					"Deleted {mxc_deletion_count} total MXCs from our database and the \
-					 filesystem from event ID {event_id}."
-				))
-				.await;
+			},
+			| _ => {
+				return Err!("Event ID does not exist or is not known to us.",);
+			},
 		}

-		Err!(
-			"Please specify either an MXC using --mxc or an event ID using --event-id of the \
-			 message containing an image. See --help for details."
-		)
-	}
-
-	pub(super) async fn delete_list(&self) -> Result {
-		self.bail_restricted()?;
-
-		if self.body.len() < 2
-			|| !self.body[0].trim().starts_with("```")
-			|| self.body.last().unwrap_or(&"").trim() != "```"
-		{
-			return Err!("Expected code block in command body. Add --help for details.",);
+		if mxc_urls.is_empty() {
+			return Err!("Parsed event ID but found no MXC URLs.",);
 		}

-		let mut failed_parsed_mxcs: usize = 0;
-
-		let mxc_list = self
-			.body
-			.to_vec()
-			.drain(1..self.body.len().checked_sub(1).unwrap())
-			.filter_map(|mxc_s| {
-				mxc_s
-					.try_into()
-					.inspect_err(|e| {
-						debug_warn!("Failed to parse user-provided MXC URI: {e}");
-						failed_parsed_mxcs = failed_parsed_mxcs.saturating_add(1);
-					})
-					.ok()
-			})
-			.collect::<Vec<Mxc<'_>>>();
-
 		let mut mxc_deletion_count: usize = 0;

-		for mxc in &mxc_list {
-			trace!(%failed_parsed_mxcs, %mxc_deletion_count, "Deleting MXC {mxc} in bulk");
-			match self.services.media.delete(mxc).await {
+		for mxc_url in mxc_urls {
+			match self
+				.services
+				.media
+				.delete(&mxc_url.as_str().try_into()?)
+				.await
+			{
 				| Ok(()) => {
-					debug_info!("Successfully deleted {mxc} from filesystem and database");
+					debug_info!("Successfully deleted {mxc_url} from filesystem and database");
 					mxc_deletion_count = mxc_deletion_count.saturating_add(1);
 				},
 				| Err(e) => {
-					debug_warn!("Failed to delete {mxc}, ignoring error and skipping: {e}");
+					debug_warn!("Failed to delete {mxc_url}, ignoring error and skipping: {e}");
 					continue;
 				},
 			}
 		}

-		self.write_str(&format!(
-			"Finished bulk MXC deletion, deleted {mxc_deletion_count} total MXCs from our \
-			 database and the filesystem. {failed_parsed_mxcs} MXCs failed to be parsed from \
-			 the database.",
-		))
-		.await
+		return self
+			.write_str(&format!(
+				"Deleted {mxc_deletion_count} total MXCs from our database and the filesystem \
+				 from event ID {event_id}."
+			))
+			.await;
 	}

-	pub(super) async fn delete_past_remote_media(
-		&self,
-		duration: String,
-		before: bool,
-		after: bool,
-		yes_i_want_to_delete_local_media: bool,
-	) -> Result {
-		self.bail_restricted()?;
-
-		if before && after {
-			return Err!("Please only pick one argument, --before or --after.",);
-		}
-		assert!(!(before && after), "--before and --after should not be specified together");
-
-		let direction = if after {
-			TimeDirection::After
-		} else {
-			TimeDirection::Before
-		};
-
-		let time_boundary = parse_timepoint_ago(&duration)?;
-		let deleted_count = self
-			.services
-			.media
-			.delete_all_media_within_timeframe(
-				time_boundary,
-				direction,
-				yes_i_want_to_delete_local_media,
-			)
-			.await?;
-
-		self.write_str(&format!("Deleted {deleted_count} total files."))
-			.await
-	}
-
-	pub(super) async fn delete_all_from_user(&self, username: String) -> Result {
-		let user_id = parse_local_user_id(self.services, &username)?;
-
-		let deleted_count = self.services.media.delete_from_user(&user_id).await?;
-
-		self.write_str(&format!("Deleted {deleted_count} total files."))
-			.await
-	}
-
-	pub(super) async fn delete_all_from_server(
-		&self,
-		server_name: OwnedServerName,
-		yes_i_want_to_delete_local_media: bool,
-	) -> Result {
-		self.bail_restricted()?;
-
-		if server_name == self.services.globals.server_name() && !yes_i_want_to_delete_local_media
-		{
-			return Err!("This command only works for remote media by default.",);
-		}
-
-		let Ok(all_mxcs) = self
-			.services
-			.media
-			.get_all_mxcs()
-			.await
-			.inspect_err(|e| error!("Failed to get MXC URIs from our database: {e}"))
-		else {
-			return Err!("Failed to get MXC URIs from our database",);
-		};
-
-		let mut deleted_count: usize = 0;
-
-		for mxc in all_mxcs {
-			let Ok(mxc_server_name) = mxc.server_name().inspect_err(|e| {
-				debug_warn!(
-					"Failed to parse MXC {mxc} server name from database, ignoring error and \
-					 skipping: {e}"
-				);
-			}) else {
-				continue;
-			};
-
-			if mxc_server_name != server_name
-				|| (self.services.globals.server_is_ours(mxc_server_name)
-					&& !yes_i_want_to_delete_local_media)
-			{
-				trace!("skipping MXC URI {mxc}");
-				continue;
-			}
-
-			let mxc: Mxc<'_> = mxc.as_str().try_into()?;
-
-			match self.services.media.delete(&mxc).await {
-				| Ok(()) => {
-					deleted_count = deleted_count.saturating_add(1);
-				},
-				| Err(e) => {
-					debug_warn!("Failed to delete {mxc}, ignoring error and skipping: {e}");
-					continue;
-				},
-			}
-		}
-
-		self.write_str(&format!("Deleted {deleted_count} total files."))
-			.await
-	}
-
-	pub(super) async fn get_file_info(&self, mxc: OwnedMxcUri) -> Result {
-		let mxc: Mxc<'_> = mxc.as_str().try_into()?;
-		let metadata = self.services.media.get_metadata(&mxc).await;
-
-		self.write_str(&format!("```\n{metadata:#?}\n```")).await
-	}
-
-	pub(super) async fn get_remote_file(
-		&self,
-		mxc: OwnedMxcUri,
-		server: Option<OwnedServerName>,
-		timeout: u32,
-	) -> Result {
-		let mxc: Mxc<'_> = mxc.as_str().try_into()?;
-		let timeout = Duration::from_millis(timeout.into());
-		let mut result = self
-			.services
-			.media
-			.fetch_remote_content(&mxc, None, server.as_deref(), timeout)
-			.await?;
-
-		// Grab the length of the content before clearing it to not flood the output
-		let len = result.content.as_ref().expect("content").len();
-		result.content.as_mut().expect("content").clear();
-
-		self.write_str(&format!("```\n{result:#?}\nreceived {len} bytes for file content.\n```"))
-			.await
-	}
-
-	pub(super) async fn get_remote_thumbnail(
-		&self,
-		mxc: OwnedMxcUri,
-		server: Option<OwnedServerName>,
-		timeout: u32,
-		width: u32,
-		height: u32,
-	) -> Result {
-		let mxc: Mxc<'_> = mxc.as_str().try_into()?;
-		let timeout = Duration::from_millis(timeout.into());
-		let dim = Dim::new(width, height, None);
-		let mut result = self
-			.services
-			.media
-			.fetch_remote_thumbnail(&mxc, None, server.as_deref(), timeout, &dim)
-			.await?;
-
-		// Grab the length of the content before clearing it to not flood the output
-		let len = result.content.as_ref().expect("content").len();
-		result.content.as_mut().expect("content").clear();
-
-		self.write_str(&format!("```\n{result:#?}\nreceived {len} bytes for file content.\n```"))
-			.await
-	}
-
-	pub(super) async fn delete_url_preview(&self, url: Option<String>, all: bool) -> Result {
-		if all {
-			self.services.media.clear_url_previews().await;
-
-			return self.write_str("Deleted all cached URL previews.").await;
-		}
-
-		let url = url.expect("clap enforces url is required unless --all");
-
-		self.services.media.remove_url_preview(&url).await?;
-
-		self.write_str(&format!("Deleted cached URL preview for: {url}"))
-			.await
-	}
+	Err!(
+		"Please specify either an MXC using --mxc or an event ID using --event-id of the \
+		 message containing an image. See --help for details."
+	)
+}
+
+#[admin_command]
+pub(super) async fn delete_list(&self) -> Result {
+	self.bail_restricted()?;
+
+	if self.body.len() < 2
+		|| !self.body[0].trim().starts_with("```")
+		|| self.body.last().unwrap_or(&"").trim() != "```"
+	{
+		return Err!("Expected code block in command body. Add --help for details.",);
+	}
+
+	let mut failed_parsed_mxcs: usize = 0;
+
+	let mxc_list = self
+		.body
+		.to_vec()
+		.drain(1..self.body.len().checked_sub(1).unwrap())
+		.filter_map(|mxc_s| {
+			mxc_s
+				.try_into()
+				.inspect_err(|e| {
+					debug_warn!("Failed to parse user-provided MXC URI: {e}");
+					failed_parsed_mxcs = failed_parsed_mxcs.saturating_add(1);
+				})
+				.ok()
+		})
+		.collect::<Vec<Mxc<'_>>>();
+
+	let mut mxc_deletion_count: usize = 0;
+
+	for mxc in &mxc_list {
+		trace!(%failed_parsed_mxcs, %mxc_deletion_count, "Deleting MXC {mxc} in bulk");
+		match self.services.media.delete(mxc).await {
+			| Ok(()) => {
+				debug_info!("Successfully deleted {mxc} from filesystem and database");
+				mxc_deletion_count = mxc_deletion_count.saturating_add(1);
+			},
+			| Err(e) => {
+				debug_warn!("Failed to delete {mxc}, ignoring error and skipping: {e}");
+				continue;
+			},
+		}
+	}
+
+	self.write_str(&format!(
+		"Finished bulk MXC deletion, deleted {mxc_deletion_count} total MXCs from our database \
+		 and the filesystem. {failed_parsed_mxcs} MXCs failed to be parsed from the database.",
+	))
+	.await
+}
+
+#[admin_command]
+pub(super) async fn delete_past_remote_media(
+	&self,
+	duration: String,
+	before: bool,
+	after: bool,
+	yes_i_want_to_delete_local_media: bool,
+) -> Result {
+	self.bail_restricted()?;
+
+	if before && after {
+		return Err!("Please only pick one argument, --before or --after.",);
+	}
+	assert!(!(before && after), "--before and --after should not be specified together");
+
+	let direction = if after {
+		TimeDirection::After
+	} else {
+		TimeDirection::Before
+	};
+
+	let time_boundary = parse_timepoint_ago(&duration)?;
+	let deleted_count = self
+		.services
+		.media
+		.delete_all_media_within_timeframe(
+			time_boundary,
+			direction,
+			yes_i_want_to_delete_local_media,
+		)
+		.await?;
+
+	self.write_str(&format!("Deleted {deleted_count} total files."))
+		.await
+}
+
+#[admin_command]
+pub(super) async fn delete_all_from_user(&self, username: String) -> Result {
+	let user_id = parse_local_user_id(self.services, &username)?;
+
+	let deleted_count = self.services.media.delete_from_user(&user_id).await?;
+
+	self.write_str(&format!("Deleted {deleted_count} total files."))
+		.await
+}
+
+#[admin_command]
+pub(super) async fn delete_all_from_server(
+	&self,
+	server_name: OwnedServerName,
+	yes_i_want_to_delete_local_media: bool,
+) -> Result {
+	self.bail_restricted()?;
+
+	if server_name == self.services.globals.server_name() && !yes_i_want_to_delete_local_media {
+		return Err!("This command only works for remote media by default.",);
+	}
+
+	let Ok(all_mxcs) = self
+		.services
+		.media
+		.get_all_mxcs()
+		.await
+		.inspect_err(|e| error!("Failed to get MXC URIs from our database: {e}"))
+	else {
+		return Err!("Failed to get MXC URIs from our database",);
+	};
+
+	let mut deleted_count: usize = 0;
+
+	for mxc in all_mxcs {
+		let Ok(mxc_server_name) = mxc.server_name().inspect_err(|e| {
+			debug_warn!(
+				"Failed to parse MXC {mxc} server name from database, ignoring error and \
+				 skipping: {e}"
+			);
+		}) else {
+			continue;
+		};
+
+		if mxc_server_name != server_name
+			|| (self.services.globals.server_is_ours(mxc_server_name)
+				&& !yes_i_want_to_delete_local_media)
+		{
+			trace!("skipping MXC URI {mxc}");
+			continue;
+		}
+
+		let mxc: Mxc<'_> = mxc.as_str().try_into()?;
+
+		match self.services.media.delete(&mxc).await {
+			| Ok(()) => {
+				deleted_count = deleted_count.saturating_add(1);
+			},
+			| Err(e) => {
+				debug_warn!("Failed to delete {mxc}, ignoring error and skipping: {e}");
+				continue;
+			},
+		}
+	}
+
+	self.write_str(&format!("Deleted {deleted_count} total files."))
+		.await
+}
+
+#[admin_command]
+pub(super) async fn get_file_info(&self, mxc: OwnedMxcUri) -> Result {
+	let mxc: Mxc<'_> = mxc.as_str().try_into()?;
+	let metadata = self.services.media.get_metadata(&mxc).await;
+
+	self.write_str(&format!("```\n{metadata:#?}\n```")).await
+}
+
+#[admin_command]
+pub(super) async fn get_remote_file(
+	&self,
+	mxc: OwnedMxcUri,
+	server: Option<OwnedServerName>,
+	timeout: u32,
+) -> Result {
+	let mxc: Mxc<'_> = mxc.as_str().try_into()?;
+	let timeout = Duration::from_millis(timeout.into());
+	let mut result = self
+		.services
+		.media
+		.fetch_remote_content(&mxc, None, server.as_deref(), timeout)
+		.await?;
+
+	// Grab the length of the content before clearing it to not flood the output
+	let len = result.content.as_ref().expect("content").len();
+	result.content.as_mut().expect("content").clear();
+
+	self.write_str(&format!("```\n{result:#?}\nreceived {len} bytes for file content.\n```"))
+		.await
+}
+
+#[admin_command]
+pub(super) async fn get_remote_thumbnail(
+	&self,
+	mxc: OwnedMxcUri,
+	server: Option<OwnedServerName>,
+	timeout: u32,
+	width: u32,
+	height: u32,
+) -> Result {
+	let mxc: Mxc<'_> = mxc.as_str().try_into()?;
+	let timeout = Duration::from_millis(timeout.into());
+	let dim = Dim::new(width, height, None);
+	let mut result = self
+		.services
+		.media
+		.fetch_remote_thumbnail(&mxc, None, server.as_deref(), timeout, &dim)
+		.await?;
+
+	// Grab the length of the content before clearing it to not flood the output
+	let len = result.content.as_ref().expect("content").len();
+	result.content.as_mut().expect("content").clear();
+
+	self.write_str(&format!("```\n{result:#?}\nreceived {len} bytes for file content.\n```"))
+		.await
+}
+
+#[admin_command]
+pub(super) async fn delete_url_preview(&self, url: Option<String>, all: bool) -> Result {
+	if all {
+		self.services.media.clear_url_previews().await;
+
+		return self.write_str("Deleted all cached URL previews.").await;
+	}
+
+	let url = url.expect("clap enforces url is required unless --all");
+
+	self.services.media.remove_url_preview(&url).await?;
+
+	self.write_str(&format!("Deleted cached URL preview for: {url}"))
+		.await
 }
@@ -26,7 +26,7 @@
 extern crate conduwuit_core as conduwuit;
 extern crate conduwuit_service as service;

-pub(crate) use conduwuit_macros::admin_command_dispatch;
+pub(crate) use conduwuit_macros::{admin_command, admin_command_dispatch};

 pub(crate) use crate::{context::Context, utils::get_room_info};

@@ -4,7 +4,7 @@
 use futures::StreamExt;
 use ruma::{OwnedRoomId, OwnedUserId, exports::serde::Serialize};

-use crate::admin_command_dispatch;
+use crate::{admin_command, admin_command_dispatch};

 #[admin_command_dispatch]
 #[derive(Debug, Subcommand)]
@@ -31,50 +31,50 @@ pub enum AccountDataCommand {
 	},
 }

-impl crate::Context<'_> {
-	async fn changes_since(
-		&self,
-		user_id: OwnedUserId,
-		since: u64,
-		room_id: Option<OwnedRoomId>,
-	) -> Result {
-		let timer = tokio::time::Instant::now();
-		let results: Vec<_> = self
-			.services
-			.account_data
-			.changes_since(room_id.as_deref(), &user_id, Some(since), None)
-			.collect()
-			.await;
-		let query_time = timer.elapsed();
+#[admin_command]
+async fn changes_since(
+	&self,
+	user_id: OwnedUserId,
+	since: u64,
+	room_id: Option<OwnedRoomId>,
+) -> Result {
+	let timer = tokio::time::Instant::now();
+	let results: Vec<_> = self
+		.services
+		.account_data
+		.changes_since(room_id.as_deref(), &user_id, Some(since), None)
+		.collect()
+		.await;
+	let query_time = timer.elapsed();

-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{results:#?}\n```"))
-			.await
-	}
-
-	async fn account_data_get(
-		&self,
-		user_id: OwnedUserId,
-		kind: String,
-		room_id: Option<OwnedRoomId>,
-	) -> Result {
-		let timer = tokio::time::Instant::now();
-		let result = self
-			.services
-			.account_data
-			.get_raw(room_id.as_deref(), &user_id, &kind)
-			.await;
-		let query_time = timer.elapsed();
-
-		let json = serde_json::to_string_pretty(&match room_id {
-			| None => result
-				.deserialized::<ruma::serde::Raw<ruma::events::AnyGlobalAccountDataEvent>>()?
-				.serialize(serde_json::value::Serializer)?,
-			| Some(_) => result
-				.deserialized::<ruma::serde::Raw<ruma::events::AnyRoomAccountDataEvent>>()?
-				.serialize(serde_json::value::Serializer)?,
-		})?;
-
-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{json}\n```"))
-			.await
-	}
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{results:#?}\n```"))
+		.await
+}
+
+#[admin_command]
+async fn account_data_get(
+	&self,
+	user_id: OwnedUserId,
+	kind: String,
+	room_id: Option<OwnedRoomId>,
+) -> Result {
+	let timer = tokio::time::Instant::now();
+	let result = self
+		.services
+		.account_data
+		.get_raw(room_id.as_deref(), &user_id, &kind)
+		.await;
+	let query_time = timer.elapsed();
+
+	let json = serde_json::to_string_pretty(&match room_id {
+		| None => result
+			.deserialized::<ruma::serde::Raw<ruma::events::AnyGlobalAccountDataEvent>>()?
+			.serialize(serde_json::value::Serializer)?,
+		| Some(_) => result
+			.deserialized::<ruma::serde::Raw<ruma::events::AnyRoomAccountDataEvent>>()?
+			.serialize(serde_json::value::Serializer)?,
+	})?;
+
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{json}\n```"))
+		.await
 }
@@ -13,7 +13,7 @@
 use futures::{FutureExt, Stream, StreamExt, TryStreamExt};
 use tokio::time::Instant;

-use crate::admin_command_dispatch;
+use crate::{admin_command, admin_command_dispatch};

 #[admin_command_dispatch]
 #[derive(Debug, Subcommand)]
@@ -159,287 +159,279 @@ pub enum RawCommand {
 	},
 }

-impl crate::Context<'_> {
-	pub(super) async fn compact(
-		&self,
-		map: Option<Vec<String>>,
-		start: Option<String>,
-		stop: Option<String>,
-		from: Option<usize>,
-		into: Option<usize>,
-		parallelism: Option<usize>,
-		exhaustive: bool,
-	) -> Result {
-		use conduwuit_database::compact::Options;
+#[admin_command]
+pub(super) async fn compact(
+	&self,
+	map: Option<Vec<String>>,
+	start: Option<String>,
+	stop: Option<String>,
+	from: Option<usize>,
+	into: Option<usize>,
+	parallelism: Option<usize>,
+	exhaustive: bool,
+) -> Result {
+	use conduwuit_database::compact::Options;

-		let default_all_maps: Option<_> = map.is_none().then(|| {
-			self.services
-				.db
-				.keys()
-				.map(Deref::deref)
-				.map(ToOwned::to_owned)
-		});
+	let default_all_maps: Option<_> = map.is_none().then(|| {
+		self.services
+			.db
+			.keys()
+			.map(Deref::deref)
+			.map(ToOwned::to_owned)
+	});

-		let maps: Vec<_> = map
-			.unwrap_or_default()
-			.into_iter()
-			.chain(default_all_maps.into_iter().flatten())
-			.map(|map| self.services.db.get(&map))
-			.filter_map(Result::ok)
-			.cloned()
-			.collect();
+	let maps: Vec<_> = map
+		.unwrap_or_default()
+		.into_iter()
+		.chain(default_all_maps.into_iter().flatten())
+		.map(|map| self.services.db.get(&map))
+		.filter_map(Result::ok)
+		.cloned()
+		.collect();

-		if maps.is_empty() {
-			return Err!("--map argument invalid. not found in database");
-		}
-
-		let range = (
-			start.as_ref().map(String::as_bytes).map(Into::into),
-			stop.as_ref().map(String::as_bytes).map(Into::into),
-		);
-
-		let options = Options {
-			range,
-			level: (from, into),
-			exclusive: parallelism.is_some_and(is_zero!()),
-			exhaustive,
-		};
-
-		let runtime = self.services.server.runtime().clone();
-		let parallelism = parallelism.unwrap_or(1);
-		let results = maps
-			.into_iter()
-			.try_stream::<conduwuit::Error>()
-			.paralleln_and_then(runtime, parallelism, move |map| {
-				map.compact_blocking(options.clone())?;
-				Ok(map.name().to_owned())
-			})
-			.collect::<Vec<_>>();
-
-		let timer = Instant::now();
-		let results = results.await;
-		let query_time = timer.elapsed();
-		self.write_str(&format!("Jobs completed in {query_time:?}:\n\n```rs\n{results:#?}\n```"))
-			.await
+	if maps.is_empty() {
+		return Err!("--map argument invalid. not found in database");
 	}

-	pub(super) async fn raw_count(&self, map: Option<String>, prefix: Option<String>) -> Result {
-		let prefix = prefix.as_deref().unwrap_or(EMPTY);
+	let range = (
+		start.as_ref().map(String::as_bytes).map(Into::into),
+		stop.as_ref().map(String::as_bytes).map(Into::into),
+	);

-		let timer = Instant::now();
-		let count = with_maps_or(map.as_deref(), self.services)
-			.then(|map| map.raw_count_prefix(&prefix))
-			.ready_fold(0_usize, usize::saturating_add)
-			.await;
+	let options = Options {
+		range,
+		level: (from, into),
+		exclusive: parallelism.is_some_and(is_zero!()),
+		exhaustive,
+	};

-		let query_time = timer.elapsed();
-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{count:#?}\n```"))
-			.await
-	}
+	let runtime = self.services.server.runtime().clone();
+	let parallelism = parallelism.unwrap_or(1);
+	let results = maps
+		.into_iter()
+		.try_stream::<conduwuit::Error>()
+		.paralleln_and_then(runtime, parallelism, move |map| {
+			map.compact_blocking(options.clone())?;
+			Ok(map.name().to_owned())
+		})
+		.collect::<Vec<_>>();

-	pub(super) async fn raw_keys(&self, map: String, prefix: Option<String>) -> Result {
-		writeln!(self, "```").boxed().await?;
+	let timer = Instant::now();
+	let results = results.await;
+	let query_time = timer.elapsed();
+	self.write_str(&format!("Jobs completed in {query_time:?}:\n\n```rs\n{results:#?}\n```"))
+		.await
+}

-		let map = self.services.db.get(map.as_str())?;
-		let timer = Instant::now();
-		prefix
-			.as_deref()
-			.map_or_else(|| map.raw_keys().boxed(), |prefix| map.raw_keys_prefix(prefix).boxed())
-			.map_ok(String::from_utf8_lossy)
-			.try_for_each(|str| writeln!(self, "{str:?}"))
-			.boxed()
-			.await?;
+#[admin_command]
+pub(super) async fn raw_count(&self, map: Option<String>, prefix: Option<String>) -> Result {
+	let prefix = prefix.as_deref().unwrap_or(EMPTY);

-		let query_time = timer.elapsed();
-		self.write_str(&format!("\n```\n\nQuery completed in {query_time:?}"))
-			.await
-	}
+	let timer = Instant::now();
+	let count = with_maps_or(map.as_deref(), self.services)
+		.then(|map| map.raw_count_prefix(&prefix))
+		.ready_fold(0_usize, usize::saturating_add)
+		.await;

-	pub(super) async fn raw_keys_sizes(
-		&self,
-		map: Option<String>,
-		prefix: Option<String>,
-	) -> Result {
-		let prefix = prefix.as_deref().unwrap_or(EMPTY);
+	let query_time = timer.elapsed();
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{count:#?}\n```"))
+		.await
+}

-		let timer = Instant::now();
-		let result = with_maps_or(map.as_deref(), self.services)
-			.map(|map| map.raw_keys_prefix(&prefix))
-			.flatten()
-			.ignore_err()
-			.map(<[u8]>::len)
-			.ready_fold_default(|mut map: BTreeMap<_, usize>, len| {
-				let entry = map.entry(len).or_default();
-				*entry = entry.saturating_add(1);
-				map
-			})
-			.await;
+#[admin_command]
+pub(super) async fn raw_keys(&self, map: String, prefix: Option<String>) -> Result {
+	writeln!(self, "```").boxed().await?;

-		let query_time = timer.elapsed();
-		self.write_str(&format!("```\n{result:#?}\n```\n\nQuery completed in {query_time:?}"))
-			.await
-	}
+	let map = self.services.db.get(map.as_str())?;
+	let timer = Instant::now();
+	prefix
+		.as_deref()
+		.map_or_else(|| map.raw_keys().boxed(), |prefix| map.raw_keys_prefix(prefix).boxed())
+		.map_ok(String::from_utf8_lossy)
+		.try_for_each(|str| writeln!(self, "{str:?}"))
+		.boxed()
+		.await?;

-	pub(super) async fn raw_keys_total(
-		&self,
-		map: Option<String>,
-		prefix: Option<String>,
-	) -> Result {
-		let prefix = prefix.as_deref().unwrap_or(EMPTY);
+	let query_time = timer.elapsed();
+	self.write_str(&format!("\n```\n\nQuery completed in {query_time:?}"))
+		.await
+}

-		let timer = Instant::now();
-		let result = with_maps_or(map.as_deref(), self.services)
-			.map(|map| map.raw_keys_prefix(&prefix))
-			.flatten()
-			.ignore_err()
-			.map(<[u8]>::len)
-			.ready_fold_default(|acc: usize, len| acc.saturating_add(len))
-			.await;
+#[admin_command]
+pub(super) async fn raw_keys_sizes(&self, map: Option<String>, prefix: Option<String>) -> Result {
+	let prefix = prefix.as_deref().unwrap_or(EMPTY);

-		let query_time = timer.elapsed();
-		self.write_str(&format!("```\n{result:#?}\n\n```\n\nQuery completed in {query_time:?}"))
-			.await
-	}
+	let timer = Instant::now();
+	let result = with_maps_or(map.as_deref(), self.services)
+		.map(|map| map.raw_keys_prefix(&prefix))
+		.flatten()
+		.ignore_err()
+		.map(<[u8]>::len)
+		.ready_fold_default(|mut map: BTreeMap<_, usize>, len| {
+			let entry = map.entry(len).or_default();
+			*entry = entry.saturating_add(1);
+			map
+		})
+		.await;

-	pub(super) async fn raw_vals_sizes(
-		&self,
-		map: Option<String>,
-		prefix: Option<String>,
-	) -> Result {
-		let prefix = prefix.as_deref().unwrap_or(EMPTY);
+	let query_time = timer.elapsed();
+	self.write_str(&format!("```\n{result:#?}\n```\n\nQuery completed in {query_time:?}"))
+		.await
+}

-		let timer = Instant::now();
-		let result = with_maps_or(map.as_deref(), self.services)
-			.map(|map| map.raw_stream_prefix(&prefix))
-			.flatten()
-			.ignore_err()
-			.map(at!(1))
-			.map(<[u8]>::len)
-			.ready_fold_default(|mut map: BTreeMap<_, usize>, len| {
-				let entry = map.entry(len).or_default();
-				*entry = entry.saturating_add(1);
-				map
-			})
-			.await;
+#[admin_command]
+pub(super) async fn raw_keys_total(&self, map: Option<String>, prefix: Option<String>) -> Result {
+	let prefix = prefix.as_deref().unwrap_or(EMPTY);

-		let query_time = timer.elapsed();
-		self.write_str(&format!("```\n{result:#?}\n```\n\nQuery completed in {query_time:?}"))
-			.await
-	}
+	let timer = Instant::now();
+	let result = with_maps_or(map.as_deref(), self.services)
+		.map(|map| map.raw_keys_prefix(&prefix))
+		.flatten()
+		.ignore_err()
+		.map(<[u8]>::len)
+		.ready_fold_default(|acc: usize, len| acc.saturating_add(len))
+		.await;

-	pub(super) async fn raw_vals_total(
-		&self,
-		map: Option<String>,
-		prefix: Option<String>,
-	) -> Result {
-		let prefix = prefix.as_deref().unwrap_or(EMPTY);
+	let query_time = timer.elapsed();
+	self.write_str(&format!("```\n{result:#?}\n\n```\n\nQuery completed in {query_time:?}"))
+		.await
+}

-		let timer = Instant::now();
-		let result = with_maps_or(map.as_deref(), self.services)
-			.map(|map| map.raw_stream_prefix(&prefix))
-			.flatten()
-			.ignore_err()
-			.map(at!(1))
-			.map(<[u8]>::len)
-			.ready_fold_default(|acc: usize, len| acc.saturating_add(len))
-			.await;
+#[admin_command]
+pub(super) async fn raw_vals_sizes(&self, map: Option<String>, prefix: Option<String>) -> Result {
+	let prefix = prefix.as_deref().unwrap_or(EMPTY);

-		let query_time = timer.elapsed();
-		self.write_str(&format!("```\n{result:#?}\n\n```\n\nQuery completed in {query_time:?}"))
-			.await
-	}
+	let timer = Instant::now();
+	let result = with_maps_or(map.as_deref(), self.services)
+		.map(|map| map.raw_stream_prefix(&prefix))
+		.flatten()
+		.ignore_err()
+		.map(at!(1))
+		.map(<[u8]>::len)
+		.ready_fold_default(|mut map: BTreeMap<_, usize>, len| {
+			let entry = map.entry(len).or_default();
+			*entry = entry.saturating_add(1);
+			map
+		})
+		.await;

-	pub(super) async fn raw_iter(&self, map: String, prefix: Option<String>) -> Result {
-		writeln!(self, "```").await?;
+	let query_time = timer.elapsed();
+	self.write_str(&format!("```\n{result:#?}\n```\n\nQuery completed in {query_time:?}"))
+		.await
+}

-		let map = self.services.db.get(&map)?;
-		let timer = Instant::now();
-		prefix
-			.as_deref()
-			.map_or_else(
-				|| map.raw_stream().boxed(),
-				|prefix| map.raw_stream_prefix(prefix).boxed(),
-			)
-			.map_ok(apply!(2, String::from_utf8_lossy))
-			.map_ok(apply!(2, Cow::into_owned))
-			.try_for_each(|keyval| writeln!(self, "{keyval:?}"))
-			.boxed()
-			.await?;
+#[admin_command]
+pub(super) async fn raw_vals_total(&self, map: Option<String>, prefix: Option<String>) -> Result {
+	let prefix = prefix.as_deref().unwrap_or(EMPTY);

-		let query_time = timer.elapsed();
-		self.write_str(&format!("\n```\n\nQuery completed in {query_time:?}"))
-			.await
-	}
+	let timer = Instant::now();
+	let result = with_maps_or(map.as_deref(), self.services)
+		.map(|map| map.raw_stream_prefix(&prefix))
+		.flatten()
+		.ignore_err()
+		.map(at!(1))
+		.map(<[u8]>::len)
+		.ready_fold_default(|acc: usize, len| acc.saturating_add(len))
+		.await;

-	pub(super) async fn raw_keys_from(
-		&self,
-		map: String,
-		start: String,
-		limit: Option<usize>,
-	) -> Result {
-		writeln!(self, "```").await?;
+	let query_time = timer.elapsed();
+	self.write_str(&format!("```\n{result:#?}\n\n```\n\nQuery completed in {query_time:?}"))
+		.await
+}

-		let map = self.services.db.get(&map)?;
-		let timer = Instant::now();
-		map.raw_keys_from(&start)
-			.map_ok(String::from_utf8_lossy)
-			.take(limit.unwrap_or(usize::MAX))
-			.try_for_each(|str| writeln!(self, "{str:?}"))
-			.boxed()
-			.await?;
+#[admin_command]
+pub(super) async fn raw_iter(&self, map: String, prefix: Option<String>) -> Result {
+	writeln!(self, "```").await?;

-		let query_time = timer.elapsed();
-		self.write_str(&format!("\n```\n\nQuery completed in {query_time:?}"))
-			.await
-	}
+	let map = self.services.db.get(&map)?;
+	let timer = Instant::now();
+	prefix
+		.as_deref()
+		.map_or_else(|| map.raw_stream().boxed(), |prefix| map.raw_stream_prefix(prefix).boxed())
+		.map_ok(apply!(2, String::from_utf8_lossy))
+		.map_ok(apply!(2, Cow::into_owned))
+		.try_for_each(|keyval| writeln!(self, "{keyval:?}"))
+		.boxed()
+		.await?;

-	pub(super) async fn raw_iter_from(
-		&self,
-		map: String,
-		start: String,
-		limit: Option<usize>,
-	) -> Result {
-		let map = self.services.db.get(&map)?;
-		let timer = Instant::now();
-		let result = map
-			.raw_stream_from(&start)
-			.map_ok(apply!(2, String::from_utf8_lossy))
-			.map_ok(apply!(2, Cow::into_owned))
-			.take(limit.unwrap_or(usize::MAX))
-			.try_collect::<Vec<(String, String)>>()
-			.await?;
+	let query_time = timer.elapsed();
+	self.write_str(&format!("\n```\n\nQuery completed in {query_time:?}"))
+		.await
+}

-		let query_time = timer.elapsed();
-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
-			.await
-	}
+#[admin_command]
+pub(super) async fn raw_keys_from(
+	&self,
+	map: String,
+	start: String,
+	limit: Option<usize>,
+) -> Result {
+	writeln!(self, "```").await?;

-	pub(super) async fn raw_del(&self, map: String, key: String) -> Result {
-		let map = self.services.db.get(&map)?;
-		let timer = Instant::now();
-		map.remove(&key);
+	let map = self.services.db.get(&map)?;
+	let timer = Instant::now();
+	map.raw_keys_from(&start)
+		.map_ok(String::from_utf8_lossy)
+		.take(limit.unwrap_or(usize::MAX))
+		.try_for_each(|str| writeln!(self, "{str:?}"))
+		.boxed()
+		.await?;

-		let query_time = timer.elapsed();
-		self.write_str(&format!("Operation completed in {query_time:?}"))
-			.await
-	}
+	let query_time = timer.elapsed();
+	self.write_str(&format!("\n```\n\nQuery completed in {query_time:?}"))
+		.await
+}

-	pub(super) async fn raw_get(&self, map: String, key: String) -> Result {
-		let map = self.services.db.get(&map)?;
-		let timer = Instant::now();
-		let handle = map.get(&key).await?;
+#[admin_command]
+pub(super) async fn raw_iter_from(
+	&self,
+	map: String,
+	start: String,
+	limit: Option<usize>,
+) -> Result {
+	let map = self.services.db.get(&map)?;
+	let timer = Instant::now();
+	let result = map
+		.raw_stream_from(&start)
+		.map_ok(apply!(2, String::from_utf8_lossy))
+		.map_ok(apply!(2, Cow::into_owned))
+		.take(limit.unwrap_or(usize::MAX))
+		.try_collect::<Vec<(String, String)>>()
+		.await?;

-		let query_time = timer.elapsed();
-		let result = String::from_utf8_lossy(&handle);
-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:?}\n```"))
-			.await
-	}
+	let query_time = timer.elapsed();
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
+		.await
+}

-	pub(super) async fn raw_maps(&self) -> Result {
-		let list: Vec<_> = self.services.db.iter().map(at!(0)).copied().collect();
+#[admin_command]
+pub(super) async fn raw_del(&self, map: String, key: String) -> Result {
+	let map = self.services.db.get(&map)?;
+	let timer = Instant::now();
+	map.remove(&key);

-		self.write_str(&format!("{list:#?}")).await
-	}
+	let query_time = timer.elapsed();
+	self.write_str(&format!("Operation completed in {query_time:?}"))
+		.await
+}
+
+#[admin_command]
+pub(super) async fn raw_get(&self, map: String, key: String) -> Result {
+	let map = self.services.db.get(&map)?;
+	let timer = Instant::now();
+	let handle = map.get(&key).await?;
+
+	let query_time = timer.elapsed();
+	let result = String::from_utf8_lossy(&handle);
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:?}\n```"))
+		.await
+}
+
+#[admin_command]
+pub(super) async fn raw_maps(&self) -> Result {
+	let list: Vec<_> = self.services.db.iter().map(at!(0)).copied().collect();
+
+	self.write_str(&format!("{list:#?}")).await
 }

 fn with_maps_or<'a>(
@@ -3,7 +3,7 @@
 use futures::StreamExt;
 use ruma::OwnedServerName;

-use crate::admin_command_dispatch;
+use crate::{admin_command, admin_command_dispatch};

 #[admin_command_dispatch]
 #[derive(Debug, Subcommand)]
@@ -39,68 +39,67 @@ pub enum ResolverCommand {
 	},
 }

-impl crate::Context<'_> {
-	async fn destinations_cache(&self, server_name: Option<OwnedServerName>) -> Result {
-		use service::resolver::cache::CachedDest;
+#[admin_command]
+async fn destinations_cache(&self, server_name: Option<OwnedServerName>) -> Result {
+	use service::resolver::cache::CachedDest;

-		writeln!(self, "| Server Name | Destination | Hostname | Expires |").await?;
-		writeln!(self, "| ----------- | ----------- | -------- | ------- |").await?;
+	writeln!(self, "| Server Name | Destination | Hostname | Expires |").await?;
+	writeln!(self, "| ----------- | ----------- | -------- | ------- |").await?;

-		let mut destinations = self.services.resolver.cache.destinations().boxed();
+	let mut destinations = self.services.resolver.cache.destinations().boxed();

-		while let Some((name, CachedDest { dest, host, expire })) = destinations.next().await {
-			if let Some(server_name) = server_name.as_ref() {
-				if name != *server_name {
-					continue;
-				}
+	while let Some((name, CachedDest { dest, host, expire })) = destinations.next().await {
+		if let Some(server_name) = server_name.as_ref() {
+			if name != *server_name {
+				continue;
 			}
-
-			let expire = time::format(expire, "%+");
-			self.write_str(&format!("| {name} | {dest} | {host} | {expire} |\n"))
-				.await?;
 		}

-		Ok(())
-	}
-
-	async fn overrides_cache(&self, server_name: Option<String>) -> Result {
-		use service::resolver::cache::CachedOverride;
-
-		writeln!(self, "| Server Name | IP  | Port | Expires | Overriding |").await?;
-		writeln!(self, "| ----------- | --- | ----:| ------- | ---------- |").await?;
-
-		let mut overrides = self.services.resolver.cache.overrides().boxed();
-
-		while let Some((name, CachedOverride { ips, port, expire, overriding })) =
-			overrides.next().await
-		{
-			if let Some(server_name) = server_name.as_ref() {
-				if name != *server_name {
-					continue;
-				}
-			}
-
-			let expire = time::format(expire, "%+");
-			self.write_str(&format!(
-				"| {name} | {ips:?} | {port} | {expire} | {overriding:?} |\n"
-			))
+		let expire = time::format(expire, "%+");
+		self.write_str(&format!("| {name} | {dest} | {host} | {expire} |\n"))
 			.await?;
-		}
-
-		Ok(())
 	}

-	async fn flush_cache(&self, name: Option<OwnedServerName>, all: bool) -> Result {
-		if all {
-			self.services.resolver.cache.clear().await;
-			writeln!(self, "Resolver caches cleared!").await
-		} else if let Some(name) = name {
-			self.services.resolver.cache.del_destination(&name);
-			self.services.resolver.cache.del_override(&name);
-			self.write_str(&format!("Cleared {name} from resolver caches!"))
-				.await
-		} else {
-			Err!("Missing name. Supply a name or use --all to flush the whole cache.")
+	Ok(())
+}
+
+#[admin_command]
+async fn overrides_cache(&self, server_name: Option<String>) -> Result {
+	use service::resolver::cache::CachedOverride;
+
+	writeln!(self, "| Server Name | IP  | Port | Expires | Overriding |").await?;
+	writeln!(self, "| ----------- | --- | ----:| ------- | ---------- |").await?;
+
+	let mut overrides = self.services.resolver.cache.overrides().boxed();
+
+	while let Some((name, CachedOverride { ips, port, expire, overriding })) =
+		overrides.next().await
+	{
+		if let Some(server_name) = server_name.as_ref() {
+			if name != *server_name {
+				continue;
+			}
 		}
+
+		let expire = time::format(expire, "%+");
+		self.write_str(&format!("| {name} | {ips:?} | {port} | {expire} | {overriding:?} |\n"))
+			.await?;
+	}
+
+	Ok(())
+}
+
+#[admin_command]
+async fn flush_cache(&self, name: Option<OwnedServerName>, all: bool) -> Result {
+	if all {
+		self.services.resolver.cache.clear().await;
+		writeln!(self, "Resolver caches cleared!").await
+	} else if let Some(name) = name {
+		self.services.resolver.cache.del_destination(&name);
+		self.services.resolver.cache.del_override(&name);
+		self.write_str(&format!("Cleared {name} from resolver caches!"))
+			.await
+	} else {
+		Err!("Missing name. Supply a name or use --all to flush the whole cache.")
 	}
 }
@@ -3,7 +3,7 @@
 use futures::TryStreamExt;
 use ruma::OwnedRoomOrAliasId;

-use crate::admin_command_dispatch;
+use crate::{admin_command, admin_command_dispatch};

 #[admin_command_dispatch]
 #[derive(Debug, Subcommand)]
@@ -23,39 +23,39 @@ pub enum RoomTimelineCommand {
 	},
 }

-impl crate::Context<'_> {
-	pub(super) async fn last(&self, room_id: OwnedRoomOrAliasId) -> Result {
-		let room_id = self.services.rooms.alias.resolve(&room_id).await?;
+#[admin_command]
+pub(super) async fn last(&self, room_id: OwnedRoomOrAliasId) -> Result {
+	let room_id = self.services.rooms.alias.resolve(&room_id).await?;

-		let result = self
-			.services
-			.rooms
-			.timeline
-			.last_timeline_count(&room_id)
-			.await?;
+	let result = self
+		.services
+		.rooms
+		.timeline
+		.last_timeline_count(&room_id)
+		.await?;

-		self.write_str(&format!("{result:#?}")).await
-	}
-
-	pub(super) async fn pdus(
-		&self,
-		room_id: OwnedRoomOrAliasId,
-		from: Option<String>,
-		limit: Option<usize>,
-	) -> Result {
-		let room_id = self.services.rooms.alias.resolve(&room_id).await?;
-
-		let from: Option<PduCount> = from.as_deref().map(str::parse).transpose()?;
-
-		let result: Vec<_> = self
-			.services
-			.rooms
-			.timeline
-			.pdus_rev(&room_id, from)
-			.try_take(limit.unwrap_or(3))
-			.try_collect()
-			.await?;
-
-		self.write_str(&format!("```\n{result:#?}\n```")).await
-	}
+	self.write_str(&format!("{result:#?}")).await
+}
+
+#[admin_command]
+pub(super) async fn pdus(
+	&self,
+	room_id: OwnedRoomOrAliasId,
+	from: Option<String>,
+	limit: Option<usize>,
+) -> Result {
+	let room_id = self.services.rooms.alias.resolve(&room_id).await?;
+
+	let from: Option<PduCount> = from.as_deref().map(str::parse).transpose()?;
+
+	let result: Vec<_> = self
+		.services
+		.rooms
+		.timeline
+		.pdus_rev(&room_id, from)
+		.try_take(limit.unwrap_or(3))
+		.try_collect()
+		.await?;
+
+	self.write_str(&format!("```\n{result:#?}\n```")).await
 }
@@ -2,7 +2,7 @@
 use conduwuit::Result;
 use ruma::{OwnedEventId, OwnedRoomOrAliasId};

-use crate::admin_command_dispatch;
+use crate::{admin_command, admin_command_dispatch};

 #[admin_command_dispatch]
 #[derive(Debug, Subcommand)]
@@ -17,23 +17,23 @@ pub enum ShortCommand {
 	},
 }

-impl crate::Context<'_> {
-	pub(super) async fn short_event_id(&self, event_id: OwnedEventId) -> Result {
-		let shortid = self
-			.services
-			.rooms
-			.short
-			.get_shorteventid(&event_id)
-			.await?;
+#[admin_command]
+pub(super) async fn short_event_id(&self, event_id: OwnedEventId) -> Result {
+	let shortid = self
+		.services
+		.rooms
+		.short
+		.get_shorteventid(&event_id)
+		.await?;

-		self.write_str(&format!("{shortid:#?}")).await
-	}
-
-	pub(super) async fn short_room_id(&self, room_id: OwnedRoomOrAliasId) -> Result {
-		let room_id = self.services.rooms.alias.resolve(&room_id).await?;
-
-		let shortid = self.services.rooms.short.get_shortroomid(&room_id).await?;
-
-		self.write_str(&format!("{shortid:#?}")).await
-	}
+	self.write_str(&format!("{shortid:#?}")).await
+}
+
+#[admin_command]
+pub(super) async fn short_room_id(&self, room_id: OwnedRoomOrAliasId) -> Result {
+	let room_id = self.services.rooms.alias.resolve(&room_id).await?;
+
+	let shortid = self.services.rooms.short.get_shortroomid(&room_id).await?;
+
+	self.write_str(&format!("{shortid:#?}")).await
 }
@@ -3,7 +3,7 @@
 use futures::stream::StreamExt;
 use ruma::{OwnedDeviceId, OwnedRoomId, OwnedUserId};

-use crate::admin_command_dispatch;
+use crate::{admin_command, admin_command_dispatch};

 #[admin_command_dispatch]
 #[derive(Debug, Subcommand)]
@@ -92,259 +92,263 @@ pub enum UsersCommand {
 	},
 }

-impl crate::Context<'_> {
-	async fn get_shared_rooms(&self, user_a: OwnedUserId, user_b: OwnedUserId) -> Result {
-		let timer = tokio::time::Instant::now();
-		let result: Vec<_> = self
-			.services
-			.rooms
-			.state_cache
-			.get_shared_rooms(&user_a, &user_b)
-			.collect()
-			.await;
-		let query_time = timer.elapsed();
+#[admin_command]
+async fn get_shared_rooms(&self, user_a: OwnedUserId, user_b: OwnedUserId) -> Result {
+	let timer = tokio::time::Instant::now();
+	let result: Vec<_> = self
+		.services
+		.rooms
+		.state_cache
+		.get_shared_rooms(&user_a, &user_b)
+		.collect()
+		.await;
+	let query_time = timer.elapsed();

-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
-			.await
-	}
-
-	async fn get_backup_session(
-		&self,
-		user_id: OwnedUserId,
-		version: String,
-		room_id: OwnedRoomId,
-		session_id: String,
-	) -> Result {
-		let timer = tokio::time::Instant::now();
-		let result = self
-			.services
-			.key_backups
-			.get_session(&user_id, &version, &room_id, &session_id)
-			.await;
-		let query_time = timer.elapsed();
-
-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
-			.await
-	}
-
-	async fn get_room_backups(
-		&self,
-		user_id: OwnedUserId,
-		version: String,
-		room_id: OwnedRoomId,
-	) -> Result {
-		let timer = tokio::time::Instant::now();
-		let result = self
-			.services
-			.key_backups
-			.get_room(&user_id, &version, &room_id)
-			.await;
-		let query_time = timer.elapsed();
-
-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
-			.await
-	}
-
-	async fn get_all_backups(&self, user_id: OwnedUserId, version: String) -> Result {
-		let timer = tokio::time::Instant::now();
-		let result = self.services.key_backups.get_all(&user_id, &version).await;
-		let query_time = timer.elapsed();
-
-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
-			.await
-	}
-
-	async fn get_backup_algorithm(&self, user_id: OwnedUserId, version: String) -> Result {
-		let timer = tokio::time::Instant::now();
-		let result = self
-			.services
-			.key_backups
-			.get_backup(&user_id, &version)
-			.await;
-		let query_time = timer.elapsed();
-
-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
-			.await
-	}
-
-	async fn get_latest_backup_version(&self, user_id: OwnedUserId) -> Result {
-		let timer = tokio::time::Instant::now();
-		let result = self
-			.services
-			.key_backups
-			.get_latest_backup_version(&user_id)
-			.await;
-		let query_time = timer.elapsed();
-
-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
-			.await
-	}
-
-	async fn get_latest_backup(&self, user_id: OwnedUserId) -> Result {
-		let timer = tokio::time::Instant::now();
-		let result = self.services.key_backups.get_latest_backup(&user_id).await;
-		let query_time = timer.elapsed();
-
-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
-			.await
-	}
-
-	async fn iter_users(&self) -> Result {
-		let timer = tokio::time::Instant::now();
-		let result: Vec<OwnedUserId> =
-			self.services.users.stream().map(Into::into).collect().await;
-
-		let query_time = timer.elapsed();
-
-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
-			.await
-	}
-
-	async fn iter_users2(&self) -> Result {
-		let timer = tokio::time::Instant::now();
-		let result: Vec<_> = self.services.users.stream().collect().await;
-		let result: Vec<_> = result
-			.into_iter()
-			.map(|user_id| String::from_utf8_lossy(user_id.as_bytes()).into_owned())
-			.collect();
-
-		let query_time = timer.elapsed();
-
-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:?}\n```"))
-			.await
-	}
-
-	async fn count_users(&self) -> Result {
-		let timer = tokio::time::Instant::now();
-		let result = self.services.users.count().await;
-		let query_time = timer.elapsed();
-
-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
-			.await
-	}
-
-	async fn list_devices(&self, user_id: OwnedUserId) -> Result {
-		let timer = tokio::time::Instant::now();
-		let devices = self
-			.services
-			.users
-			.all_device_ids(&user_id)
-			.collect::<Vec<_>>()
-			.await;
-
-		let query_time = timer.elapsed();
-
-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{devices:#?}\n```"))
-			.await
-	}
-
-	async fn list_devices_metadata(&self, user_id: OwnedUserId) -> Result {
-		let timer = tokio::time::Instant::now();
-		let devices = self
-			.services
-			.users
-			.all_devices_metadata(&user_id)
-			.collect::<Vec<_>>()
-			.await;
-		let query_time = timer.elapsed();
-
-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{devices:#?}\n```"))
-			.await
-	}
-
-	async fn get_device_metadata(
-		&self,
-		user_id: OwnedUserId,
-		device_id: OwnedDeviceId,
-	) -> Result {
-		let timer = tokio::time::Instant::now();
-		let device = self
-			.services
-			.users
-			.get_device_metadata(&user_id, &device_id)
-			.await;
-		let query_time = timer.elapsed();
-
-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{device:#?}\n```"))
-			.await
-	}
-
-	async fn get_devices_version(&self, user_id: OwnedUserId) -> Result {
-		let timer = tokio::time::Instant::now();
-		let device = self.services.users.get_devicelist_version(&user_id).await;
-		let query_time = timer.elapsed();
-
-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{device:#?}\n```"))
-			.await
-	}
-
-	async fn count_one_time_keys(
-		&self,
-		user_id: OwnedUserId,
-		device_id: OwnedDeviceId,
-	) -> Result {
-		let timer = tokio::time::Instant::now();
-		let result = self
-			.services
-			.users
-			.count_one_time_keys(&user_id, &device_id)
-			.await;
-		let query_time = timer.elapsed();
-
-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
-			.await
-	}
-
-	async fn get_device_keys(&self, user_id: OwnedUserId, device_id: OwnedDeviceId) -> Result {
-		let timer = tokio::time::Instant::now();
-		let result = self
-			.services
-			.users
-			.get_device_keys(&user_id, &device_id)
-			.await;
-		let query_time = timer.elapsed();
-
-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
-			.await
-	}
-
-	async fn get_user_signing_key(&self, user_id: OwnedUserId) -> Result {
-		let timer = tokio::time::Instant::now();
-		let result = self.services.users.get_user_signing_key(&user_id).await;
-		let query_time = timer.elapsed();
-
-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
-			.await
-	}
-
-	async fn get_master_key(&self, user_id: OwnedUserId) -> Result {
-		let timer = tokio::time::Instant::now();
-		let result = self
-			.services
-			.users
-			.get_master_key(None, &user_id, &|_| true)
-			.await;
-		let query_time = timer.elapsed();
-
-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
-			.await
-	}
-
-	async fn get_to_device_events(
-		&self,
-		user_id: OwnedUserId,
-		device_id: OwnedDeviceId,
-	) -> Result {
-		let timer = tokio::time::Instant::now();
-		let result = self
-			.services
-			.users
-			.get_to_device_events(&user_id, &device_id, None, None)
-			.collect::<Vec<_>>()
-			.await;
-		let query_time = timer.elapsed();
-
-		self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
-			.await
-	}
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
+		.await
+}
+
+#[admin_command]
+async fn get_backup_session(
+	&self,
+	user_id: OwnedUserId,
+	version: String,
+	room_id: OwnedRoomId,
+	session_id: String,
+) -> Result {
+	let timer = tokio::time::Instant::now();
+	let result = self
+		.services
+		.key_backups
+		.get_session(&user_id, &version, &room_id, &session_id)
+		.await;
+	let query_time = timer.elapsed();
+
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
+		.await
+}
+
+#[admin_command]
+async fn get_room_backups(
+	&self,
+	user_id: OwnedUserId,
+	version: String,
+	room_id: OwnedRoomId,
+) -> Result {
+	let timer = tokio::time::Instant::now();
+	let result = self
+		.services
+		.key_backups
+		.get_room(&user_id, &version, &room_id)
+		.await;
+	let query_time = timer.elapsed();
+
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
+		.await
+}
+
+#[admin_command]
+async fn get_all_backups(&self, user_id: OwnedUserId, version: String) -> Result {
+	let timer = tokio::time::Instant::now();
+	let result = self.services.key_backups.get_all(&user_id, &version).await;
+	let query_time = timer.elapsed();
+
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
+		.await
+}
+
+#[admin_command]
+async fn get_backup_algorithm(&self, user_id: OwnedUserId, version: String) -> Result {
+	let timer = tokio::time::Instant::now();
+	let result = self
+		.services
+		.key_backups
+		.get_backup(&user_id, &version)
+		.await;
+	let query_time = timer.elapsed();
+
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
+		.await
+}
+
+#[admin_command]
+async fn get_latest_backup_version(&self, user_id: OwnedUserId) -> Result {
+	let timer = tokio::time::Instant::now();
+	let result = self
+		.services
+		.key_backups
+		.get_latest_backup_version(&user_id)
+		.await;
+	let query_time = timer.elapsed();
+
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
+		.await
+}
+
+#[admin_command]
+async fn get_latest_backup(&self, user_id: OwnedUserId) -> Result {
+	let timer = tokio::time::Instant::now();
+	let result = self.services.key_backups.get_latest_backup(&user_id).await;
+	let query_time = timer.elapsed();
+
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
+		.await
+}
+
+#[admin_command]
+async fn iter_users(&self) -> Result {
+	let timer = tokio::time::Instant::now();
+	let result: Vec<OwnedUserId> = self.services.users.stream().map(Into::into).collect().await;
+
+	let query_time = timer.elapsed();
+
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
+		.await
+}
+
+#[admin_command]
+async fn iter_users2(&self) -> Result {
+	let timer = tokio::time::Instant::now();
+	let result: Vec<_> = self.services.users.stream().collect().await;
+	let result: Vec<_> = result
+		.into_iter()
+		.map(|user_id| String::from_utf8_lossy(user_id.as_bytes()).into_owned())
+		.collect();
+
+	let query_time = timer.elapsed();
+
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:?}\n```"))
+		.await
+}
+
+#[admin_command]
+async fn count_users(&self) -> Result {
+	let timer = tokio::time::Instant::now();
+	let result = self.services.users.count().await;
+	let query_time = timer.elapsed();
+
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
+		.await
+}
+
+#[admin_command]
+async fn list_devices(&self, user_id: OwnedUserId) -> Result {
+	let timer = tokio::time::Instant::now();
+	let devices = self
+		.services
+		.users
+		.all_device_ids(&user_id)
+		.collect::<Vec<_>>()
+		.await;
+
+	let query_time = timer.elapsed();
+
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{devices:#?}\n```"))
+		.await
+}
+
+#[admin_command]
+async fn list_devices_metadata(&self, user_id: OwnedUserId) -> Result {
+	let timer = tokio::time::Instant::now();
+	let devices = self
+		.services
+		.users
+		.all_devices_metadata(&user_id)
+		.collect::<Vec<_>>()
+		.await;
+	let query_time = timer.elapsed();
+
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{devices:#?}\n```"))
+		.await
+}
+
+#[admin_command]
+async fn get_device_metadata(&self, user_id: OwnedUserId, device_id: OwnedDeviceId) -> Result {
+	let timer = tokio::time::Instant::now();
+	let device = self
+		.services
+		.users
+		.get_device_metadata(&user_id, &device_id)
+		.await;
+	let query_time = timer.elapsed();
+
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{device:#?}\n```"))
+		.await
+}
+
+#[admin_command]
+async fn get_devices_version(&self, user_id: OwnedUserId) -> Result {
+	let timer = tokio::time::Instant::now();
+	let device = self.services.users.get_devicelist_version(&user_id).await;
+	let query_time = timer.elapsed();
+
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{device:#?}\n```"))
+		.await
+}
+
+#[admin_command]
+async fn count_one_time_keys(&self, user_id: OwnedUserId, device_id: OwnedDeviceId) -> Result {
+	let timer = tokio::time::Instant::now();
+	let result = self
+		.services
+		.users
+		.count_one_time_keys(&user_id, &device_id)
+		.await;
+	let query_time = timer.elapsed();
+
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
+		.await
+}
+
+#[admin_command]
+async fn get_device_keys(&self, user_id: OwnedUserId, device_id: OwnedDeviceId) -> Result {
+	let timer = tokio::time::Instant::now();
+	let result = self
+		.services
+		.users
+		.get_device_keys(&user_id, &device_id)
+		.await;
+	let query_time = timer.elapsed();
+
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
+		.await
+}
+
+#[admin_command]
+async fn get_user_signing_key(&self, user_id: OwnedUserId) -> Result {
+	let timer = tokio::time::Instant::now();
+	let result = self.services.users.get_user_signing_key(&user_id).await;
+	let query_time = timer.elapsed();
+
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
+		.await
+}
+
+#[admin_command]
+async fn get_master_key(&self, user_id: OwnedUserId) -> Result {
+	let timer = tokio::time::Instant::now();
+	let result = self
+		.services
+		.users
+		.get_master_key(None, &user_id, &|_| true)
+		.await;
+	let query_time = timer.elapsed();
+
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
+		.await
+}
+
+#[admin_command]
+async fn get_to_device_events(&self, user_id: OwnedUserId, device_id: OwnedDeviceId) -> Result {
+	let timer = tokio::time::Instant::now();
+	let result = self
+		.services
+		.users
+		.get_to_device_events(&user_id, &device_id, None, None)
+		.collect::<Vec<_>>()
+		.await;
+	let query_time = timer.elapsed();
+
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
+		.await
 }
@@ -2,83 +2,83 @@
 use futures::StreamExt;
 use ruma::OwnedRoomId;

-use crate::{PAGE_SIZE, get_room_info};
+use crate::{PAGE_SIZE, admin_command, get_room_info};

-impl crate::Context<'_> {
-	#[allow(clippy::fn_params_excessive_bools)]
-	pub(super) async fn list_rooms(
-		&self,
-		page: Option<usize>,
-		exclude_disabled: bool,
-		exclude_banned: bool,
-		include_empty: bool,
-		no_details: bool,
-	) -> Result {
-		// TODO: i know there's a way to do this with clap, but i can't seem to find it
-		let page = page.unwrap_or(1);
-		let mut rooms = self
-			.services
-			.rooms
-			.metadata
-			.iter_ids()
-			.filter_map(|room_id| async move {
-				(!exclude_disabled || !self.services.rooms.metadata.is_disabled(&room_id).await)
-					.then_some(room_id)
-			})
-			.filter_map(|room_id| async move {
-				(!exclude_banned || !self.services.rooms.metadata.is_banned(&room_id).await)
-					.then_some(room_id)
-			})
-			.then(async |room_id| get_room_info(self.services, &room_id).await)
-			.then(|(room_id, total_members, name)| async move {
-				let local_members: Vec<_> = self
-					.services
-					.rooms
-					.state_cache
-					.active_local_users_in_room(&room_id)
-					.collect()
-					.await;
-				let local_members = local_members.len();
-				(room_id, total_members, local_members, name)
-			})
-			.filter_map(|(room_id, total_members, local_members, name)| async move {
-				(include_empty || local_members > 0).then_some((room_id, total_members, name))
-			})
-			.collect::<Vec<_>>()
-			.await;
+#[allow(clippy::fn_params_excessive_bools)]
+#[admin_command]
+pub(super) async fn list_rooms(
+	&self,
+	page: Option<usize>,
+	exclude_disabled: bool,
+	exclude_banned: bool,
+	include_empty: bool,
+	no_details: bool,
+) -> Result {
+	// TODO: i know there's a way to do this with clap, but i can't seem to find it
+	let page = page.unwrap_or(1);
+	let mut rooms = self
+		.services
+		.rooms
+		.metadata
+		.iter_ids()
+		.filter_map(|room_id| async move {
+			(!exclude_disabled || !self.services.rooms.metadata.is_disabled(&room_id).await)
+				.then_some(room_id)
+		})
+		.filter_map(|room_id| async move {
+			(!exclude_banned || !self.services.rooms.metadata.is_banned(&room_id).await)
+				.then_some(room_id)
+		})
+		.then(async |room_id| get_room_info(self.services, &room_id).await)
+		.then(|(room_id, total_members, name)| async move {
+			let local_members: Vec<_> = self
+				.services
+				.rooms
+				.state_cache
+				.active_local_users_in_room(&room_id)
+				.collect()
+				.await;
+			let local_members = local_members.len();
+			(room_id, total_members, local_members, name)
+		})
+		.filter_map(|(room_id, total_members, local_members, name)| async move {
+			(include_empty || local_members > 0).then_some((room_id, total_members, name))
+		})
+		.collect::<Vec<_>>()
+		.await;

-		rooms.sort_by_key(|r| r.1);
-		rooms.reverse();
+	rooms.sort_by_key(|r| r.1);
+	rooms.reverse();

-		let rooms = rooms
-			.into_iter()
-			.skip(page.saturating_sub(1).saturating_mul(PAGE_SIZE))
-			.take(PAGE_SIZE)
-			.collect::<Vec<_>>();
+	let rooms = rooms
+		.into_iter()
+		.skip(page.saturating_sub(1).saturating_mul(PAGE_SIZE))
+		.take(PAGE_SIZE)
+		.collect::<Vec<_>>();

-		if rooms.is_empty() {
-			return Err!("No more rooms.");
-		}
-
-		let body = rooms
-			.iter()
-			.map(|(id, members, name)| {
-				if no_details {
-					format!("{id}")
-				} else {
-					format!("{id}\tMembers: {members}\tName: {name}")
-				}
-			})
-			.collect::<Vec<_>>()
-			.join("\n");
-
-		self.write_str(&format!("Rooms ({}):\n```\n{body}\n```", rooms.len()))
-			.await
+	if rooms.is_empty() {
+		return Err!("No more rooms.");
 	}

-	pub(super) async fn exists(&self, room_id: OwnedRoomId) -> Result {
-		let result = self.services.rooms.metadata.exists(&room_id).await;
+	let body = rooms
+		.iter()
+		.map(|(id, members, name)| {
+			if no_details {
+				format!("{id}")
+			} else {
+				format!("{id}\tMembers: {members}\tName: {name}")
+			}
+		})
+		.collect::<Vec<_>>()
+		.join("\n");

-		self.write_str(&format!("{result}")).await
-	}
+	self.write_str(&format!("Rooms ({}):\n```\n{body}\n```", rooms.len()))
+		.await
+}
+
+#[admin_command]
+pub(super) async fn exists(&self, room_id: OwnedRoomId) -> Result {
+	let result = self.services.rooms.metadata.exists(&room_id).await;
+
+	self.write_str(&format!("{result}")).await
 }
@@ -3,7 +3,7 @@
 use futures::StreamExt;
 use ruma::OwnedRoomId;

-use crate::admin_command_dispatch;
+use crate::{admin_command, admin_command_dispatch};

 #[admin_command_dispatch]
 #[derive(Debug, Subcommand)]
@@ -26,62 +26,62 @@ pub enum RoomInfoCommand {
 	},
 }

-impl crate::Context<'_> {
-	async fn list_joined_members(&self, room_id: OwnedRoomId, local_only: bool) -> Result {
-		let room_name = self
-			.services
-			.rooms
-			.state_accessor
-			.get_name(&room_id)
-			.await
-			.unwrap_or_else(|_| room_id.to_string());
+#[admin_command]
+async fn list_joined_members(&self, room_id: OwnedRoomId, local_only: bool) -> Result {
+	let room_name = self
+		.services
+		.rooms
+		.state_accessor
+		.get_name(&room_id)
+		.await
+		.unwrap_or_else(|_| room_id.to_string());

-		let member_info: Vec<_> = self
-			.services
-			.rooms
-			.state_cache
-			.room_members(&room_id)
-			.ready_filter(|user_id| {
-				local_only
-					.then(|| self.services.globals.user_is_local(user_id))
-					.unwrap_or(true)
-			})
-			.filter_map(|user_id| async move {
-				Some((
-					self.services
-						.users
-						.displayname(&user_id)
-						.await
-						.unwrap_or_else(|_| user_id.to_string()),
-					user_id,
-				))
-			})
-			.collect()
-			.await;
+	let member_info: Vec<_> = self
+		.services
+		.rooms
+		.state_cache
+		.room_members(&room_id)
+		.ready_filter(|user_id| {
+			local_only
+				.then(|| self.services.globals.user_is_local(user_id))
+				.unwrap_or(true)
+		})
+		.filter_map(|user_id| async move {
+			Some((
+				self.services
+					.users
+					.displayname(&user_id)
+					.await
+					.unwrap_or_else(|_| user_id.to_string()),
+				user_id,
+			))
+		})
+		.collect()
+		.await;

-		let num = member_info.len();
-		let body = member_info
-			.into_iter()
-			.map(|(displayname, mxid)| format!("{mxid} | {displayname}"))
-			.collect::<Vec<_>>()
-			.join("\n");
+	let num = member_info.len();
+	let body = member_info
+		.into_iter()
+		.map(|(displayname, mxid)| format!("{mxid} | {displayname}"))
+		.collect::<Vec<_>>()
+		.join("\n");

-		self.write_str(&format!("{num} Members in Room \"{room_name}\":\n```\n{body}\n```"))
-			.await
-	}
-
-	async fn view_room_topic(&self, room_id: OwnedRoomId) -> Result {
-		let Ok(room_topic) = self
-			.services
-			.rooms
-			.state_accessor
-			.get_room_topic(&room_id)
-			.await
-		else {
-			return Err!("Room does not have a room topic set.");
-		};
-
-		self.write_str(&format!("Room topic:\n```\n{room_topic}\n```"))
-			.await
-	}
+	self.write_str(&format!("{num} Members in Room \"{room_name}\":\n```\n{body}\n```"))
+		.await
+}
+
+#[admin_command]
+async fn view_room_topic(&self, room_id: OwnedRoomId) -> Result {
+	let Ok(room_topic) = self
+		.services
+		.rooms
+		.state_accessor
+		.get_room_topic(&room_id)
+		.await
+	else {
+		return Err!("Room does not have a room topic set.");
+	};
+
+	self.write_str(&format!("Room topic:\n```\n{room_topic}\n```"))
+		.await
 }
@@ -8,7 +8,7 @@
 use futures::{FutureExt, StreamExt};
 use ruma::{OwnedRoomId, OwnedRoomOrAliasId, RoomAliasId, RoomId, RoomOrAliasId};

-use crate::{admin_command_dispatch, get_room_info};
+use crate::{admin_command, admin_command_dispatch, get_room_info};

 #[admin_command_dispatch]
 #[derive(Debug, Subcommand)]
@@ -45,72 +45,238 @@ pub enum RoomModerationCommand {
 	},
 }

-impl crate::Context<'_> {
-	async fn ban_room(&self, room: OwnedRoomOrAliasId) -> Result {
-		debug!("Got room alias or ID: {}", room);
+#[admin_command]
+async fn ban_room(&self, room: OwnedRoomOrAliasId) -> Result {
+	debug!("Got room alias or ID: {}", room);

-		let admin_room_alias = &self.services.globals.admin_alias;
+	let admin_room_alias = &self.services.globals.admin_alias;

-		if let Ok(admin_room_id) = self.services.admin.get_admin_room().await {
-			if room.to_string().eq(&admin_room_id) || room.to_string().eq(admin_room_alias) {
-				return Err!("Not allowed to ban the admin room.");
-			}
+	if let Ok(admin_room_id) = self.services.admin.get_admin_room().await {
+		if room.to_string().eq(&admin_room_id) || room.to_string().eq(admin_room_alias) {
+			return Err!("Not allowed to ban the admin room.");
 		}
+	}

-		let room_id = if room.is_room_id() {
-			let room_id = match RoomId::parse(&room) {
-				| Ok(room_id) => room_id,
-				| Err(e) => {
-					return Err!(
-						"Failed to parse room ID {room}. Please note that this requires a full \
-						 room ID (`!awIh6gGInaS5wLQJwa:example.com`) or a room alias \
-						 (`#roomalias:example.com`): {e}"
-					);
-				},
-			};
-
-			debug!("Room specified is a room ID, banning room ID");
-
-			room_id.clone()
-		} else if room.is_room_alias_id() {
-			let room_alias = match RoomAliasId::parse(&room) {
-				| Ok(room_alias) => room_alias,
-				| Err(e) => {
-					return Err!(
-						"Failed to parse room ID {room}. Please note that this requires a full \
-						 room ID (`!awIh6gGInaS5wLQJwa:example.com`) or a room alias \
-						 (`#roomalias:example.com`): {e}"
-					);
-				},
-			};
-
-			debug!(
-				"Room specified is not a room ID, attempting to resolve room alias to a room ID \
-				 locally, if not using get_alias_helper to fetch room ID remotely"
-			);
-
-			match self.services.rooms.alias.resolve_alias(&room_alias).await {
-				| Ok((room_id, servers)) => {
-					debug!(
-						%room_id,
-						?servers,
-						"Got federation response fetching room ID for room {room}"
-					);
-					room_id
-				},
-				| Err(e) => {
-					return Err!("Failed to resolve room alias {room} to a room ID: {e}");
-				},
-			}
-		} else {
-			return Err!(
-				"Room specified is not a room ID or room alias. Please note that this requires \
-				 a full room ID (`!awIh6gGInaS5wLQJwa:example.com`) or a room alias \
-				 (`#roomalias:example.com`)",
-			);
+	let room_id = if room.is_room_id() {
+		let room_id = match RoomId::parse(&room) {
+			| Ok(room_id) => room_id,
+			| Err(e) => {
+				return Err!(
+					"Failed to parse room ID {room}. Please note that this requires a full room \
+					 ID (`!awIh6gGInaS5wLQJwa:example.com`) or a room alias \
+					 (`#roomalias:example.com`): {e}"
+				);
+			},
 		};

-		info!("Making all users leave the room {room_id} and forgetting it");
+		debug!("Room specified is a room ID, banning room ID");
+
+		room_id.clone()
+	} else if room.is_room_alias_id() {
+		let room_alias = match RoomAliasId::parse(&room) {
+			| Ok(room_alias) => room_alias,
+			| Err(e) => {
+				return Err!(
+					"Failed to parse room ID {room}. Please note that this requires a full room \
+					 ID (`!awIh6gGInaS5wLQJwa:example.com`) or a room alias \
+					 (`#roomalias:example.com`): {e}"
+				);
+			},
+		};
+
+		debug!(
+			"Room specified is not a room ID, attempting to resolve room alias to a room ID \
+			 locally, if not using get_alias_helper to fetch room ID remotely"
+		);
+
+		match self.services.rooms.alias.resolve_alias(&room_alias).await {
+			| Ok((room_id, servers)) => {
+				debug!(
+					%room_id,
+					?servers,
+					"Got federation response fetching room ID for room {room}"
+				);
+				room_id
+			},
+			| Err(e) => {
+				return Err!("Failed to resolve room alias {room} to a room ID: {e}");
+			},
+		}
+	} else {
+		return Err!(
+			"Room specified is not a room ID or room alias. Please note that this requires a \
+			 full room ID (`!awIh6gGInaS5wLQJwa:example.com`) or a room alias \
+			 (`#roomalias:example.com`)",
+		);
+	};
+
+	info!("Making all users leave the room {room_id} and forgetting it");
+	let mut users = self
+		.services
+		.rooms
+		.state_cache
+		.room_members(&room_id)
+		.ready_filter(|user| self.services.globals.user_is_local(user))
+		.boxed();
+
+	while let Some(ref user_id) = users.next().await {
+		info!(
+			"Attempting leave for user {user_id} in room {room_id} (ignoring all errors, \
+			 evicting admins too)",
+		);
+
+		if let Err(e) = leave_room(self.services, user_id, &room_id, None)
+			.boxed()
+			.await
+		{
+			warn!("Failed to leave room: {e}");
+		}
+
+		self.services.rooms.state_cache.forget(&room_id, user_id);
+	}
+
+	self.services
+		.rooms
+		.alias
+		.local_aliases_for_room(&room_id)
+		.for_each(|local_alias| async move {
+			self.services
+				.rooms
+				.alias
+				.remove_alias(&local_alias, &self.services.globals.server_user)
+				.await
+				.ok();
+		})
+		.await;
+
+	self.services.rooms.directory.set_not_public(&room_id); // remove from the room directory
+	self.services.rooms.metadata.ban_room(&room_id, true); // prevent further joins
+	self.services.rooms.metadata.disable_room(&room_id, true); // disable federation
+
+	self.write_str(
+		"Room banned, removed all our local users, and disabled incoming federation with room.",
+	)
+	.await
+}
+
+#[admin_command]
+async fn ban_list_of_rooms(&self) -> Result {
+	if self.body.len() < 2
+		|| !self.body[0].trim().starts_with("```")
+		|| self.body.last().unwrap_or(&"").trim() != "```"
+	{
+		return Err!("Expected code block in command body. Add --help for details.",);
+	}
+
+	let rooms_s = self
+		.body
+		.to_vec()
+		.drain(1..self.body.len().saturating_sub(1))
+		.collect::<Vec<_>>();
+
+	let admin_room_alias = &self.services.globals.admin_alias;
+
+	let mut room_ban_count: usize = 0;
+	let mut room_ids: Vec<OwnedRoomId> = Vec::new();
+
+	for &room in &rooms_s {
+		match <&RoomOrAliasId>::try_from(room) {
+			| Ok(room_alias_or_id) => {
+				if let Ok(admin_room_id) = self.services.admin.get_admin_room().await {
+					if room.to_owned().eq(&admin_room_id) || room.to_owned().eq(admin_room_alias)
+					{
+						warn!("User specified admin room in bulk ban list, ignoring");
+						continue;
+					}
+				}
+
+				if room_alias_or_id.is_room_id() {
+					let room_id = match RoomId::parse(room_alias_or_id) {
+						| Ok(room_id) => room_id,
+						| Err(e) => {
+							// ignore rooms we failed to parse
+							warn!(
+								"Error parsing room \"{room}\" during bulk room banning, \
+								 ignoring error and logging here: {e}"
+							);
+							continue;
+						},
+					};
+
+					room_ids.push(room_id.clone());
+				}
+
+				if room_alias_or_id.is_room_alias_id() {
+					match RoomAliasId::parse(room_alias_or_id) {
+						| Ok(room_alias) => {
+							let room_id = match self
+								.services
+								.rooms
+								.alias
+								.resolve_local_alias(&room_alias)
+								.await
+							{
+								| Ok(room_id) => room_id,
+								| _ => {
+									debug!(
+										"We don't have this room alias to a room ID locally, \
+										 attempting to fetch room ID over federation"
+									);
+
+									match self
+										.services
+										.rooms
+										.alias
+										.resolve_alias(&room_alias)
+										.await
+									{
+										| Ok((room_id, servers)) => {
+											debug!(
+												%room_id,
+												?servers,
+												"Got federation response fetching room ID for \
+												 {room}",
+											);
+											room_id
+										},
+										| Err(e) => {
+											warn!(
+												"Failed to resolve room alias {room} to a room \
+												 ID: {e}"
+											);
+											continue;
+										},
+									}
+								},
+							};
+
+							room_ids.push(room_id);
+						},
+						| Err(e) => {
+							warn!(
+								"Error parsing room \"{room}\" during bulk room banning, \
+								 ignoring error and logging here: {e}"
+							);
+							continue;
+						},
+					}
+				}
+			},
+			| Err(e) => {
+				warn!(
+					"Error parsing room \"{room}\" during bulk room banning, ignoring error and \
+					 logging here: {e}"
+				);
+				continue;
+			},
+		}
+	}
+
+	for room_id in room_ids {
+		debug!("Banned {room_id} successfully");
+		room_ban_count = room_ban_count.saturating_add(1);
+
+		debug!("Making all users leave the room {room_id} and forgetting it");
 		let mut users = self
 			.services
 			.rooms
@@ -120,7 +286,7 @@ async fn ban_room(&self, room: OwnedRoomOrAliasId) -> Result {
 			.boxed();

 		while let Some(ref user_id) = users.next().await {
-			info!(
+			debug!(
 				"Attempting leave for user {user_id} in room {room_id} (ignoring all errors, \
 				 evicting admins too)",
 			);
@@ -135,6 +301,7 @@ async fn ban_room(&self, room: OwnedRoomOrAliasId) -> Result {
 			self.services.rooms.state_cache.forget(&room_id, user_id);
 		}

+		// remove any local aliases, ignore errors
 		self.services
 			.rooms
 			.alias
@@ -149,307 +316,139 @@ async fn ban_room(&self, room: OwnedRoomOrAliasId) -> Result {
 			})
 			.await;

-		self.services.rooms.directory.set_not_public(&room_id); // remove from the room directory
-		self.services.rooms.metadata.ban_room(&room_id, true); // prevent further joins
-		self.services.rooms.metadata.disable_room(&room_id, true); // disable federation
-
-		self.write_str(
-			"Room banned, removed all our local users, and disabled incoming federation with \
-			 room.",
-		)
-		.await
+		self.services.rooms.metadata.ban_room(&room_id, true);
+		// unpublish from room directory, ignore errors
+		self.services.rooms.directory.set_not_public(&room_id);
+		self.services.rooms.metadata.disable_room(&room_id, true);
 	}

-	async fn ban_list_of_rooms(&self) -> Result {
-		if self.body.len() < 2
-			|| !self.body[0].trim().starts_with("```")
-			|| self.body.last().unwrap_or(&"").trim() != "```"
-		{
-			return Err!("Expected code block in command body. Add --help for details.",);
-		}
+	self.write_str(&format!(
+		"Finished bulk room ban, banned {room_ban_count} total rooms, evicted all users, and \
+		 disabled incoming federation with the room."
+	))
+	.await
+}

-		let rooms_s = self
-			.body
-			.to_vec()
-			.drain(1..self.body.len().saturating_sub(1))
-			.collect::<Vec<_>>();
-
-		let admin_room_alias = &self.services.globals.admin_alias;
-
-		let mut room_ban_count: usize = 0;
-		let mut room_ids: Vec<OwnedRoomId> = Vec::new();
-
-		for &room in &rooms_s {
-			match <&RoomOrAliasId>::try_from(room) {
-				| Ok(room_alias_or_id) => {
-					if let Ok(admin_room_id) = self.services.admin.get_admin_room().await {
-						if room.to_owned().eq(&admin_room_id)
-							|| room.to_owned().eq(admin_room_alias)
-						{
-							warn!("User specified admin room in bulk ban list, ignoring");
-							continue;
-						}
-					}
-
-					if room_alias_or_id.is_room_id() {
-						let room_id = match RoomId::parse(room_alias_or_id) {
-							| Ok(room_id) => room_id,
-							| Err(e) => {
-								// ignore rooms we failed to parse
-								warn!(
-									"Error parsing room \"{room}\" during bulk room banning, \
-									 ignoring error and logging here: {e}"
-								);
-								continue;
-							},
-						};
-
-						room_ids.push(room_id.clone());
-					}
-
-					if room_alias_or_id.is_room_alias_id() {
-						match RoomAliasId::parse(room_alias_or_id) {
-							| Ok(room_alias) => {
-								let room_id = match self
-									.services
-									.rooms
-									.alias
-									.resolve_local_alias(&room_alias)
-									.await
-								{
-									| Ok(room_id) => room_id,
-									| _ => {
-										debug!(
-											"We don't have this room alias to a room ID \
-											 locally, attempting to fetch room ID over \
-											 federation"
-										);
-
-										match self
-											.services
-											.rooms
-											.alias
-											.resolve_alias(&room_alias)
-											.await
-										{
-											| Ok((room_id, servers)) => {
-												debug!(
-													%room_id,
-													?servers,
-													"Got federation response fetching room ID for \
-													 {room}",
-												);
-												room_id
-											},
-											| Err(e) => {
-												warn!(
-													"Failed to resolve room alias {room} to a \
-													 room ID: {e}"
-												);
-												continue;
-											},
-										}
-									},
-								};
-
-								room_ids.push(room_id);
-							},
-							| Err(e) => {
-								warn!(
-									"Error parsing room \"{room}\" during bulk room banning, \
-									 ignoring error and logging here: {e}"
-								);
-								continue;
-							},
-						}
-					}
-				},
-				| Err(e) => {
-					warn!(
-						"Error parsing room \"{room}\" during bulk room banning, ignoring error \
-						 and logging here: {e}"
-					);
-					continue;
-				},
-			}
-		}
-
-		for room_id in room_ids {
-			debug!("Banned {room_id} successfully");
-			room_ban_count = room_ban_count.saturating_add(1);
-
-			debug!("Making all users leave the room {room_id} and forgetting it");
-			let mut users = self
-				.services
-				.rooms
-				.state_cache
-				.room_members(&room_id)
-				.ready_filter(|user| self.services.globals.user_is_local(user))
-				.boxed();
-
-			while let Some(ref user_id) = users.next().await {
-				debug!(
-					"Attempting leave for user {user_id} in room {room_id} (ignoring all \
-					 errors, evicting admins too)",
+#[admin_command]
+async fn unban_room(&self, room: OwnedRoomOrAliasId) -> Result {
+	let room_id = if room.is_room_id() {
+		let room_id = match RoomId::parse(&room) {
+			| Ok(room_id) => room_id,
+			| Err(e) => {
+				return Err!(
+					"Failed to parse room ID {room}. Please note that this requires a full room \
+					 ID (`!awIh6gGInaS5wLQJwa:example.com`) or a room alias \
+					 (`#roomalias:example.com`): {e}"
 				);
-
-				if let Err(e) = leave_room(self.services, user_id, &room_id, None)
-					.boxed()
-					.await
-				{
-					warn!("Failed to leave room: {e}");
-				}
-
-				self.services.rooms.state_cache.forget(&room_id, user_id);
-			}
-
-			// remove any local aliases, ignore errors
-			self.services
-				.rooms
-				.alias
-				.local_aliases_for_room(&room_id)
-				.for_each(|local_alias| async move {
-					self.services
-						.rooms
-						.alias
-						.remove_alias(&local_alias, &self.services.globals.server_user)
-						.await
-						.ok();
-				})
-				.await;
-
-			self.services.rooms.metadata.ban_room(&room_id, true);
-			// unpublish from room directory, ignore errors
-			self.services.rooms.directory.set_not_public(&room_id);
-			self.services.rooms.metadata.disable_room(&room_id, true);
-		}
-
-		self.write_str(&format!(
-			"Finished bulk room ban, banned {room_ban_count} total rooms, evicted all users, \
-			 and disabled incoming federation with the room."
-		))
-		.await
-	}
-
-	async fn unban_room(&self, room: OwnedRoomOrAliasId) -> Result {
-		let room_id = if room.is_room_id() {
-			let room_id = match RoomId::parse(&room) {
-				| Ok(room_id) => room_id,
-				| Err(e) => {
-					return Err!(
-						"Failed to parse room ID {room}. Please note that this requires a full \
-						 room ID (`!awIh6gGInaS5wLQJwa:example.com`) or a room alias \
-						 (`#roomalias:example.com`): {e}"
-					);
-				},
-			};
-
-			debug!("Room specified is a room ID, unbanning room ID");
-			self.services.rooms.metadata.ban_room(&room_id, false);
-
-			room_id.clone()
-		} else if room.is_room_alias_id() {
-			let room_alias = match RoomAliasId::parse(&room) {
-				| Ok(room_alias) => room_alias,
-				| Err(e) => {
-					return Err!(
-						"Failed to parse room ID {room}. Please note that this requires a full \
-						 room ID (`!awIh6gGInaS5wLQJwa:example.com`) or a room alias \
-						 (`#roomalias:example.com`): {e}"
-					);
-				},
-			};
-
-			debug!(
-				"Room specified is not a room ID, attempting to resolve room alias to a room ID \
-				 locally, if not using get_alias_helper to fetch room ID remotely"
-			);
-
-			let room_id = match self
-				.services
-				.rooms
-				.alias
-				.resolve_local_alias(&room_alias)
-				.await
-			{
-				| Ok(room_id) => room_id,
-				| _ => {
-					debug!(
-						"We don't have this room alias to a room ID locally, attempting to \
-						 fetch room ID over federation"
-					);
-
-					match self.services.rooms.alias.resolve_alias(&room_alias).await {
-						| Ok((room_id, servers)) => {
-							debug!(
-								%room_id,
-								?servers,
-								"Got federation response fetching room ID for room {room}"
-							);
-							room_id
-						},
-						| Err(e) => {
-							return Err!("Failed to resolve room alias {room} to a room ID: {e}");
-						},
-					}
-				},
-			};
-
-			self.services.rooms.metadata.ban_room(&room_id, false);
-
-			room_id
-		} else {
-			return Err!(
-				"Room specified is not a room ID or room alias. Please note that this requires \
-				 a full room ID (`!awIh6gGInaS5wLQJwa:example.com`) or a room alias \
-				 (`#roomalias:example.com`)",
-			);
+			},
 		};

-		self.services.rooms.metadata.disable_room(&room_id, false);
-		self.write_str("Room unbanned and federation re-enabled.")
-			.await
-	}
+		debug!("Room specified is a room ID, unbanning room ID");
+		self.services.rooms.metadata.ban_room(&room_id, false);

-	async fn list_banned_rooms(&self, no_details: bool) -> Result {
-		let room_ids: Vec<OwnedRoomId> = self
+		room_id.clone()
+	} else if room.is_room_alias_id() {
+		let room_alias = match RoomAliasId::parse(&room) {
+			| Ok(room_alias) => room_alias,
+			| Err(e) => {
+				return Err!(
+					"Failed to parse room ID {room}. Please note that this requires a full room \
+					 ID (`!awIh6gGInaS5wLQJwa:example.com`) or a room alias \
+					 (`#roomalias:example.com`): {e}"
+				);
+			},
+		};
+
+		debug!(
+			"Room specified is not a room ID, attempting to resolve room alias to a room ID \
+			 locally, if not using get_alias_helper to fetch room ID remotely"
+		);
+
+		let room_id = match self
 			.services
 			.rooms
-			.metadata
-			.list_banned_rooms()
-			.map(Into::into)
-			.collect()
-			.await;
-
-		if room_ids.is_empty() {
-			return Err!("No rooms are banned.");
-		}
-
-		let mut rooms = room_ids
-			.iter()
-			.stream()
-			.then(|room_id| get_room_info(self.services, room_id))
-			.collect::<Vec<_>>()
-			.await;
-
-		rooms.sort_by_key(|r| r.1);
-		rooms.reverse();
-
-		let num = rooms.len();
-
-		let body = rooms
-			.iter()
-			.map(|(id, members, name)| {
-				if no_details {
-					format!("{id}")
-				} else {
-					format!("{id}\tMembers: {members}\tName: {name}")
-				}
-			})
-			.collect::<Vec<_>>()
-			.join("\n");
-
-		self.write_str(&format!("Rooms Banned ({num}):\n```\n{body}\n```"))
+			.alias
+			.resolve_local_alias(&room_alias)
 			.await
-	}
+		{
+			| Ok(room_id) => room_id,
+			| _ => {
+				debug!(
+					"We don't have this room alias to a room ID locally, attempting to fetch \
+					 room ID over federation"
+				);
+
+				match self.services.rooms.alias.resolve_alias(&room_alias).await {
+					| Ok((room_id, servers)) => {
+						debug!(
+							%room_id,
+							?servers,
+							"Got federation response fetching room ID for room {room}"
+						);
+						room_id
+					},
+					| Err(e) => {
+						return Err!("Failed to resolve room alias {room} to a room ID: {e}");
+					},
+				}
+			},
+		};
+
+		self.services.rooms.metadata.ban_room(&room_id, false);
+
+		room_id
+	} else {
+		return Err!(
+			"Room specified is not a room ID or room alias. Please note that this requires a \
+			 full room ID (`!awIh6gGInaS5wLQJwa:example.com`) or a room alias \
+			 (`#roomalias:example.com`)",
+		);
+	};
+
+	self.services.rooms.metadata.disable_room(&room_id, false);
+	self.write_str("Room unbanned and federation re-enabled.")
+		.await
+}
+
+#[admin_command]
+async fn list_banned_rooms(&self, no_details: bool) -> Result {
+	let room_ids: Vec<OwnedRoomId> = self
+		.services
+		.rooms
+		.metadata
+		.list_banned_rooms()
+		.map(Into::into)
+		.collect()
+		.await;
+
+	if room_ids.is_empty() {
+		return Err!("No rooms are banned.");
+	}
+
+	let mut rooms = room_ids
+		.iter()
+		.stream()
+		.then(|room_id| get_room_info(self.services, room_id))
+		.collect::<Vec<_>>()
+		.await;
+
+	rooms.sort_by_key(|r| r.1);
+	rooms.reverse();
+
+	let num = rooms.len();
+
+	let body = rooms
+		.iter()
+		.map(|(id, members, name)| {
+			if no_details {
+				format!("{id}")
+			} else {
+				format!("{id}\tMembers: {members}\tName: {name}")
+			}
+		})
+		.collect::<Vec<_>>()
+		.join("\n");
+
+	self.write_str(&format!("Rooms Banned ({num}):\n```\n{body}\n```"))
+		.await
 }
@@ -7,230 +7,243 @@
 };
 use futures::TryStreamExt;

-impl crate::Context<'_> {
-	pub(super) async fn uptime(&self) -> Result {
-		let elapsed = self
-			.services
-			.server
-			.started
-			.elapsed()
-			.expect("standard duration");
+use crate::admin_command;

-		let result = time::pretty(elapsed);
-		self.write_str(&format!("{result}.")).await
-	}
+#[admin_command]
+pub(super) async fn uptime(&self) -> Result {
+	let elapsed = self
+		.services
+		.server
+		.started
+		.elapsed()
+		.expect("standard duration");

-	pub(super) async fn show_config(&self) -> Result {
-		self.bail_restricted()?;
-
-		self.write_str(&format!("{}", *self.services.server.config))
-			.await
-	}
-
-	pub(super) async fn reload_config(&self, path: Option<PathBuf>) -> Result {
-		// The path argument is only what's optionally passed via the admin command,
-		// so we need to merge it with the existing paths if any were given at startup.
-		let mut paths = Vec::new();
-
-		// Add previously saved paths to the argument list
-		self.services
-			.config
-			.config_paths
-			.clone()
-			.unwrap_or_default()
-			.iter()
-			.for_each(|p| paths.push(p.to_owned()));
-
-		// If a path is given, and it's not already in the list,
-		// add it last, so that it overrides earlier files
-		if let Some(p) = path {
-			if !paths.contains(&p) {
-				paths.push(p);
-			}
-		}
-
-		self.services.config.reload(&paths)?;
-
-		self.write_str(&format!("Successfully reconfigured from paths: {paths:?}"))
-			.await
-	}
-
-	pub(super) async fn memory_usage(&self) -> Result {
-		let services_usage = self.services.memory_usage().await?;
-		let database_usage = self.services.db.db.memory_usage()?;
-		let allocator_usage = conduwuit::alloc::memory_usage()
-			.map_or(String::new(), |s| format!("\nAllocator:\n{s}"));
-
-		self.write_str(&format!(
-			"Services:\n{services_usage}\nDatabase:\n{database_usage}{allocator_usage}",
-		))
-		.await
-	}
-
-	pub(super) async fn clear_caches(&self) -> Result {
-		self.services.clear_cache().await;
-
-		self.write_str("Done.").await
-	}
-
-	pub(super) async fn list_backups(&self) -> Result {
-		self.services
-			.db
-			.db
-			.backup_list()?
-			.try_stream()
-			.try_for_each(|result| writeln!(self, "{result}"))
-			.await
-	}
-
-	pub(super) async fn backup_database(&self) -> Result {
-		self.bail_restricted()?;
-
-		let db = Arc::clone(&self.services.db);
-		let result = self
-			.services
-			.server
-			.runtime()
-			.spawn_blocking(move || match db.db.backup() {
-				| Ok(()) => "Done".to_owned(),
-				| Err(e) => format!("Failed: {e}"),
-			})
-			.await?;
-
-		let count = self.services.db.db.backup_count()?;
-		self.write_str(&format!("{result}. Currently have {count} backups."))
-			.await
-	}
-
-	pub(super) async fn admin_notice(&self, message: Vec<String>) -> Result {
-		let message = message.join(" ");
-		self.services.admin.send_text(&message).await;
-
-		self.write_str("Notice was sent to #admins").await
-	}
-
-	pub(super) async fn reload_mods(&self) -> Result {
-		self.bail_restricted()?;
-
-		self.services.server.reload()?;
-
-		self.write_str("Reloading server...").await
-	}
-
-	#[cfg(unix)]
-	pub(super) async fn restart(&self, force: bool) -> Result {
-		use conduwuit::utils::sys::current_exe_deleted;
-
-		if !force && current_exe_deleted() {
-			return Err!(
-				"The server cannot be restarted because the executable changed. If this is \
-				 expected use --force to override."
-			);
-		}
-
-		self.services.server.restart()?;
-
-		self.write_str("Restarting server...").await
-	}
-
-	pub(super) async fn shutdown(&self) -> Result {
-		self.bail_restricted()?;
-
-		warn!("shutdown command");
-		self.services.server.shutdown()?;
-
-		self.write_str("Shutting down server...").await
-	}
-
-	pub(super) async fn list_features(&self) -> Result {
-		let mut enabled_features = conduwuit::info::introspection::ENABLED_FEATURES
-			.lock()
-			.expect("locked")
-			.values()
-			.flat_map(|f| f.iter())
-			.collect::<Vec<_>>();
-
-		enabled_features.sort_unstable();
-		enabled_features.dedup();
-
-		let mut available_features = conduwuit::build_metadata::WORKSPACE_FEATURES
-			.iter()
-			.flat_map(|(_, f)| f.iter())
-			.collect::<Vec<_>>();
-
-		available_features.sort_unstable();
-		available_features.dedup();
-
-		let mut features = String::new();
-
-		for feature in available_features {
-			let active = enabled_features.contains(&feature);
-			let emoji = if active { "✅" } else { "❌" };
-			let remark = if active { "[enabled]" } else { "" };
-			writeln!(features, "{emoji} {feature} {remark}")?;
-		}
-
-		self.write_str(&features).await
-	}
-
-	pub(super) async fn build_info(&self) -> Result {
-		use conduwuit::build_metadata::built;
-
-		let mut info = String::new();
-
-		// Version information
-		writeln!(info, "# Build Information\n")?;
-		writeln!(info, "**Version:** {}", built::PKG_VERSION)?;
-		writeln!(info, "**Package:** {}", built::PKG_NAME)?;
-		writeln!(info, "**Description:** {}", built::PKG_DESCRIPTION)?;
-
-		// Git information
-		writeln!(info, "\n## Git Information\n")?;
-		if let Some(hash) = conduwuit::build_metadata::GIT_COMMIT_HASH {
-			writeln!(info, "**Commit Hash:** {hash}")?;
-		}
-		if let Some(hash) = conduwuit::build_metadata::GIT_COMMIT_HASH_SHORT {
-			writeln!(info, "**Commit Hash (short):** {hash}")?;
-		}
-		if let Some(url) = conduwuit::build_metadata::GIT_REMOTE_WEB_URL {
-			writeln!(info, "**Repository:** {url}")?;
-		}
-		if let Some(url) = conduwuit::build_metadata::GIT_REMOTE_COMMIT_URL {
-			writeln!(info, "**Commit URL:** {url}")?;
-		}
-
-		// Build environment
-		writeln!(info, "\n## Build Environment\n")?;
-		writeln!(info, "**Profile:** {}", built::PROFILE)?;
-		writeln!(info, "**Optimization Level:** {}", built::OPT_LEVEL)?;
-		writeln!(info, "**Debug:** {}", built::DEBUG)?;
-		writeln!(info, "**Target:** {}", built::TARGET)?;
-		writeln!(info, "**Host:** {}", built::HOST)?;
-
-		// Rust compiler information
-		writeln!(info, "\n## Compiler Information\n")?;
-		writeln!(info, "**Rustc Version:** {}", built::RUSTC_VERSION)?;
-		if !built::RUSTDOC_VERSION.is_empty() {
-			writeln!(info, "**Rustdoc Version:** {}", built::RUSTDOC_VERSION)?;
-		}
-
-		// Target configuration
-		writeln!(info, "\n## Target Configuration\n")?;
-		writeln!(info, "**Architecture:** {}", built::CFG_TARGET_ARCH)?;
-		writeln!(info, "**OS:** {}", built::CFG_OS)?;
-		writeln!(info, "**Family:** {}", built::CFG_FAMILY)?;
-		writeln!(info, "**Endianness:** {}", built::CFG_ENDIAN)?;
-		writeln!(info, "**Pointer Width:** {} bits", built::CFG_POINTER_WIDTH)?;
-		if !built::CFG_ENV.is_empty() {
-			writeln!(info, "**Environment:** {}", built::CFG_ENV)?;
-		}
-
-		// CI information
-		if let Some(ci) = built::CI_PLATFORM {
-			writeln!(info, "\n## CI Platform\n")?;
-			writeln!(info, "**Platform:** {ci}")?;
-		}
-
-		self.write_str(&info).await
-	}
+	let result = time::pretty(elapsed);
+	self.write_str(&format!("{result}.")).await
+}
+
+#[admin_command]
+pub(super) async fn show_config(&self) -> Result {
+	self.bail_restricted()?;
+
+	self.write_str(&format!("{}", *self.services.server.config))
+		.await
+}
+
+#[admin_command]
+pub(super) async fn reload_config(&self, path: Option<PathBuf>) -> Result {
+	// The path argument is only what's optionally passed via the admin command,
+	// so we need to merge it with the existing paths if any were given at startup.
+	let mut paths = Vec::new();
+
+	// Add previously saved paths to the argument list
+	self.services
+		.config
+		.config_paths
+		.clone()
+		.unwrap_or_default()
+		.iter()
+		.for_each(|p| paths.push(p.to_owned()));
+
+	// If a path is given, and it's not already in the list,
+	// add it last, so that it overrides earlier files
+	if let Some(p) = path {
+		if !paths.contains(&p) {
+			paths.push(p);
+		}
+	}
+
+	self.services.config.reload(&paths)?;
+
+	self.write_str(&format!("Successfully reconfigured from paths: {paths:?}"))
+		.await
+}
+
+#[admin_command]
+pub(super) async fn memory_usage(&self) -> Result {
+	let services_usage = self.services.memory_usage().await?;
+	let database_usage = self.services.db.db.memory_usage()?;
+	let allocator_usage =
+		conduwuit::alloc::memory_usage().map_or(String::new(), |s| format!("\nAllocator:\n{s}"));
+
+	self.write_str(&format!(
+		"Services:\n{services_usage}\nDatabase:\n{database_usage}{allocator_usage}",
+	))
+	.await
+}
+
+#[admin_command]
+pub(super) async fn clear_caches(&self) -> Result {
+	self.services.clear_cache().await;
+
+	self.write_str("Done.").await
+}
+
+#[admin_command]
+pub(super) async fn list_backups(&self) -> Result {
+	self.services
+		.db
+		.db
+		.backup_list()?
+		.try_stream()
+		.try_for_each(|result| writeln!(self, "{result}"))
+		.await
+}
+
+#[admin_command]
+pub(super) async fn backup_database(&self) -> Result {
+	self.bail_restricted()?;
+
+	let db = Arc::clone(&self.services.db);
+	let result = self
+		.services
+		.server
+		.runtime()
+		.spawn_blocking(move || match db.db.backup() {
+			| Ok(()) => "Done".to_owned(),
+			| Err(e) => format!("Failed: {e}"),
+		})
+		.await?;
+
+	let count = self.services.db.db.backup_count()?;
+	self.write_str(&format!("{result}. Currently have {count} backups."))
+		.await
+}
+
+#[admin_command]
+pub(super) async fn admin_notice(&self, message: Vec<String>) -> Result {
+	let message = message.join(" ");
+	self.services.admin.send_text(&message).await;
+
+	self.write_str("Notice was sent to #admins").await
+}
+
+#[admin_command]
+pub(super) async fn reload_mods(&self) -> Result {
+	self.bail_restricted()?;
+
+	self.services.server.reload()?;
+
+	self.write_str("Reloading server...").await
+}
+
+#[admin_command]
+#[cfg(unix)]
+pub(super) async fn restart(&self, force: bool) -> Result {
+	use conduwuit::utils::sys::current_exe_deleted;
+
+	if !force && current_exe_deleted() {
+		return Err!(
+			"The server cannot be restarted because the executable changed. If this is expected \
+			 use --force to override."
+		);
+	}
+
+	self.services.server.restart()?;
+
+	self.write_str("Restarting server...").await
+}
+
+#[admin_command]
+pub(super) async fn shutdown(&self) -> Result {
+	self.bail_restricted()?;
+
+	warn!("shutdown command");
+	self.services.server.shutdown()?;
+
+	self.write_str("Shutting down server...").await
+}
+
+#[admin_command]
+pub(super) async fn list_features(&self) -> Result {
+	let mut enabled_features = conduwuit::info::introspection::ENABLED_FEATURES
+		.lock()
+		.expect("locked")
+		.values()
+		.flat_map(|f| f.iter())
+		.collect::<Vec<_>>();
+
+	enabled_features.sort_unstable();
+	enabled_features.dedup();
+
+	let mut available_features = conduwuit::build_metadata::WORKSPACE_FEATURES
+		.iter()
+		.flat_map(|(_, f)| f.iter())
+		.collect::<Vec<_>>();
+
+	available_features.sort_unstable();
+	available_features.dedup();
+
+	let mut features = String::new();
+
+	for feature in available_features {
+		let active = enabled_features.contains(&feature);
+		let emoji = if active { "✅" } else { "❌" };
+		let remark = if active { "[enabled]" } else { "" };
+		writeln!(features, "{emoji} {feature} {remark}")?;
+	}
+
+	self.write_str(&features).await
+}
+
+#[admin_command]
+pub(super) async fn build_info(&self) -> Result {
+	use conduwuit::build_metadata::built;
+
+	let mut info = String::new();
+
+	// Version information
+	writeln!(info, "# Build Information\n")?;
+	writeln!(info, "**Version:** {}", built::PKG_VERSION)?;
+	writeln!(info, "**Package:** {}", built::PKG_NAME)?;
+	writeln!(info, "**Description:** {}", built::PKG_DESCRIPTION)?;
+
+	// Git information
+	writeln!(info, "\n## Git Information\n")?;
+	if let Some(hash) = conduwuit::build_metadata::GIT_COMMIT_HASH {
+		writeln!(info, "**Commit Hash:** {hash}")?;
+	}
+	if let Some(hash) = conduwuit::build_metadata::GIT_COMMIT_HASH_SHORT {
+		writeln!(info, "**Commit Hash (short):** {hash}")?;
+	}
+	if let Some(url) = conduwuit::build_metadata::GIT_REMOTE_WEB_URL {
+		writeln!(info, "**Repository:** {url}")?;
+	}
+	if let Some(url) = conduwuit::build_metadata::GIT_REMOTE_COMMIT_URL {
+		writeln!(info, "**Commit URL:** {url}")?;
+	}
+
+	// Build environment
+	writeln!(info, "\n## Build Environment\n")?;
+	writeln!(info, "**Profile:** {}", built::PROFILE)?;
+	writeln!(info, "**Optimization Level:** {}", built::OPT_LEVEL)?;
+	writeln!(info, "**Debug:** {}", built::DEBUG)?;
+	writeln!(info, "**Target:** {}", built::TARGET)?;
+	writeln!(info, "**Host:** {}", built::HOST)?;
+
+	// Rust compiler information
+	writeln!(info, "\n## Compiler Information\n")?;
+	writeln!(info, "**Rustc Version:** {}", built::RUSTC_VERSION)?;
+	if !built::RUSTDOC_VERSION.is_empty() {
+		writeln!(info, "**Rustdoc Version:** {}", built::RUSTDOC_VERSION)?;
+	}
+
+	// Target configuration
+	writeln!(info, "\n## Target Configuration\n")?;
+	writeln!(info, "**Architecture:** {}", built::CFG_TARGET_ARCH)?;
+	writeln!(info, "**OS:** {}", built::CFG_OS)?;
+	writeln!(info, "**Family:** {}", built::CFG_FAMILY)?;
+	writeln!(info, "**Endianness:** {}", built::CFG_ENDIAN)?;
+	writeln!(info, "**Pointer Width:** {} bits", built::CFG_POINTER_WIDTH)?;
+	if !built::CFG_ENV.is_empty() {
+		writeln!(info, "**Environment:** {}", built::CFG_ENV)?;
+	}
+
+	// CI information
+	if let Some(ci) = built::CI_PLATFORM {
+		writeln!(info, "\n## CI Platform\n")?;
+		writeln!(info, "**Platform:** {ci}")?;
+	}
+
+	self.write_str(&info).await
 }
@@ -1,99 +1,82 @@
 use conduwuit::{Err, Result, utils};
+use conduwuit_macros::admin_command;
 use futures::StreamExt;
 use service::registration_tokens::TokenExpires;

-impl crate::Context<'_> {
-	pub(super) async fn issue_token(&self, expires: super::TokenExpires) -> Result {
-		let expires = {
-			if expires.immortal {
-				None
-			} else if let Some(max_uses) = expires.max_uses {
-				Some(TokenExpires::AfterUses(max_uses))
-			} else if expires.once {
-				Some(TokenExpires::AfterUses(1))
-			} else if let Some(max_age) = expires
-				.max_age
-				.as_deref()
-				.map(|max_age| {
-					utils::time::timepoint_from_now(utils::time::parse_duration(max_age)?)
-				})
-				.transpose()?
-			{
-				Some(TokenExpires::AfterTime(max_age))
-			} else {
-				unreachable!();
-			}
-		};
+#[admin_command]
+pub(super) async fn issue_token(&self, expires: super::TokenExpires) -> Result {
+	let expires = {
+		let max_uses = expires.max_uses;
+		let max_age = expires
+			.max_age
+			.as_deref()
+			.map(|max_age| utils::time::timepoint_from_now(utils::time::parse_duration(max_age)?))
+			.transpose()?;

-		let (token, info) = self
-			.services
-			.registration_tokens
-			.issue_token(self.sender_or_service_user().into(), expires);
+		if expires.immortal {
+			None
+		} else if let Some(max_uses) = max_uses
+			&& let Some(max_age) = max_age
+		{
+			Some(TokenExpires::AfterTimeOrUses { max_uses, max_age })
+		} else if let Some(max_uses) = max_uses {
+			Some(TokenExpires::AfterUses(max_uses))
+		} else if expires.once {
+			Some(TokenExpires::AfterUses(1))
+		} else if let Some(max_age) = max_age {
+			Some(TokenExpires::AfterTime(max_age))
+		} else {
+			unreachable!();
+		}
+	};

-		self.write_str(&format!(
-			"New registration token issued: `{token}` . {}.",
-			if let Some(expires) = info.expires {
-				format!("{expires}")
-			} else {
-				"Never expires".to_owned()
-			}
-		))
+	let (token, info) = self
+		.services
+		.registration_tokens
+		.issue_token(self.sender_or_service_user().into(), expires);
+
+	self.write_str(&format!(
+		"New registration token issued: `{token}`. {}.",
+		if let Some(expires) = info.expires {
+			format!("{expires}")
+		} else {
+			"Never expires".to_owned()
+		}
+	))
+	.await
+}
+
+#[admin_command]
+pub(super) async fn revoke_token(&self, token: String) -> Result {
+	let Some(token) = self
+		.services
+		.registration_tokens
+		.validate_token(token)
+		.await
+	else {
+		return Err!("This token does not exist or has already expired.");
+	};
+
+	self.services.registration_tokens.revoke_token(token)?;
+
+	self.write_str("Token revoked successfully.").await
+}
+
+#[admin_command]
+pub(super) async fn list_tokens(&self) -> Result {
+	let tokens: Vec<_> = self
+		.services
+		.registration_tokens
+		.iterate_tokens()
+		.collect()
+		.await;
+
+	self.write_str(&format!("Found {} registration tokens:\n", tokens.len()))
 		.await?;

-		if self
-			.services
-			.config
-			.oauth
-			.compatibility_mode
-			.oauth_available()
-		{
-			self.write_str(&format!(
-				"\nInvite link using this token: {}",
-				self.services
-					.config
-					.get_client_domain()
-					.join(&format!(
-						"{}/account/register/?flow=trusted&token={token}",
-						conduwuit::ROUTE_PREFIX
-					))
-					.unwrap()
-			))
-			.await?;
-		}
-
-		Ok(())
+	for token in tokens {
+		self.write_str(&format!("- {token}\n")).await?;
 	}

-	pub(super) async fn revoke_token(&self, token: String) -> Result {
-		let Some(token) = self
-			.services
-			.registration_tokens
-			.validate_token(token)
-			.await
-		else {
-			return Err!("This token does not exist or has already expired.");
-		};
-
-		self.services.registration_tokens.revoke_token(token)?;
-
-		self.write_str("Token revoked successfully.").await
-	}
-
-	pub(super) async fn list_tokens(&self) -> Result {
-		let tokens: Vec<_> = self
-			.services
-			.registration_tokens
-			.iterate_tokens()
-			.collect()
-			.await;
-
-		self.write_str(&format!("Found {} registration tokens:\n", tokens.len()))
-			.await?;
-
-		for token in tokens {
-			self.write_str(&format!("- {token}\n")).await?;
-		}
-
-		Ok(())
-	}
+	Ok(())
 }
@@ -29,23 +29,23 @@ pub enum TokenCommand {
 }

 #[derive(Debug, Args)]
-#[group(required = true, multiple = false)]
+#[group(required = true, multiple = true)]
 pub struct TokenExpires {
 	/// The maximum number of times this token is allowed to be used before it
 	/// expires.
-	#[arg(long)]
+	#[arg(long, conflicts_with_all = ["immortal", "once"])]
 	max_uses: Option<u64>,

 	/// The maximum age of this token (e.g. 30s, 5m, 7d). It will expire after
 	/// this much time has passed.
-	#[arg(long)]
+	#[arg(long, conflicts_with_all = ["immortal", "once"])]
 	max_age: Option<String>,

 	/// This token will never expire.
-	#[arg(long)]
+	#[arg(long, conflicts_with_all = ["once", "max_uses", "max_age"])]
 	immortal: bool,

 	/// A shortcut for `--max-uses 1`.
-	#[arg(long)]
+	#[arg(long, conflicts_with_all = ["immortal", "max_uses", "max_age"])]
 	once: bool,
 }
@@ -29,6 +29,12 @@ pub enum UserCommand {
 		password: Option<String>,
 	},

+	/// Issue a self-service password reset link for a user.
+	IssuePasswordResetLink {
+		/// Username of the user who may use the link
+		username: String,
+	},
+
 	/// Get a user's associated email address.
 	GetEmail {
 		user_id: String,
@@ -24,7 +24,7 @@
 		power_levels::RoomPowerLevelsEventContent,
 	},
 };
-use service::{mailer::messages, uiaa::UiaaInitiator, users::HashedPassword};
+use service::{mailer::messages, uiaa::Identity, users::HashedPassword};

 use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH};
 use crate::{Ruma, router::ClientIdentity};
@@ -49,16 +49,39 @@ pub(crate) async fn get_register_available_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<get_username_availability::v3::Request>,
 ) -> Result<get_username_availability::v3::Response> {
-	let _ = services
-		.users
-		.determine_registration_user_id(
-			Some(body.username.clone()),
-			None,
-			body.identity
-				.as_ref()
-				.and_then(ClientIdentity::appservice_info),
-		)
-		.await?;
+	// Validate user id
+	let user_id =
+		match UserId::parse_with_server_name(&body.username, services.globals.server_name()) {
+			| Ok(user_id) => {
+				if let Err(e) = user_id.validate_strict() {
+					return Err!(Request(InvalidUsername(debug_warn!(
+						"Username {} contains disallowed characters or spaces: {e}",
+						body.username
+					))));
+				}
+
+				user_id
+			},
+			| Err(e) => {
+				return Err!(Request(InvalidUsername(debug_warn!(
+					"Username {} is not valid: {e}",
+					body.username
+				))));
+			},
+		};
+
+	// Check if username is creative enough
+	if services.users.exists(&user_id).await {
+		return Err!(Request(UserInUse("User ID is not available.")));
+	}
+
+	if let Some(ClientIdentity::Appservice { appservice_info, .. }) = &body.identity
+		&& !appservice_info.is_user_match(&user_id)
+	{
+		return Err!(Request(Exclusive("Username is not in an appservice namespace.")));
+	} else if services.appservice.is_exclusive_user_id(&user_id).await {
+		return Err!(Request(Exclusive("Username is reserved by an appservice.")));
+	}

 	Ok(get_username_availability::v3::Response::new(true))
 }
@@ -86,7 +109,12 @@ pub(crate) async fn change_password_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<change_password::v3::Request>,
 ) -> Result<change_password::v3::Response> {
-	let identity = if let Some(identity) = body.identity.as_ref() {
+	let identity = if let Some(user_id) = body
+		.identity
+		.as_ref()
+		.map(ClientIdentity::expect_sender_user)
+		.transpose()?
+	{
 		// A signed-in user is trying to change their password, prompt them for their
 		// existing one

@@ -96,10 +124,7 @@ pub(crate) async fn change_password_route(
 				&body.auth,
 				vec![AuthFlow::new(vec![AuthType::Password])],
 				Box::default(),
-				Some(UiaaInitiator::new(
-					identity.expect_sender_user()?,
-					identity.sender_device(),
-				)),
+				Some(Identity::from_user_id(user_id)),
 			)
 			.await?
 	} else {
@@ -255,24 +280,16 @@ pub(crate) async fn deactivate_route(
 ) -> Result<deactivate::v3::Response> {
 	// Authentication for this endpoint is technically optional,
 	// but we require the user to be logged in
-	let identity = body
+	let sender_user = body
 		.identity
 		.as_ref()
-		.ok_or_else(|| err!(Request(MissingToken("Missing access token."))))?;
-
-	let sender_user = identity.expect_sender_user()?;
-
-	if !services.config.allow_deactivation {
-		return Err!(Request(Forbidden(
-			"You may not deactivate your own account. Contact your server's administrator for \
-			 assistance."
-		)));
-	}
+		.map(ClientIdentity::expect_sender_user)
+		.ok_or_else(|| err!(Request(MissingToken("Missing access token."))))??;

 	// Prompt the user to confirm with their password using UIAA
 	let _ = services
 		.uiaa
-		.authenticate_password(&body.auth, sender_user, identity.sender_device(), None)
+		.authenticate_password(&body.auth, Some(Identity::from_user_id(sender_user)))
 		.await?;

 	// Remove profile pictures and display name
@@ -1,15 +1,17 @@
-use std::collections::HashMap;
+use std::{collections::HashMap, fmt::Write};

 use axum::extract::State;
 use axum_client_ip::ClientIp;
 use conduwuit::{
-	Err, Result, debug_info, info,
+	Err, Result, debug_info, error, info,
 	utils::{self},
+	warn,
 };
 use conduwuit_service::Services;
-use futures::StreamExt;
+use futures::{FutureExt, StreamExt};
 use lettre::{Address, message::Mailbox};
 use ruma::{
+	OwnedUserId, UserId,
 	api::client::{
 		account::{
 			register::{self, LoginType, RegistrationKind},
@@ -18,6 +20,11 @@
 		uiaa::{AuthFlow, AuthType},
 	},
 	assign,
+	events::{
+		GlobalAccountDataEventType, push_rules::PushRulesEvent,
+		room::message::RoomMessageEventContent,
+	},
+	push,
 };
 use serde_json::value::RawValue;
 use service::{mailer::messages, users::HashedPassword};
@@ -25,6 +32,8 @@
 use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH};
 use crate::Ruma;

+const RANDOM_USER_ID_LENGTH: usize = 10;
+
 /// # `POST /_matrix/client/v3/register`
 ///
 /// Register an account on this homeserver.
@@ -43,6 +52,8 @@ pub(crate) async fn register_route(
 		return Err!(Request(GuestAccessForbidden("Guests may not register on this server.")));
 	}

+	let emergency_mode_enabled = services.config.emergency_password.is_some();
+
 	// Allow registration if it's enabled in the config file or if this is the first
 	// run (so the first user account can be created)
 	let allow_registration =
@@ -60,59 +71,99 @@ pub(crate) async fn register_route(
 		)));
 	}

-	let user_id = if body.body.login_type == Some(LoginType::ApplicationService) {
-		let Some(appservice_info) = &body.identity else {
-			return Err!(Request(Forbidden(
-				"Only appservices can use the appservice login type."
-			)));
-		};
-
-		let user_id = services
-			.users
-			.determine_registration_user_id(body.username.clone(), None, Some(appservice_info))
-			.await?;
-
-		services.users.create(&user_id, None)?;
-
-		user_id
+	let identity = if body.identity.is_some() {
+		// Appservices can skip auth
+		None
 	} else {
 		// Perform UIAA to determine the user's identity
 		let (flows, params) = create_registration_uiaa_session(&services).await?;

-		let identity = services
-			.uiaa
-			.authenticate(&body.auth, flows, params, None)
-			.await?;
-
-		let password = if let Some(password) = &body.password {
-			HashedPassword::new(password)?
-		} else {
-			return Err!(Request(InvalidParam("A password must be provided.")));
-		};
-
-		let user_id = services
-			.users
-			.determine_registration_user_id(body.username.clone(), identity.email.as_ref(), None)
-			.await?;
-
-		services
-			.users
-			.create_local_account(&user_id, password, identity.email)
-			.await;
-
-		user_id
+		Some(
+			services
+				.uiaa
+				.authenticate(&body.auth, flows, params, None)
+				.await?,
+		)
 	};

-	let (token, device) = if !body.inhibit_login {
-		// If UIAA is disabled, we can't create a device. In that case only appservices
-		// can reach this point in the first place, so we return an error for them.
-		if !services.config.oauth.compatibility_mode.uiaa_available() {
-			return Err!(Request(AppserviceLoginUnsupported(
-				"User-interactive appservice registration is not available on this server."
-			)));
+	// If the user didn't supply a username but did supply an email, use
+	// the email's user as their initial localpart to avoid falling back to
+	// a randomly generated localpart
+	let supplied_username = body.username.clone().or_else(|| {
+		if let Some(identity) = &identity
+			&& let Some(email) = &identity.email
+		{
+			Some(email.user().to_owned())
+		} else {
+			None
 		}
+	});

-		// Generate new device id if the user didn't specify one
+	let user_id =
+		determine_registration_user_id(&services, supplied_username, emergency_mode_enabled)
+			.await?;
+
+	if body.body.login_type == Some(LoginType::ApplicationService) {
+		// For appservice logins, make sure that the user ID is in the appservice's
+		// namespace
+
+		match body.identity {
+			| Some(ref info) =>
+				if !info.is_user_match(&user_id) && !emergency_mode_enabled {
+					return Err!(Request(Exclusive(
+						"Username is not in an appservice namespace."
+					)));
+				},
+			| _ => {
+				return Err!(Request(MissingToken("Missing appservice token.")));
+			},
+		}
+	} else if services.appservice.is_exclusive_user_id(&user_id).await && !emergency_mode_enabled
+	{
+		// For non-appservice logins, ban user IDs which are in an appservice's
+		// namespace (unless emergency mode is enabled)
+		return Err!(Request(Exclusive("Username is reserved by an appservice.")));
+	}
+
+	let password = if body.identity.is_some() {
+		None
+	} else if let Some(password) = body.password.as_deref() {
+		Some(HashedPassword::new(password)?)
+	} else {
+		return Err!(Request(InvalidParam("A password must be provided")));
+	};
+
+	// Create user
+	services.users.create(&user_id, password).await?;
+
+	// Set an initial display name
+	let mut displayname = user_id.localpart().to_owned();
+
+	// Apply the new user displayname suffix, if it's set
+	if !services.globals.new_user_displayname_suffix().is_empty() && body.identity.is_none() {
+		write!(displayname, " {}", services.server.config.new_user_displayname_suffix)?;
+	}
+
+	services
+		.users
+		.set_displayname(&user_id, Some(displayname.clone()));
+
+	// Initial account data
+	services
+		.account_data
+		.update(
+			None,
+			&user_id,
+			GlobalAccountDataEventType::PushRules.to_string().into(),
+			&serde_json::to_value(PushRulesEvent::new(
+				push::Ruleset::server_default(&user_id).into(),
+			))
+			.expect("should be able to serialize push rules"),
+		)
+		.await?;
+
+	// Generate new device id if the user didn't specify one
+	let (token, device) = if !body.inhibit_login {
 		let device_id = body
 			.device_id
 			.clone()
@@ -128,7 +179,6 @@ pub(crate) async fn register_route(
 				&user_id,
 				&device_id,
 				&new_token,
-				None,
 				body.initial_device_display_name.clone(),
 				Some(client.to_string()),
 			)
@@ -139,7 +189,118 @@ pub(crate) async fn register_route(
 		(None, None)
 	};

-	debug_info!(%user_id, ?device, "New account created via legacy registration");
+	debug_info!(%user_id, ?device, "User account was created");
+
+	// If the user registered with an email, associate it with their account.
+	if let Some(identity) = identity
+		&& let Some(email) = identity.email
+	{
+		// This may fail if the email is already in use, but we already check for that
+		// in `/requestToken`, so ignoring the error is acceptable here in the rare case
+		// that an email is sniped by another user between the `/requestToken` request
+		// and the `/register` request.
+		let _ = services
+			.threepid
+			.associate_localpart_email(user_id.localpart(), &email)
+			.await;
+	}
+
+	let device_display_name = body.initial_device_display_name.as_deref().unwrap_or("");
+
+	if body.identity.is_none() {
+		if !device_display_name.is_empty() {
+			let notice = format!(
+				"New user \"{user_id}\" registered on this server from IP {client} and device \
+				 display name \"{device_display_name}\""
+			);
+
+			info!("{notice}");
+			if services.server.config.admin_room_notices {
+				services.admin.notice(&notice).await;
+			}
+		} else {
+			let notice = format!("New user \"{user_id}\" registered on this server.");
+
+			info!("{notice}");
+			if services.server.config.admin_room_notices {
+				services.admin.notice(&notice).await;
+			}
+		}
+	}
+
+	// Make the first user to register an administrator and disable first-run mode.
+	let was_first_user = services.firstrun.empower_first_user(&user_id).await?;
+
+	// If the registering user was not the first and we're suspending users on
+	// register, suspend them.
+	if !was_first_user && services.config.suspend_on_register {
+		// Note that we can still do auto joins for suspended users
+		services
+			.users
+			.suspend_account(&user_id, &services.globals.server_user)
+			.await;
+		// And send an @room notice to the admin room, to prompt admins to review the
+		// new user and ideally unsuspend them if deemed appropriate.
+		if services.server.config.admin_room_notices {
+			services
+				.admin
+				.send_loud_message(RoomMessageEventContent::text_plain(format!(
+					"User {user_id} has been suspended as they are not the first user on this \
+					 server. Please review and unsuspend them if appropriate."
+				)))
+				.await
+				.ok();
+		}
+	}
+
+	if body.identity.is_none() && !services.server.config.auto_join_rooms.is_empty() {
+		for room in &services.server.config.auto_join_rooms {
+			let Ok(room_id) = services.rooms.alias.resolve(room).await else {
+				error!(
+					"Failed to resolve room alias to room ID when attempting to auto join \
+					 {room}, skipping"
+				);
+				continue;
+			};
+
+			if !services
+				.rooms
+				.state_cache
+				.server_in_room(services.globals.server_name(), &room_id)
+				.await
+			{
+				warn!(
+					"Skipping room {room} to automatically join as we have never joined before."
+				);
+				continue;
+			}
+
+			if let Some(room_server_name) = room.server_name() {
+				match services
+					.rooms
+					.membership
+					.join_room(
+						&user_id,
+						&room_id,
+						Some("Automatically joining this room upon registration".to_owned()),
+						&[services.globals.server_name().to_owned(), room_server_name.to_owned()],
+					)
+					.boxed()
+					.await
+				{
+					| Err(e) => {
+						// don't return this error so we don't fail registrations
+						error!(
+							"Failed to automatically join room {room} for user {user_id}: {e}"
+						);
+					},
+					| _ => {
+						info!("Automatically joined room {room} for user {user_id}");
+					},
+				}
+			}
+		}
+	}

 	Ok(assign!(register::v3::Response::new(user_id), {
 		access_token: token,
@@ -211,21 +372,21 @@ async fn create_registration_uiaa_session(

 		// Require all users to agree to the terms and conditions, if configured
 		let terms = &services.config.registration_terms;
-		if !terms.documents.is_empty() {
-			let mut terms_map = HashMap::new();
+		if !terms.is_empty() {
+			let mut terms =
+				serde_json::to_value(terms.clone()).expect("failed to serialize terms");

-			for (id, document) in &terms.documents {
-				terms_map.insert(id.to_owned(), serde_json::json!({
-					terms.language.clone(): serde_json::to_value(document).expect("should be able to serialize document")
-				}));
+			// Insert a dummy `version` field
+			for (_, documents) in terms.as_object_mut().unwrap() {
+				let documents = documents.as_object_mut().unwrap();
+
+				documents.insert("version".to_owned(), "latest".into());
 			}

-			terms_map.insert("version".to_owned(), "latest".into());
-
 			params.insert(
 				AuthType::Terms.as_str().to_owned(),
 				serde_json::json!({
-					"policies": terms_map,
+					"policies": terms,
 				}),
 			);

@@ -258,6 +419,81 @@ async fn create_registration_uiaa_session(
 	Ok((flows, params))
 }

+async fn determine_registration_user_id(
+	services: &Services,
+	supplied_username: Option<String>,
+	emergency_mode_enabled: bool,
+) -> Result<OwnedUserId> {
+	if let Some(supplied_username) = supplied_username {
+		// The user gets to pick their username. Do some validation to make sure it's
+		// acceptable.
+
+		// Don't allow registration with forbidden usernames.
+		if services
+			.globals
+			.forbidden_usernames()
+			.is_match(&supplied_username)
+			&& !emergency_mode_enabled
+		{
+			return Err!(Request(Forbidden("Username is forbidden")));
+		}
+
+		// Create and validate the user ID
+		let user_id = match UserId::parse_with_server_name(
+			&supplied_username,
+			services.globals.server_name(),
+		) {
+			| Ok(user_id) => {
+				if let Err(e) = user_id.validate_strict() {
+					// Unless we are in emergency mode, we should follow synapse's behaviour on
+					// not allowing things like spaces and UTF-8 characters in usernames
+					if !emergency_mode_enabled {
+						return Err!(Request(InvalidUsername(debug_warn!(
+							"Username {supplied_username} contains disallowed characters or \
+							 spaces: {e}"
+						))));
+					}
+				}
+
+				// Don't allow registration with user IDs that aren't local
+				if !services.globals.user_is_local(&user_id) {
+					return Err!(Request(InvalidUsername(
+						"Username {supplied_username} is not local to this server"
+					)));
+				}
+
+				user_id
+			},
+			| Err(e) => {
+				return Err!(Request(InvalidUsername(debug_warn!(
+					"Username {supplied_username} is not valid: {e}"
+				))));
+			},
+		};
+
+		if services.users.exists(&user_id).await {
+			return Err!(Request(UserInUse("User ID is not available.")));
+		}
+
+		Ok(user_id)
+	} else {
+		// The user didn't specify a username. Generate a username for
+		// them.
+
+		loop {
+			let user_id = UserId::parse_with_server_name(
+				utils::random_string(RANDOM_USER_ID_LENGTH).to_lowercase(),
+				services.globals.server_name(),
+			)
+			.unwrap();
+
+			if !services.users.exists(&user_id).await {
+				break Ok(user_id);
+			}
+		}
+	}
+}
+
 /// # `POST /_matrix/client/v3/register/email/requestToken`
 ///
 /// Requests a validation email for the purpose of registering a new account.
@@ -11,7 +11,7 @@
 	},
 	thirdparty::{Medium, ThirdPartyIdentifierInit},
 };
-use service::mailer::messages;
+use service::{mailer::messages, uiaa::Identity};

 use crate::{Ruma, router::ClientIdentity};

@@ -124,18 +124,15 @@ pub(crate) async fn add_3pid_route(
 		.uiaa
 		.authenticate_password(
 			&body.auth,
-			body.identity.expect_sender_user()?,
-			body.identity.sender_device(),
-			None,
+			Some(Identity::from_user_id(body.identity.expect_sender_user()?)),
 		)
 		.await?;

 	let email = services
 		.threepid
-		.get_valid_session(&body.sid, &body.client_secret)
+		.consume_valid_session(&body.sid, &body.client_secret)
 		.await
-		.map_err(|message| err!(Request(ThreepidAuthFailed("{message}"))))?
-		.consume();
+		.map_err(|message| err!(Request(ThreepidAuthFailed("{message}"))))?;

 	services
 		.threepid
@@ -8,6 +8,7 @@
 		self, delete_device, delete_devices, get_device, get_devices, update_device,
 	},
 };
+use service::uiaa::Identity;

 use crate::{Ruma, client::DEVICE_ID_LENGTH};

@@ -94,7 +95,6 @@ pub(crate) async fn update_device_route(
 					&device_id,
 					&appservice.registration.as_token,
 					None,
-					None,
 					Some(client.to_string()),
 				)
 				.await?;
@@ -119,13 +119,14 @@ pub(crate) async fn delete_device_route(
 	body: Ruma<delete_device::v3::Request>,
 ) -> Result<delete_device::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
+	let appservice = body.identity.appservice_info();

 	// Appservices get to skip UIAA for this endpoint
-	if let Some(sender_device) = body.identity.sender_device() {
+	if appservice.is_none() {
 		// Prompt the user to confirm with their password using UIAA
 		let _ = services
 			.uiaa
-			.authenticate_password(&body.auth, sender_user, Some(sender_device), None)
+			.authenticate_password(&body.auth, Some(Identity::from_user_id(sender_user)))
 			.await?;
 	}

@@ -154,13 +155,14 @@ pub(crate) async fn delete_devices_route(
 	body: Ruma<delete_devices::v3::Request>,
 ) -> Result<delete_devices::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
+	let appservice = body.identity.appservice_info();

 	// Appservices get to skip UIAA for this endpoint
-	if let Some(sender_device) = body.identity.sender_device() {
+	if appservice.is_none() {
 		// Prompt the user to confirm with their password using UIAA
 		let _ = services
 			.uiaa
-			.authenticate_password(&body.auth, sender_user, Some(sender_device), None)
+			.authenticate_password(&body.auth, Some(Identity::from_user_id(sender_user)))
 			.await?;
 	}

@@ -26,7 +26,7 @@
 	serde::Raw,
 };
 use serde_json::json;
-use service::oauth::OAuthTicket;
+use service::uiaa::Identity;

 use crate::Ruma;

@@ -205,12 +205,7 @@ pub(crate) async fn upload_signing_keys_route(
 	{
 		let _ = services
 			.uiaa
-			.authenticate_password(
-				&body.auth,
-				sender_user,
-				body.identity.sender_device(),
-				Some(OAuthTicket::CrossSigningReset),
-			)
+			.authenticate_password(&body.auth, Some(Identity::from_user_id(sender_user)))
 			.await?;
 	}

@@ -16,7 +16,6 @@
 pub(super) mod membership;
 pub(super) mod message;
 pub(super) mod mutual_rooms;
-pub(super) mod oauth;
 pub(super) mod openid;
 pub(super) mod presence;
 pub(super) mod profile;
@@ -62,7 +61,6 @@
 pub use membership::{leave_all_rooms, leave_room, remote_leave_room};
 pub(super) use message::*;
 pub(super) use mutual_rooms::*;
-pub(super) use oauth::*;
 pub(super) use openid::*;
 pub(super) use presence::*;
 pub(super) use profile::*;
@@ -75,7 +73,6 @@
 pub(super) use room::*;
 pub(super) use search::*;
 pub(super) use send::*;
-pub use session::handle_login;
 pub(super) use session::*;
 pub(super) use space::*;
 pub(super) use state::*;
@@ -1,56 +0,0 @@
-use axum::{
-	Json, Router,
-	extract::{Request, State},
-	middleware::{self, Next},
-	response::{IntoResponse, Response},
-	routing::method_routing::{get, post},
-};
-use const_str::concat;
-use http::StatusCode;
-use serde_json::json;
-pub(crate) use server_metadata::*;
-
-mod register_client;
-mod server_metadata;
-mod token;
-
-const BASE_PATH: &str = concat!(conduwuit_core::ROUTE_PREFIX, "/oauth2/");
-const AUTH_CODE_PATH: &str = "grant/authorization_code";
-const JWKS_URI_PATH: &str = "client/keys.json";
-const CLIENT_REGISTER_PATH: &str = "client/register";
-const TOKEN_REVOKE_PATH: &str = "client/revoke";
-const TOKEN_PATH: &str = "grant/token";
-const ACCOUNT_MANAGEMENT_PATH: &str = concat!(conduwuit_core::ROUTE_PREFIX, "/account/deeplink");
-
-pub(crate) fn router(state: crate::State) -> Router<crate::State> {
-	Router::new()
-		.nest(BASE_PATH, oauth_router())
-		.route(
-			"/.well-known/openid-configuration",
-			get(
-				// TODO(unspecced): used by old versions of the matrix-js-sdk
-				async |State(services): State<crate::State>| {
-					Json(authorization_server_metadata(&services).await)
-				},
-			),
-		)
-		.layer(middleware::from_fn_with_state(
-			state,
-			async |State(state): State<crate::State>, request: Request, next: Next| -> Response {
-				if state.config.oauth.compatibility_mode.oauth_available() {
-					next.run(request).await
-				} else {
-					(StatusCode::NOT_FOUND, "OAuth is unavailable on this server").into_response()
-				}
-			},
-		))
-}
-
-fn oauth_router() -> Router<crate::State> {
-	Router::new()
-		.route(concat!("/", CLIENT_REGISTER_PATH), post(register_client::register_client_route))
-		// TODO(unspecced): used by old versions of the matrix-js-sdk
-		.route(concat!("/", JWKS_URI_PATH), get(async || Json(json!({"keys": []}))))
-		.route(concat!("/", TOKEN_PATH), post(token::token_route))
-		.route(concat!("/", TOKEN_REVOKE_PATH), post(token::revoke_token_route))
-}
@@ -1,28 +0,0 @@
-use axum::{
-	Json,
-	extract::State,
-	response::{IntoResponse, Response},
-};
-use http::StatusCode;
-use serde::Serialize;
-use service::oauth::client_metadata::ClientMetadata;
-
-#[derive(Serialize)]
-struct RegisteredClient {
-	client_id: String,
-	#[serde(flatten)]
-	metadata: ClientMetadata,
-}
-
-pub(crate) async fn register_client_route(
-	State(services): State<crate::State>,
-	Json(metadata): Json<ClientMetadata>,
-) -> Result<Response, Response> {
-	let client_id = services
-		.oauth
-		.register_client(&metadata)
-		.await
-		.map_err(|err| (StatusCode::BAD_REQUEST, Json(err)).into_response())?;
-
-	Ok(Json(RegisteredClient { client_id, metadata }).into_response())
-}
@@ -1,62 +0,0 @@
-use axum::extract::State;
-use conduwuit::{Err, Result};
-use ruma::{
-	api::client::discovery::get_authorization_server_metadata::{
-		self, v1::AccountManagementAction,
-	},
-	serde::Raw,
-};
-use serde_json::{Value, json};
-use service::Services;
-
-use crate::{
-	Ruma,
-	client::oauth::{
-		ACCOUNT_MANAGEMENT_PATH, AUTH_CODE_PATH, CLIENT_REGISTER_PATH, JWKS_URI_PATH, TOKEN_PATH,
-		TOKEN_REVOKE_PATH,
-	},
-};
-
-pub(crate) async fn get_authorization_server_metadata_route(
-	State(services): State<crate::State>,
-	_body: Ruma<get_authorization_server_metadata::v1::Request>,
-) -> Result<get_authorization_server_metadata::v1::Response> {
-	if !services.config.oauth.compatibility_mode.oauth_available() {
-		return Err!(Request(Unrecognized("OAuth is unavailable on this server")));
-	}
-
-	let metadata = Raw::new(&authorization_server_metadata(&services).await).unwrap();
-
-	Ok(get_authorization_server_metadata::v1::Response::new(metadata.cast_unchecked()))
-}
-
-pub(crate) async fn authorization_server_metadata(services: &Services) -> Value {
-	let endpoint_base = services
-		.config
-		.get_client_domain()
-		.join(super::BASE_PATH)
-		.unwrap();
-
-	json!({
-		"account_management_uri": endpoint_base.join(ACCOUNT_MANAGEMENT_PATH).unwrap(),
-		"account_management_actions_supported": [
-			AccountManagementAction::AccountDeactivate,
-			AccountManagementAction::CrossSigningReset,
-			AccountManagementAction::DeviceDelete,
-			AccountManagementAction::DeviceView,
-			AccountManagementAction::DevicesList,
-			AccountManagementAction::Profile,
-		],
-		"authorization_endpoint": endpoint_base.join(AUTH_CODE_PATH).unwrap(),
-		"code_challenge_methods_supported": ["S256"],
-		"grant_types_supported": ["authorization_code", "refresh_token"],
-		"issuer": services.config.get_client_domain(),
-		"jwks_uri": endpoint_base.join(JWKS_URI_PATH).unwrap(),
-		"prompt_values_supported": ["create"],
-		"registration_endpoint": endpoint_base.join(CLIENT_REGISTER_PATH).unwrap(),
-		"response_modes_supported": ["query", "fragment"],
-		"response_types_supported": ["code"],
-		"revocation_endpoint": endpoint_base.join(TOKEN_REVOKE_PATH).unwrap(),
-		"token_endpoint": endpoint_base.join(TOKEN_PATH).unwrap(),
-	})
-}
@@ -1,23 +0,0 @@
-use axum::{Form, Json, extract::State, response::IntoResponse};
-use http::StatusCode;
-use service::oauth::grant::{RevokeTokenRequest, TokenRequest};
-
-pub(crate) async fn token_route(
-	State(services): State<crate::State>,
-	Form(request): Form<TokenRequest>,
-) -> impl IntoResponse {
-	match services.oauth.issue_token(request).await {
-		| Ok(response) => Ok(Json(response)),
-		| Err(err) => Err((StatusCode::BAD_REQUEST, Json(err))),
-	}
-}
-
-pub(crate) async fn revoke_token_route(
-	State(services): State<crate::State>,
-	Form(request): Form<RevokeTokenRequest>,
-) -> impl IntoResponse {
-	match services.oauth.revoke_token(request.token).await {
-		| Ok(()) => Ok(StatusCode::OK),
-		| Err(err) => Err((StatusCode::BAD_REQUEST, Json(err))),
-	}
-}
@@ -21,7 +21,7 @@
 			},
 			login::{
 				self,
-				v3::{DiscoveryInfo, HomeserverInfo, LoginInfo},
+				v3::{DiscoveryInfo, HomeserverInfo},
 			},
 			logout, logout_all,
 		},
@@ -29,6 +29,7 @@
 	},
 	assign,
 };
+use service::uiaa::Identity;

 use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH};
 use crate::Ruma;
@@ -43,12 +44,6 @@ pub(crate) async fn get_login_types_route(
 	ClientIp(client): ClientIp,
 	_body: Ruma<get_login_types::v3::Request>,
 ) -> Result<get_login_types::v3::Response> {
-	if !services.config.oauth.compatibility_mode.uiaa_available() {
-		return Err!(Request(Unrecognized(
-			"User-interactive authentication is not available on this server."
-		)));
-	}
-
 	Ok(get_login_types::v3::Response::new(vec![
 		get_login_types::v3::LoginType::Password(PasswordLoginType::default()),
 		get_login_types::v3::LoginType::ApplicationService(ApplicationServiceLoginType::default()),
@@ -58,7 +53,7 @@ pub(crate) async fn get_login_types_route(
 	]))
 }

-pub async fn handle_login(
+pub(crate) async fn handle_login(
 	services: &Services,
 	identifier: Option<&UserIdentifier>,
 	password: &str,
@@ -92,10 +87,6 @@ pub async fn handle_login(
 		return Err!(Request(InvalidParam("User ID does not belong to this homeserver")));
 	}

-	if services.users.is_deactivated(&user_id).await? {
-		return Err!(Request(UserDeactivated("This account has been deactivated.")));
-	}
-
 	if services.users.is_locked(&user_id).await? {
 		return Err!(Request(UserLocked("This account has been locked.")));
 	}
@@ -128,29 +119,19 @@ pub(crate) async fn login_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<login::v3::Request>,
 ) -> Result<login::v3::Response> {
-	if !services.config.oauth.compatibility_mode.uiaa_available() {
-		return match body.login_info {
-			| LoginInfo::ApplicationService(_) => {
-				Err!(Request(AppserviceLoginUnsupported(
-					"User-interactive appservice login is not available on this server."
-				)))
-			},
-			| _ => {
-				Err!(Request(Unrecognized(
-					"User-interactive authentication is not available on this server."
-				)))
-			},
-		};
-	}
-
 	let emergency_mode_enabled = services.config.emergency_password.is_some();

 	// Validate login method
+	// TODO: Other login methods
 	let user_id = match &body.login_info {
 		#[allow(deprecated)]
-		| LoginInfo::Password(login::v3::Password { identifier, password, user, .. }) =>
-			handle_login(&services, identifier.as_ref(), password, user.as_ref()).await?,
-		| LoginInfo::Token(login::v3::Token { token, .. }) => {
+		| login::v3::LoginInfo::Password(login::v3::Password {
+			identifier,
+			password,
+			user,
+			..
+		}) => handle_login(&services, identifier.as_ref(), password, user.as_ref()).await?,
+		| login::v3::LoginInfo::Token(login::v3::Token { token, .. }) => {
 			debug!("Got token login type");
 			if !services.server.config.login_via_existing_session {
 				return Err!(Request(Unknown("Token login is not enabled.")));
@@ -158,7 +139,7 @@ pub(crate) async fn login_route(
 			services.users.find_from_login_token(token).await?
 		},
 		#[allow(deprecated)]
-		| LoginInfo::ApplicationService(login::v3::ApplicationService {
+		| login::v3::LoginInfo::ApplicationService(login::v3::ApplicationService {
 			identifier,
 			user,
 			..
@@ -192,6 +173,7 @@ pub(crate) async fn login_route(
 			user_id
 		},
 		| _ => {
+			debug!("/login json_body: {:?}", &body.json_body);
 			return Err!(Request(Unknown(
 				debug_warn!(?body.login_info, "Invalid or unsupported login type")
 			)));
@@ -221,7 +203,7 @@ pub(crate) async fn login_route(
 	if device_exists {
 		services
 			.users
-			.set_token(&user_id, &device_id, &token, None)
+			.set_token(&user_id, &device_id, &token)
 			.await?;
 	} else {
 		services
@@ -230,7 +212,6 @@ pub(crate) async fn login_route(
 				&user_id,
 				&device_id,
 				&token,
-				None,
 				body.initial_device_display_name.clone(),
 				Some(client.to_string()),
 			)
@@ -269,7 +250,7 @@ pub(crate) async fn login_token_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<get_login_token::v1::Request>,
 ) -> Result<get_login_token::v1::Response> {
-	if !services.config.login_via_existing_session {
+	if !services.server.config.login_via_existing_session {
 		return Err!(Request(Forbidden("Login via an existing session is not enabled")));
 	}

@@ -278,7 +259,7 @@ pub(crate) async fn login_token_route(
 	// Prompt the user to confirm with their password using UIAA
 	let _ = services
 		.uiaa
-		.authenticate_password(&body.auth, sender_user, body.identity.sender_device(), None)
+		.authenticate_password(&body.auth, Some(Identity::from_user_id(sender_user)))
 		.await?;

 	let login_token = utils::random_string(TOKEN_LENGTH);
@@ -48,13 +48,6 @@ async fn load_timeline(
 	ending_count: Option<PduCount>,
 	limit: usize,
 ) -> Result<TimelinePdus> {
-	if let (Some(starting_count), Some(ending_count)) = (starting_count, ending_count) {
-		debug_assert!(
-			starting_count <= ending_count,
-			"starting count {starting_count} > ending count {ending_count}"
-		);
-	}
-
 	let mut pdu_stream = match starting_count {
 		| Some(starting_count) => {
 			let last_timeline_count = services
@@ -38,7 +38,6 @@
 	uint,
 };
 use service::{account_data::AnyRawAccountDataEvent, rooms::short::ShortStateHash};
-use tokio::pin;

 use super::{load_timeline, share_encrypted_room};
 use crate::client::{
@@ -97,19 +96,12 @@ pub(super) async fn load_joined_room(
 		);
 	}

-	let state_events =
-		StateEvents::with_events(state_events.into_iter().map(Event::into_format).collect());
-
 	let joined_room = assign!(JoinedRoom::new(), {
 		account_data,
 		summary: summary.unwrap_or_default(),
 		unread_notifications: notification_counts.unwrap_or_default(),
 		timeline,
-		state: if sync_context.use_state_after {
-			RoomState::After(state_events)
-		} else {
-			RoomState::Before(state_events)
-		},
+		state: RoomState::Before(StateEvents::with_events(state_events.into_iter().map(Event::into_format).collect())),
 		ephemeral,
 		unread_thread_notifications: BTreeMap::new(),
 	});
@@ -352,7 +344,7 @@ struct ShortStateHashes {
 #[tracing::instrument(level = "debug", skip_all)]
 async fn fetch_shortstatehashes(
 	services: &Services,
-	SyncContext { last_sync_end_count, .. }: SyncContext<'_>,
+	SyncContext { last_sync_end_count, current_count, .. }: SyncContext<'_>,
 	room_id: &RoomId,
 ) -> Result<ShortStateHashes> {
 	// the room state currently.
@@ -362,45 +354,46 @@ async fn fetch_shortstatehashes(
 		.rooms
 		.state
 		.get_room_shortstatehash(room_id)
-		.map_err(|_| err!(Database(error!("Room {room_id} has no state"))))
-		.await?;
+		.map_err(|_| err!(Database(error!("Room {room_id} has no state"))));

-	// The room state as of the end of the last sync.
-	// This will be None if we are doing an initial sync.
+	// the room state as of the end of the last sync.
+	// this will be None if we are doing an initial sync or if we just joined this
+	// room.
 	let last_sync_end_shortstatehash =
-		OptionFuture::from(last_sync_end_count.map(async |last_sync_end_count| {
-			pin! {
-				let pdus = services
-					.rooms
-					.timeline
-					.pdus(room_id, Some(PduCount::Normal(last_sync_end_count)))
-					.ignore_err();
-			}
-
-			match pdus.next().await {
-				| Some((_, pdu_after_last_sync_end)) => {
-					trace!(?pdu_after_last_sync_end.event_id, "pdu at last sync end");
-
-					Some(
-						services
-							.rooms
-							.state_accessor
-							.pdu_shortstatehash(&pdu_after_last_sync_end.event_id)
-							.await
-							.map_err(|err| {
-								err!("Last sync end PDU has no shortstatehash: {err}")
-							}),
-					)
-				},
-				| None => {
-					// No events have been sent since the last sync, or we just joined this room
-					None
-				},
-			}
+		OptionFuture::from(last_sync_end_count.map(|last_sync_end_count| {
+			// look up the shortstatehash saved by the last sync's call to
+			// `associate_token_shortstatehash`
+			services
+				.rooms
+				.user
+				.get_token_shortstatehash(room_id, last_sync_end_count)
+				.inspect_err(move |_| {
+					debug_warn!(
+						token = last_sync_end_count,
+						"Room has no shortstatehash for this token"
+					);
+				})
+				.ok()
 		}))
-		.await
-		.flatten()
-		.transpose()?;
+		.map(Option::flatten)
+		.map(Ok);
+
+	let (current_shortstatehash, last_sync_end_shortstatehash) =
+		try_join(current_shortstatehash, last_sync_end_shortstatehash).await?;
+
+	/*
+	associate the `current_count` with the `current_shortstatehash`, so we can
+	use it on the next sync as the `last_sync_end_shortstatehash`.
+
+	TODO: the table written to by this call grows extremely fast, gaining one new entry for each
+	joined room on _every single sync request_. we need to find a better way to remember the shortstatehash
+	between syncs.
+	*/
+	services
+		.rooms
+		.user
+		.associate_token_shortstatehash(room_id, current_count, current_shortstatehash)
+		.await;

 	Ok(ShortStateHashes {
 		current_shortstatehash,
@@ -459,7 +452,6 @@ async fn build_state_events(
 		syncing_user,
 		last_sync_end_count,
 		full_state,
-		use_state_after,
 		..
 	} = sync_context;

@@ -468,15 +460,32 @@ async fn build_state_events(
 		last_sync_end_shortstatehash,
 	} = shortstatehashes;

-	if timeline.pdus.is_empty() {
-		// If the timeline is empty there can't possibly be any changes to the state
-		return Ok(vec![]);
-	}
+	// the spec states that the `state` property only includes state events up to
+	// the beginning of the timeline, so we determine the state of the syncing room
+	// as of the first timeline event. NOTE: this explanation is not entirely
+	// accurate; see the implementation of `build_state_incremental`.
+	let timeline_start_shortstatehash = async {
+		if let Some((_, pdu)) = timeline.pdus.front() {
+			if let Ok(shortstatehash) = services
+				.rooms
+				.state_accessor
+				.pdu_shortstatehash(&pdu.event_id)
+				.await
+			{
+				return shortstatehash;
+			}
+		}
+
+		current_shortstatehash
+	};

 	// the user IDs of members whose membership needs to be sent to the client, if
 	// lazy-loading is enabled.
 	let lazily_loaded_members =
-		prepare_lazily_loaded_members(services, sync_context, room_id, timeline.senders()).await;
+		prepare_lazily_loaded_members(services, sync_context, room_id, timeline.senders());
+
+	let (timeline_start_shortstatehash, lazily_loaded_members) =
+		join(timeline_start_shortstatehash, lazily_loaded_members).await;

 	// compute the state delta between the previous sync and this sync.
 	match (last_sync_end_count, last_sync_end_shortstatehash) {
@@ -485,14 +494,16 @@ async fn build_state_events(
 		is Some (meaning the syncing user didn't just join this room for the first time ever), and `full_state` is false,
 		then use `build_state_incremental`.
 		*/
-		| (Some(_), Some(last_sync_end_shortstatehash)) if !full_state =>
+		| (Some(last_sync_end_count), Some(last_sync_end_shortstatehash)) if !full_state =>
 			build_state_incremental(
 				services,
 				syncing_user,
+				room_id,
+				PduCount::Normal(last_sync_end_count),
 				last_sync_end_shortstatehash,
+				timeline_start_shortstatehash,
 				current_shortstatehash,
 				timeline,
-				use_state_after,
 				lazily_loaded_members.as_ref(),
 			)
 			.boxed()
@@ -506,9 +517,7 @@ async fn build_state_events(
 			build_state_initial(
 				services,
 				syncing_user,
-				current_shortstatehash,
-				timeline,
-				use_state_after,
+				timeline_start_shortstatehash,
 				lazily_loaded_members.as_ref(),
 			)
 			.boxed()
@@ -589,25 +598,23 @@ async fn check_joined_since_last_sync(
 	ShortStateHashes { last_sync_end_shortstatehash, .. }: ShortStateHashes,
 	SyncContext { syncing_user, .. }: SyncContext<'_>,
 ) -> Result<bool> {
-	let Some(last_sync_end_shortstatehash) = last_sync_end_shortstatehash else {
-		// For initial syncs always return false, since there's no "last sync" for the
-		// user to have joined since.
-		return Ok(false);
+	// fetch the syncing user's membership event during the last sync.
+	// this will be None if `previous_sync_end_shortstatehash` is None.
+	let membership_during_previous_sync = match last_sync_end_shortstatehash {
+		| Some(last_sync_end_shortstatehash) => services
+			.rooms
+			.state_accessor
+			.state_get_content(
+				last_sync_end_shortstatehash,
+				&StateEventType::RoomMember,
+				syncing_user.as_str(),
+			)
+			.await
+			.inspect_err(|_| debug_warn!("User has no previous membership"))
+			.ok(),
+		| None => None,
 	};

-	// Fetch the syncing user's membership event during the last sync.
-	let membership_during_previous_sync = services
-		.rooms
-		.state_accessor
-		.state_get_content(
-			last_sync_end_shortstatehash,
-			&StateEventType::RoomMember,
-			syncing_user.as_str(),
-		)
-		.await
-		.inspect_err(|_| debug_warn!("User has no previous membership"))
-		.ok();
-
 	// TODO: If the requesting user got state-reset out of the room, this
 	// will be `true` when it shouldn't be. this function should never be called
 	// in that situation, but it may be if the membership cache didn't get updated.
@@ -4,7 +4,7 @@
 	trace,
 	utils::{self, IterStream, future::ReadyEqExt, stream::WidebandExt as _},
 };
-use futures::StreamExt;
+use futures::{StreamExt, future::join};
 use ruma::{
 	EventId, OwnedRoomId, RoomId,
 	api::client::sync::sync_events::v3::{
@@ -181,9 +181,6 @@ pub(super) async fn load_left_room(
 		.collect::<Vec<_>>()
 		.await;

-	let state_events =
-		StateEvents::with_events(state_events.into_iter().map(Event::into_format).collect());
-
 	Ok(Some(assign!(LeftRoom::new(), {
 		account_data: RoomAccountData::new(),
 		timeline: assign!(Timeline::new(), {
@@ -191,11 +188,7 @@ pub(super) async fn load_left_room(
 			prev_batch: Some(current_count.to_string()),
 			events: raw_timeline_pdus,
 		}),
-		state: if sync_context.use_state_after {
-			State::After(state_events)
-		} else {
-			State::Before(state_events)
-		},
+		state: State::Before(StateEvents::with_events(state_events.into_iter().map(Event::into_format).collect())),
 	})))
 }

@@ -240,8 +233,29 @@ async fn build_left_state_and_timeline(
 	)
 	.await?;

+	let timeline_start_shortstatehash = async {
+		if let Some((_, pdu)) = timeline.pdus.front() {
+			if let Ok(shortstatehash) = services
+				.rooms
+				.state_accessor
+				.pdu_shortstatehash(&pdu.event_id)
+				.await
+			{
+				return shortstatehash;
+			}
+		}
+
+		// the timeline generally should not be empty (see the TODO further down),
+		// but in case it is we use `leave_shortstatehash` as the state to
+		// send
+		leave_shortstatehash
+	};
+
 	let lazily_loaded_members =
-		prepare_lazily_loaded_members(services, sync_context, room_id, timeline.senders()).await;
+		prepare_lazily_loaded_members(services, sync_context, room_id, timeline.senders());
+
+	let (timeline_start_shortstatehash, lazily_loaded_members) =
+		join(timeline_start_shortstatehash, lazily_loaded_members).await;

 	// TODO: calculate incremental state for incremental syncs.
 	// always calculating initial state _works_ but returns more data and does
@@ -249,9 +263,7 @@ async fn build_left_state_and_timeline(
 	let mut state = build_state_initial(
 		services,
 		syncing_user,
-		leave_shortstatehash,
-		&timeline,
-		sync_context.use_state_after,
+		timeline_start_shortstatehash,
 		lazily_loaded_members.as_ref(),
 	)
 	.await?;
@@ -11,11 +11,12 @@
 use axum::extract::State;
 use axum_client_ip::ClientIp;
 use conduwuit::{
-	Err, Result, at, error, extract_variant,
+	Err, Result, at, extract_variant,
 	utils::{
 		ReadyExt, TryFutureExtExt,
 		stream::{BroadbandExt, Tools, WidebandExt},
 	},
+	warn,
 };
 use conduwuit_service::Services;
 use futures::{FutureExt, StreamExt, TryFutureExt, future::OptionFuture};
@@ -110,9 +111,6 @@ struct SyncContext<'a> {
 	/// The sync filter, which the client uses to specify what data should be
 	/// included in the sync response.
 	filter: &'a FilterDefinition,
-	/// Whether the state at the end of the timeline should be used when
-	/// calculating state diffs for sync.
-	use_state_after: bool,
 }

 impl<'a> SyncContext<'a> {
@@ -266,7 +264,6 @@ pub(crate) async fn build_sync_events(
 		current_count,
 		full_state,
 		filter: &filter,
-		use_state_after: body.use_state_after,
 	};

 	let joined_rooms = services
@@ -279,7 +276,7 @@ pub(crate) async fn build_sync_events(
 			match joined_room {
 				| Ok((room, updates)) => Some((room_id, room, updates)),
 				| Err(err) => {
-					error!(?err, %room_id, "error loading joined room");
+					warn!(?err, %room_id, "error loading joined room");
 					None
 				},
 			}
@@ -308,7 +305,7 @@ pub(crate) async fn build_sync_events(
 				| Ok(Some(left_room)) => Some((room_id, left_room)),
 				| Ok(None) => None,
 				| Err(err) => {
-					error!(?err, %room_id, "error loading joined room");
+					warn!(?err, %room_id, "error loading joined room");
 					None
 				},
 			}
@@ -1,8 +1,11 @@
-use std::collections::HashSet;
+use std::{collections::BTreeSet, ops::ControlFlow};

 use conduwuit::{
-	Result, at,
-	matrix::{Event, pdu::PduEvent},
+	Result, at, is_equal_to,
+	matrix::{
+		Event,
+		pdu::{PduCount, PduEvent},
+	},
 	utils::{
 		BoolExt, IterStream, ReadyExt, TryFutureExtExt,
 		stream::{BroadbandExt, TryIgnore},
@@ -13,7 +16,9 @@
 	rooms::{lazy_loading::MemberSet, short::ShortStateHash},
 };
 use futures::{FutureExt, StreamExt};
-use ruma::{OwnedEventId, UserId, events::StateEventType};
+use itertools::Itertools;
+use ruma::{OwnedEventId, RoomId, UserId, events::StateEventType};
+use service::rooms::short::ShortEventId;
 use tracing::trace;

 use crate::client::TimelinePdus;
@@ -33,22 +38,14 @@
 pub(super) async fn build_state_initial(
 	services: &Services,
 	sender_user: &UserId,
-	timeline_end_shortstatehash: ShortStateHash,
-	timeline: &TimelinePdus,
-	use_state_after: bool,
+	timeline_start_shortstatehash: ShortStateHash,
 	lazily_loaded_members: Option<&MemberSet>,
 ) -> Result<Vec<PduEvent>> {
-	let event_ids_in_timeline: HashSet<_> =
-		timeline.pdus.iter().map(|pdu| &pdu.1.event_id).collect();
-
 	// load the keys and event IDs of the state events at the start of the timeline
 	let (shortstatekeys, event_ids): (Vec<_>, Vec<_>) = services
 		.rooms
 		.state_accessor
-		.state_full_ids(timeline_end_shortstatehash)
-		.ready_filter(|(_, event_id)| {
-			use_state_after || !event_ids_in_timeline.contains(event_id)
-		})
+		.state_full_ids(timeline_start_shortstatehash)
 		.unzip()
 		.await;

@@ -95,32 +92,82 @@ pub(super) async fn build_state_initial(
 pub(super) async fn build_state_incremental<'a>(
 	services: &Services,
 	sender_user: &'a UserId,
+	room_id: &RoomId,
+	last_sync_end_count: PduCount,
 	last_sync_end_shortstatehash: ShortStateHash,
+	timeline_start_shortstatehash: ShortStateHash,
 	timeline_end_shortstatehash: ShortStateHash,
 	timeline: &TimelinePdus,
-	use_state_after: bool,
 	lazily_loaded_members: Option<&'a MemberSet>,
 ) -> Result<Vec<PduEvent>> {
-	let mut state_event_ids: HashSet<OwnedEventId> = HashSet::new();
+	/*
+	NB: a limited sync is one where `timeline.limited == true`. Synapse calls this a "gappy" sync internally.

-	trace!(
-		%use_state_after,
-		%last_sync_end_shortstatehash,
-		%timeline_end_shortstatehash,
-		"computing state for incremental sync"
-	);
+	The algorithm implemented in this function is, currently, quite different from the algorithm vaguely described
+	by the Matrix specification. This is because the specification's description of the `state` property does not accurately
+	reflect how Synapse behaves, and therefore how client SDKs behave. Notable differences include:
+	1. We do not compute the delta using the naive approach of "every state event from the end of the last sync
+	   up to the start of this sync's timeline". see below for details.
+	2. If lazy-loading is enabled, we include lazily-loaded membership events. The specific users to include are determined
+	   elsewhere and supplied to this function in the `lazily_loaded_members` parameter.
+	*/

-	// Fetch lazy-loaded membership events if lazy-loading is enabled
-	if let Some(lazily_loaded_members) = lazily_loaded_members
-		&& !lazily_loaded_members.is_empty()
-	{
-		trace!("including lazy membership events for members: {:?}", lazily_loaded_members);
+	/*
+	the `state` property of an incremental sync which isn't limited are _usually_ empty.
+	(note: the specification says that the `state` property is _always_ empty for limited syncs, which is incorrect.)
+	however, if an event in the timeline (`timeline.pdus`) merges a split in the room's DAG (i.e. has multiple `prev_events`),
+	the state at the _end_ of the timeline may include state events which were merged in and don't exist in the state
+	at the _start_ of the timeline. because this is uncommon, we check here to see if any events in the timeline
+	merged a split in the DAG.

-		services
+	see: https://github.com/element-hq/synapse/issues/16941
+	*/
+
+	let timeline_is_linear = timeline.pdus.is_empty() || {
+		let last_pdu_of_last_sync = services
 			.rooms
-			.short
-			.multi_get_eventid_from_short::<'_, OwnedEventId, _>(
-				lazily_loaded_members
+			.timeline
+			.pdus_rev(room_id, Some(last_sync_end_count.saturating_add(1)))
+			.boxed()
+			.next()
+			.await
+			.transpose()
+			.expect("last sync should have had some PDUs")
+			.map(at!(1));
+
+		// make sure the prev_events of each pdu in the timeline refer only to the
+		// previous pdu
+		timeline
+			.pdus
+			.iter()
+			.try_fold(last_pdu_of_last_sync.map(|pdu| pdu.event_id), |prev_event_id, (_, pdu)| {
+				if let Ok(pdu_prev_event_id) = pdu.prev_events.iter().exactly_one() {
+					if prev_event_id
+						.as_ref()
+						.is_none_or(is_equal_to!(pdu_prev_event_id))
+					{
+						return ControlFlow::Continue(Some(pdu_prev_event_id.to_owned()));
+					}
+				}
+
+				trace!(
+					"pdu {:?} has split prev_events (expected {:?}): {:?}",
+					pdu.event_id, prev_event_id, pdu.prev_events
+				);
+				ControlFlow::Break(())
+			})
+			.is_continue()
+	};
+
+	if timeline_is_linear && !timeline.limited {
+		// if there are no splits in the DAG and the timeline isn't limited, then
+		// `state` will always be empty unless lazy loading is enabled.
+
+		if let Some(lazily_loaded_members) = lazily_loaded_members {
+			if !timeline.pdus.is_empty() {
+				// lazy loading is enabled, so we return the membership events which were
+				// requested by the caller.
+				let lazy_membership_events: Vec<_> = lazily_loaded_members
 					.iter()
 					.stream()
 					.broad_filter_map(|user_id| async move {
@@ -131,24 +178,71 @@ pub(super) async fn build_state_incremental<'a>(
 						services
 							.rooms
 							.state_accessor
-							.state_get_shortid(
-								timeline_end_shortstatehash,
+							.state_get(
+								timeline_start_shortstatehash,
 								&StateEventType::RoomMember,
 								user_id.as_str(),
 							)
 							.ok()
 							.await
-					}),
-			)
-			.ignore_err()
-			.ready_for_each(|event_id| {
-				state_event_ids.insert(event_id);
-			})
-			.await;
+					})
+					.collect()
+					.await;
+
+				if !lazy_membership_events.is_empty() {
+					trace!(
+						"syncing lazy membership events for members: {:?}",
+						lazy_membership_events
+							.iter()
+							.map(|pdu| pdu.state_key().unwrap())
+							.collect::<Vec<_>>()
+					);
+				}
+				return Ok(lazy_membership_events);
+			}
+		}
+
+		// lazy loading is disabled, `state` is empty.
+		return Ok(vec![]);
 	}

-	// Fetch the state events added since the last sync.
-	services
+	/*
+	at this point, either the timeline is `limited` or the DAG has a split in it. this necessitates
+	computing the incremental state (which may be empty).
+
+	NOTE: this code path does not use the `lazy_membership_events` parameter. any changes to membership will be included
+	in the incremental state. therefore, the incremental state may include "redundant" membership events,
+	which we do not filter out because A. the spec forbids lazy-load filtering if the timeline is `limited`,
+	and B. DAG splits which require sending extra membership state events are (probably) uncommon enough that
+	the performance penalty is acceptable.
+	*/
+
+	trace!(%timeline_is_linear, %timeline.limited, "computing state for incremental sync");
+
+	// fetch the shorteventids of state events in the timeline
+	let state_events_in_timeline: BTreeSet<ShortEventId> = services
+		.rooms
+		.short
+		.multi_get_or_create_shorteventid(timeline.pdus.iter().filter_map(|(_, pdu)| {
+			if pdu.state_key().is_some() {
+				Some(pdu.event_id.as_ref())
+			} else {
+				None
+			}
+		}))
+		.collect()
+		.await;
+
+	trace!("{} state events in timeline", state_events_in_timeline.len());
+
+	/*
+	fetch the state events which were added since the last sync.
+
+	specifically we fetch the difference between the state at the last sync and the state at the _end_
+	of the timeline, and then we filter out state events in the timeline itself using the shorteventids we fetched.
+	this is necessary to account for splits in the DAG, as explained above.
+	*/
+	let state_diff = services
 		.rooms
 		.short
 		.multi_get_eventid_from_short::<'_, OwnedEventId, _>(
@@ -158,29 +252,18 @@ pub(super) async fn build_state_incremental<'a>(
 				.state_added((last_sync_end_shortstatehash, timeline_end_shortstatehash))
 				.await?
 				.stream()
-				.map(at!(1)),
+				.ready_filter_map(|(_, shorteventid)| {
+					if state_events_in_timeline.contains(&shorteventid) {
+						None
+					} else {
+						Some(shorteventid)
+					}
+				}),
 		)
-		.ignore_err()
-		.ready_for_each(|event_id| {
-			state_event_ids.insert(event_id);
-		})
-		.await;
+		.ignore_err();

-	if !use_state_after {
-		// If state_after isn't enabled, filter out state events which also exist
-		// in the timeline. If splits exist in the DAG, this may not be exactly the same
-		// thing as the state diff ending at the start of the timeline, but Synapse
-		// also does this and it's technically more useful behavior anyway.
-		// See: https://github.com/element-hq/synapse/issues/16941
-
-		for (_, pdu) in &timeline.pdus {
-			state_event_ids.remove(pdu.event_id());
-		}
-	}
-
-	// Finally, fetch the PDU contents and collect them into a vec
-	let state_diff_pdus = state_event_ids
-		.stream()
+	// finally, fetch the PDU contents and collect them into a vec
+	let state_diff_pdus = state_diff
 		.broad_filter_map(|event_id| async move {
 			services
 				.rooms
@@ -15,7 +15,7 @@
 		BoolExt, FutureBoolExt, IterStream, ReadyExt, TryFutureExtExt,
 		future::ReadyEqExt,
 		math::{ruma_from_usize, usize_from_ruma},
-		stream::{TryIgnore, WidebandExt},
+		stream::WidebandExt,
 	},
 	warn,
 };
@@ -41,7 +41,6 @@
 	uint,
 };
 use service::account_data::AnyRawAccountDataEvent;
-use tokio::pin;

 use super::share_encrypted_room;
 use crate::{
@@ -70,6 +69,7 @@ pub(crate) async fn sync_events_v5_route(
 	ClientIp(client_ip): ClientIp,
 	body: Ruma<sync_events::v5::Request>,
 ) -> Result<sync_events::v5::Response> {
+	debug_assert!(DEFAULT_BUMP_TYPES.is_sorted(), "DEFAULT_BUMP_TYPES is not sorted");
 	let sender_user = body.identity.expect_sender_user()?;
 	let sender_device = body.identity.expect_sender_device()?;

@@ -858,31 +858,12 @@ async fn collect_e2ee<'a, Rooms>(
 			continue;
 		};

-		let since_shortstatehash = async {
-			pin! {
-				let pdus_rev = services
-					.rooms
-					.timeline
-					.pdus_rev(room_id, Some(PduCount::Normal(globalsince.saturating_sub(1))))
-					.ignore_err();
-			}
-
-			let (count, pdu_at_last_sync_end) = pdus_rev.next().await?;
-
-			if matches!(count, PduCount::Backfilled(_)) {
-				None
-			} else {
-				Some(
-					services
-						.rooms
-						.state_accessor
-						.pdu_shortstatehash(&pdu_at_last_sync_end.event_id)
-						.await
-						.expect("pdu should have a shortstatehash"),
-				)
-			}
-		}
-		.await;
+		let since_shortstatehash = services
+			.rooms
+			.user
+			.get_token_shortstatehash(room_id, globalsince)
+			.await
+			.ok();

 		let encrypted_room = services
 			.rooms
@@ -35,8 +35,8 @@ pub(crate) async fn get_supported_versions_route(
 /// `/_matrix/federation/v1/version`
 pub(crate) async fn conduwuit_server_version() -> Result<impl IntoResponse> {
 	Ok(Json(serde_json::json!({
-		"name": conduwuit::BRANDING,
-		"version": conduwuit::version(),
+		"name": conduwuit::version::name(),
+		"version": conduwuit::version::version(),
 	})))
 }

@@ -3,7 +3,8 @@
 use ruma::{
 	api::client::discovery::{
 		discover_homeserver::{self, HomeserverInfo},
-		discover_policy_server, discover_support,
+		discover_policy_server,
+		discover_support::{self, Contact, ContactRole},
 	},
 	assign,
 };
@@ -66,7 +67,46 @@ pub(crate) async fn well_known_support(
 		.as_ref()
 		.map(ToString::to_string);

-	let contacts = services.admin.get_support_contacts().await;
+	let email_address = services.config.well_known.support_email.clone();
+	let matrix_id = services.config.well_known.support_mxid.clone();
+	let pgp_key = services.config.well_known.support_pgp_key.clone();
+
+	// TODO: support defining multiple contacts in the config
+	let mut contacts: Vec<Contact> = vec![];
+
+	let role = services
+		.config
+		.well_known
+		.support_role
+		.clone()
+		.unwrap_or(ContactRole::Admin);
+
+	// Add configured contact if at least one contact method is specified
+	let configured_contact = match (matrix_id, email_address) {
+		| (Some(matrix_id), email_address) =>
+			Some(assign!(Contact::with_matrix_id(role, matrix_id), { email_address })),
+		| (None, Some(email_address)) => Some(Contact::with_email_address(role, email_address)),
+		| (None, None) => None,
+	};
+
+	if let Some(mut configured_contact) = configured_contact {
+		configured_contact.pgp_key = pgp_key;
+
+		contacts.push(configured_contact);
+	}
+
+	// Try to add admin users as contacts if no contacts are configured
+	if contacts.is_empty() {
+		let admin_users = services.admin.get_admins().await;
+
+		for user_id in &admin_users {
+			if *user_id == services.globals.server_user {
+				continue;
+			}
+
+			contacts.push(Contact::with_matrix_id(ContactRole::Admin, user_id.to_owned()));
+		}
+	}

 	if contacts.is_empty() && support_page.is_none() {
 		// No admin room, no configured contacts, and no support page
@@ -1,5 +1,4 @@
 #![type_length_limit = "16384"] //TODO: reduce me
-#![recursion_limit = "256"] // My Giant Async Function
 #![allow(clippy::toplevel_ref_arg)]

 extern crate conduwuit_core as conduwuit;
@@ -10,7 +10,7 @@
 	response::{IntoResponse, Redirect},
 	routing::{any, get, post},
 };
-use conduwuit::err;
+use conduwuit::{Server, err};
 pub(super) use conduwuit_service::state::State;
 use http::{Uri, uri};

@@ -18,8 +18,8 @@
 pub(super) use self::{args::Args as Ruma, auth::ClientIdentity, response::RumaResponse};
 use crate::{admin, client, server};

-pub fn build(router: Router<State>, state: State) -> Router<State> {
-	let config = &state.server.config;
+pub fn build(router: Router<State>, server: &Server) -> Router<State> {
+	let config = &server.config;
 	let mut router = router
        .ruma_route(&client::appservice_ping)
 		.ruma_route(&client::get_supported_versions_route)
@@ -186,8 +186,6 @@ pub fn build(router: Router<State>, state: State) -> Router<State> {
 		.ruma_route(&client::well_known_policy_server)
 		.ruma_route(&client::get_rtc_transports)
 		.ruma_route(&client::room_initial_sync_route)
-		.ruma_route(&client::get_authorization_server_metadata_route)
-		.merge(client::oauth::router(state))
 		.route("/_conduwuit/server_version", get(client::conduwuit_server_version))
 		.route("/_continuwuity/server_version", get(client::conduwuit_server_version))
 		.ruma_route(&admin::rooms::ban::ban_room)
@@ -1,7 +1,6 @@
 use std::any::{Any, TypeId};

-use conduwuit::{Err, Error, Result, err};
-use http::StatusCode;
+use conduwuit::{Err, Result, err};
 use ruma::{
 	DeviceId, OwnedDeviceId, OwnedServerName, OwnedUserId, UserId,
 	api::{
@@ -11,15 +10,12 @@
 			AuthScheme, NoAccessToken, NoAuthentication,
 		},
 		client,
-		error::{ErrorKind, UnknownTokenErrorData},
 		federation::authentication::ServerSignatures,
 	},
-	assign,
 };
 use service::{
 	Services,
 	server_keys::{PubKeyMap, PubKeys},
-	users::AccessTokenStatus,
 };

 use crate::{router::args::AuthQueryParams, service::appservice::RegistrationInfo};
@@ -166,23 +162,7 @@ async fn verify<B: AsRef<[u8]> + Sync>(
 		query: AuthQueryParams,
 		route: TypeId,
 	) -> Result<Self::Identity> {
-		if output.is_empty() {
-			return Err!(Request(Unauthorized("Missing access token.")));
-		}
-		if let Some((sender_user, sender_device, status)) =
-			services.users.find_from_token(&output).await
-		{
-			// If the token is expired we return a soft logout
-			if matches!(status, AccessTokenStatus::Expired) {
-				return Err(Error::Request(
-					ErrorKind::UnknownToken(
-						assign!(UnknownTokenErrorData::new(), { soft_logout: true }),
-					),
-					"This token has expired".into(),
-					StatusCode::UNAUTHORIZED,
-				));
-			}
-
+		if let Ok((sender_user, sender_device)) = services.users.find_from_token(&output).await {
 			// Locked users can only use /logout and /logout/all
 			if services
 				.users
@@ -193,7 +173,7 @@ async fn verify<B: AsRef<[u8]> + Sync>(
 				if !(route == TypeId::of::<client::session::logout::v3::Request>()
 					|| route == TypeId::of::<client::session::logout_all::v3::Request>())
 				{
-					return Err!(Request(UserLocked("Your account is locked.")));
+					return Err!(Request(Unauthorized("Your account is locked.")));
 				}
 			}

@@ -244,11 +224,7 @@ async fn verify<B: AsRef<[u8]> + Sync>(
 				appservice_info: Box::new(appservice_info),
 			})
 		} else {
-			Err(Error::Request(
-				ErrorKind::UnknownToken(UnknownTokenErrorData::new()),
-				"Invalid token".into(),
-				StatusCode::UNAUTHORIZED,
-			))
+			Err!(Request(Unauthorized("Invalid access token.")))
 		}
 	}
 }
@@ -283,9 +259,6 @@ async fn verify<B: AsRef<[u8]> + Sync>(
 		_query: AuthQueryParams,
 		_route: TypeId,
 	) -> Result<Self::Identity> {
-		if output.is_empty() {
-			return Err!(Request(Unauthorized("Missing access token.")));
-		}
 		let Ok(appservice_info) = services.appservice.find_from_token(&output).await else {
 			return Err!(Request(Unauthorized("Invalid appservice token.")));
 		};
@@ -32,7 +32,7 @@ pub(crate) async fn get_backfill_route(
 		room_id: &body.room_id,
 		event_id: None,
 	}
-	.assert()
+	.check()
 	.await?;
 	if !services
 		.rooms
@@ -44,7 +44,7 @@ pub(crate) async fn get_event_route(
 		room_id,
 		event_id: Some(&body.event_id),
 	}
-	.assert()
+	.check()
 	.await?;

 	if !services
@@ -23,7 +23,7 @@ pub(crate) async fn get_event_authorization_route(
 		room_id: &body.room_id,
 		event_id: None,
 	}
-	.assert()
+	.check()
 	.await?;

 	if services
@@ -26,7 +26,7 @@ pub(crate) async fn get_missing_events_route(
 		room_id: &body.room_id,
 		event_id: None,
 	}
-	.assert()
+	.check()
 	.await?;

 	if !services
@@ -676,13 +676,6 @@ async fn handle_edu_direct_to_device(
 	messages
 		.into_iter()
 		.stream()
-		.broad_filter_map(|(target_user_id, map)| async move {
-			services
-				.users
-				.is_active_local(&target_user_id)
-				.await
-				.then_some((target_user_id, map))
-		})
 		.for_each_concurrent(automatic_width(), |(target_user_id, map)| {
 			handle_edu_direct_to_device_user(services, target_user_id, sender, &ev_type, map)
 		})
@@ -21,7 +21,7 @@ pub(crate) async fn get_room_state_route(
 		room_id: &body.room_id,
 		event_id: None,
 	}
-	.assert()
+	.check()
 	.await?;

 	if services
@@ -22,7 +22,7 @@ pub(crate) async fn get_room_state_ids_route(
 		room_id: &body.room_id,
 		event_id: None,
 	}
-	.assert()
+	.check()
 	.await?;

 	if services
@@ -1,4 +1,4 @@
-use conduwuit::{Err, Result, is_false};
+use conduwuit::{Err, Result, implement, is_false};
 use conduwuit_service::Services;
 use futures::{FutureExt, future::OptionFuture, join};
 use ruma::{EventId, RoomId, ServerName};
@@ -10,56 +10,52 @@ pub(super) struct AccessCheck<'a> {
 	pub(super) event_id: Option<&'a EventId>,
 }

-impl AccessCheck<'_> {
-	/// Asserts that the server has access to the room and event (if any).
-	/// If the server is permitted, `Ok(())` is returned. Otherwise, a Forbidden
-	/// error is returned.
-	pub(super) async fn assert(&self) -> Result {
-		let acl_check = self
-			.services
-			.rooms
-			.event_handler
-			.acl_check(self.origin, self.room_id)
-			.map(|result| result.is_ok());
+#[implement(AccessCheck, params = "<'_>")]
+pub(super) async fn check(&self) -> Result {
+	let acl_check = self
+		.services
+		.rooms
+		.event_handler
+		.acl_check(self.origin, self.room_id)
+		.map(|result| result.is_ok());

-		let world_readable = self
-			.services
-			.rooms
-			.state_accessor
-			.is_world_readable(self.room_id);
+	let world_readable = self
+		.services
+		.rooms
+		.state_accessor
+		.is_world_readable(self.room_id);

-		let server_in_room = self
-			.services
-			.rooms
-			.state_cache
-			.server_in_room(self.origin, self.room_id);
+	let server_in_room = self
+		.services
+		.rooms
+		.state_cache
+		.server_in_room(self.origin, self.room_id);

-		let server_can_see: OptionFuture<_> = self
-			.event_id
-			.map(|event_id| {
-				self.services.rooms.state_accessor.server_can_see_event(
-					self.origin,
-					self.room_id,
-					event_id,
-				)
-			})
-			.into();
+	let server_can_see: OptionFuture<_> = self
+		.event_id
+		.map(|event_id| {
+			self.services.rooms.state_accessor.server_can_see_event(
+				self.origin,
+				self.room_id,
+				event_id,
+			)
+		})
+		.into();

-		let (world_readable, server_in_room, server_can_see, acl_check) =
-			join!(world_readable, server_in_room, server_can_see, acl_check);
+	let (world_readable, server_in_room, server_can_see, acl_check) =
+		join!(world_readable, server_in_room, server_can_see, acl_check);

-		if !acl_check {
-			return Err!(Request(Forbidden("Server access denied.")));
-		}
-
-		if !world_readable && !server_in_room {
-			return Err!(Request(Forbidden("Server is not in room.")));
-		}
-
-		if server_can_see.is_some_and(is_false!()) {
-			return Err!(Request(Forbidden("Server is not allowed to see event.")));
-		}
-
-		Ok(())
+	if !acl_check {
+		return Err!(Request(Forbidden("Server access denied.")));
 	}
+
+	if !world_readable && !server_in_room {
+		return Err!(Request(Forbidden("Server is not in room.")));
+	}
+
+	if server_can_see.is_some_and(is_false!()) {
+		return Err!(Request(Forbidden("Server is not allowed to see event.")));
+	}
+
+	Ok(())
 }
@@ -11,8 +11,8 @@ pub(crate) async fn get_server_version_route(
 ) -> Result<get_server_version::v1::Response> {
 	Ok(assign!(get_server_version::v1::Response::new(), {
 		server: Some(assign!(get_server_version::v1::Server::new(), {
-			name: Some(conduwuit::BRANDING.into()),
-			version: Some(conduwuit::version().into()),
+			name: Some(conduwuit::version::name().into()),
+			version: Some(conduwuit::version::version().into()),
 		})),
 	}))
 }
@@ -10,7 +10,7 @@
 };

 use super::Config;
-use crate::Result;
+use crate::{Result, implement};

 /// The configuration manager is an indirection to reload the configuration for
 /// the server while it is running. In order to not burden or clutter the many
@@ -39,48 +39,6 @@ pub(crate) fn new(config: Config) -> Self {
 			active: AtomicPtr::new(Arc::into_raw(config).cast_mut()),
 		}
 	}
-
-	/// Update the active configuration, returning prior configuration.
-	#[tracing::instrument(skip_all, level = "info")]
-	pub fn update(&self, config: Config) -> Result<Arc<Config>> {
-		let config = Arc::new(config);
-		let new = Arc::into_raw(config);
-		let old = self.active.swap(new.cast_mut(), Ordering::AcqRel);
-
-		// SAFETY: The old active pointer was set using an Arc::into_raw(). We're
-		// obliged to reconstitute that into Arc otherwise it will leak.
-		Ok(unsafe { Arc::from_raw(old) })
-	}
-
-	fn load(&self, handle: &mut [Option<Arc<Config>>]) -> &'static Arc<Config> {
-		let config = self.active.load(Ordering::Acquire);
-
-		// Branch taken after config reload or first access by this thread.
-		if handle[INDEX.get()]
-			.as_ref()
-			.is_none_or(|handle| !ptr::eq(config, Arc::as_ptr(handle)))
-		{
-			INDEX.set(INDEX.get().wrapping_add(1).wrapping_rem(HISTORY));
-			return load_miss(handle, INDEX.get(), config);
-		}
-
-		let config: &Arc<Config> = handle[INDEX.get()]
-			.as_ref()
-			.expect("handle was already cached for this thread");
-
-		// SAFETY: The caller should not hold multiple references at a time directly
-		// into Config, as a subsequent reference might invalidate the thread's cache
-		// causing another reference to dangle.
-		//
-		// This is a highly unusual pattern as most config values are copied by value or
-		// used immediately without running overlap with another value. Even if it does
-		// actually occur somewhere, the window of danger is limited to the config being
-		// reloaded while the reference is held and another access is made by the same
-		// thread into a different config value. This is mitigated by creating a buffer
-		// of old configs rather than discarding at the earliest opportunity; the odds
-		// of this scenario are thus astronomical.
-		unsafe { std::mem::transmute(config) }
-	}
 }

 impl Drop for Manager {
@@ -99,6 +57,50 @@ impl Deref for Manager {
 	fn deref(&self) -> &Self::Target { HANDLE.with_borrow_mut(|handle| self.load(handle)) }
 }

+/// Update the active configuration, returning prior configuration.
+#[implement(Manager)]
+#[tracing::instrument(skip_all, level = "info")]
+pub fn update(&self, config: Config) -> Result<Arc<Config>> {
+	let config = Arc::new(config);
+	let new = Arc::into_raw(config);
+	let old = self.active.swap(new.cast_mut(), Ordering::AcqRel);
+
+	// SAFETY: The old active pointer was set using an Arc::into_raw(). We're
+	// obliged to reconstitute that into Arc otherwise it will leak.
+	Ok(unsafe { Arc::from_raw(old) })
+}
+
+#[implement(Manager)]
+fn load(&self, handle: &mut [Option<Arc<Config>>]) -> &'static Arc<Config> {
+	let config = self.active.load(Ordering::Acquire);
+
+	// Branch taken after config reload or first access by this thread.
+	if handle[INDEX.get()]
+		.as_ref()
+		.is_none_or(|handle| !ptr::eq(config, Arc::as_ptr(handle)))
+	{
+		INDEX.set(INDEX.get().wrapping_add(1).wrapping_rem(HISTORY));
+		return load_miss(handle, INDEX.get(), config);
+	}
+
+	let config: &Arc<Config> = handle[INDEX.get()]
+		.as_ref()
+		.expect("handle was already cached for this thread");
+
+	// SAFETY: The caller should not hold multiple references at a time directly
+	// into Config, as a subsequent reference might invalidate the thread's cache
+	// causing another reference to dangle.
+	//
+	// This is a highly unusual pattern as most config values are copied by value or
+	// used immediately without running overlap with another value. Even if it does
+	// actually occur somewhere, the window of danger is limited to the config being
+	// reloaded while the reference is held and another access is made by the same
+	// thread into a different config value. This is mitigated by creating a buffer
+	// of old configs rather than discarding at the earliest opportunity; the odds
+	// of this scenario are thus astronomical.
+	unsafe { std::mem::transmute(config) }
+}
+
 #[tracing::instrument(
 	name = "miss",
 	level = "trace",
@@ -4,7 +4,7 @@
 pub mod proxy;

 use std::{
-	collections::{BTreeMap, BTreeSet},
+	collections::{BTreeMap, BTreeSet, HashMap},
 	net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr},
 	path::PathBuf,
 };
@@ -655,25 +655,19 @@ pub struct Config {
 	/// even if `recaptcha_site_key` is set.
 	pub recaptcha_private_site_key: Option<String>,

-	/// display: nested
-	#[serde(default)]
-	pub registration_terms: RegistrationTerms,
-
-	/// display: nested
-	#[serde(default)]
-	pub oauth: OauthConfig,
-
-	/// Controls whether users are allowed to deactivate their own accounts
-	/// through the account management panel or their Matrix clients. Server
-	/// admins can always deactivate users using the relevant admin commands.
+	/// Policy documents, such as terms and conditions or a privacy policy,
+	/// which users must agree to when registering an account.
 	///
-	/// Note that, in some jurisdictions, you may be legally required to honor
-	/// users who request to deactivate their accounts if you set this option
-	/// to `false`.
+	/// Example:
+	/// ```ignore
+	/// [global.registration_terms.privacy_policy]
+	/// en = { name = "Privacy Policy", url = "https://homeserver.example/en/privacy_policy.html" }
+	/// es = { name = "Política de Privacidad", url = "https://homeserver.example/es/privacy_policy.html" }
+	/// ```
 	///
-	/// default: true
-	#[serde(default = "true_fn")]
-	pub allow_deactivation: bool,
+	/// default: {}
+	#[serde(default)]
+	pub registration_terms: HashMap<String, HashMap<String, TermsDocument>>,

 	/// Controls whether encrypted rooms and events are allowed.
 	#[serde(default = "true_fn")]
@@ -2357,29 +2351,6 @@ pub struct SmtpConfig {
 	pub require_email_for_token_registration: bool,
 }

-#[derive(Clone, Debug, Default, Deserialize, Serialize)]
-#[config_example_generator(
-	filename = "conduwuit-example.toml",
-	section = "global.registration_terms",
-	optional = "true"
-)]
-pub struct RegistrationTerms {
-	/// The language code to provide to clients along with the policy documents.
-	///
-	/// default: "en"
-	#[serde(default = "default_terms_language")]
-	pub language: String,
-	/// Policy documents, such as terms and conditions or a privacy policy,
-	/// which users must agree to when registering an account.
-	///
-	/// Example:
-	/// ```ignore
-	/// [global.registration_terms.documents]
-	/// privacy_policy = { name = "Privacy Policy", url = "https://homeserver.example/en/privacy_policy.html" }
-	/// ```
-	pub documents: BTreeMap<String, TermsDocument>,
-}
-
 /// A policy document for use with a m.login.terms stage.
 #[derive(Clone, Debug, Deserialize, Serialize)]
 pub struct TermsDocument {
@@ -2387,43 +2358,6 @@ pub struct TermsDocument {
 	pub url: String,
 }

-#[derive(Clone, Debug, Default, Deserialize)]
-#[config_example_generator(
-	filename = "conduwuit-example.toml",
-	section = "global.oauth",
-	optional = "true"
-)]
-pub struct OauthConfig {
-	/// The compatibility mode to use for OAuth.
-	///
-	/// - "disabled": OAuth will be unavailable. Users will only be able to log
-	///   in using legacy authentication.
-	/// - "hybrid": OAuth and legacy authentication will both be available. Some
-	///   clients may only use one or the other.
-	/// - "exclusive": Only OAuth will be available. Clients which require
-	///   legacy authentication will be unable to log in.
-	///
-	/// default: "hybrid"
-	pub compatibility_mode: OAuthMode,
-}
-
-#[derive(Clone, Debug, Default, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum OAuthMode {
-	Disabled,
-	#[default]
-	Hybrid,
-	Exclusive,
-}
-
-impl OAuthMode {
-	#[must_use]
-	pub fn uiaa_available(&self) -> bool { matches!(self, Self::Disabled | Self::Hybrid) }
-
-	#[must_use]
-	pub fn oauth_available(&self) -> bool { matches!(self, Self::Hybrid | Self::Exclusive) }
-}
-
 const DEPRECATED_KEYS: &[&str] = &[
 	"cache_capacity",
 	"conduit_cache_capacity_modifier",
@@ -2804,5 +2738,3 @@ fn default_client_response_timeout() -> u64 { 120 }
 fn default_client_shutdown_timeout() -> u64 { 15 }

 fn default_sender_shutdown_timeout() -> u64 { 5 }
-
-fn default_terms_language() -> String { "en".to_owned() }
@@ -161,7 +161,6 @@ pub fn message(&self) -> String {
 		match self {
 			| Self::Federation(origin, error) => format!("Answer from {origin}: {error}"),
 			| Self::Ruma(error) => response::ruma_error_message(error),
-			| Self::Request(_, message, _) => message.clone().into_owned(),
 			| _ => format!("{self}"),
 		}
 	}
@@ -73,8 +73,11 @@ pub(super) fn bad_request_code(kind: &ErrorKind) -> StatusCode {
 		// 413
 		| TooLarge => StatusCode::PAYLOAD_TOO_LARGE,

+		// 405
+		| Unrecognized => StatusCode::METHOD_NOT_ALLOWED,
+
 		// 404
-		| Unrecognized | NotFound => StatusCode::NOT_FOUND,
+		| NotFound => StatusCode::NOT_FOUND,

 		// 403
 		| GuestAccessForbidden
@@ -7,16 +7,19 @@

 use std::sync::OnceLock;

-pub const BRANDING: &str = "continuwuity";
-pub const ROUTE_PREFIX: &str = "/_continuwuity";
-pub const WEBSITE: &str = "https://continuwuity.org";
-pub const SEMANTIC: &str = env!("CARGO_PKG_VERSION");
+static BRANDING: &str = "continuwuity";
+static WEBSITE: &str = "https://continuwuity.org";
+static SEMANTIC: &str = env!("CARGO_PKG_VERSION");

 static VERSION: OnceLock<String> = OnceLock::new();
 static VERSION_UA: OnceLock<String> = OnceLock::new();
 static USER_AGENT: OnceLock<String> = OnceLock::new();
 static USER_AGENT_MEDIA: OnceLock<String> = OnceLock::new();

+#[inline]
+#[must_use]
+pub fn name() -> &'static str { BRANDING }
+
 #[inline]
 pub fn version() -> &'static str { VERSION.get_or_init(init_version) }

@@ -29,10 +32,10 @@ pub fn user_agent() -> &'static str { USER_AGENT.get_or_init(init_user_agent) }
 #[inline]
 pub fn user_agent_media() -> &'static str { USER_AGENT_MEDIA.get_or_init(init_user_agent_media) }

-fn init_user_agent() -> String { format!("{BRANDING}/{} (bot; +{WEBSITE})", version_ua()) }
+fn init_user_agent() -> String { format!("{}/{} (bot; +{WEBSITE})", name(), version_ua()) }

 fn init_user_agent_media() -> String {
-	format!("{BRANDING}/{} (embedbot; facebookexternalhit/1.1; +{WEBSITE})", version_ua())
+	format!("{}/{} (embedbot; facebookexternalhit/1.1; +{WEBSITE})", name(), version_ua())
 }

 fn init_version_ua() -> String {
@@ -1,34 +1,32 @@
 use ruma::{RoomVersionId, canonical_json::redact_content_in_place};
 use serde_json::{Value as JsonValue, json, value::to_raw_value};

-use crate::{Err, Result, err};
+use crate::{Err, Result, err, implement};

-impl super::Pdu {
-	pub fn redact(&mut self, room_version_id: &RoomVersionId, reason: JsonValue) -> Result {
-		let Some(rules) = room_version_id.rules() else {
-			return Err!("Cannot redact event for unknown room version {room_version_id}");
-		};
+#[implement(super::Pdu)]
+pub fn redact(&mut self, room_version_id: &RoomVersionId, reason: JsonValue) -> Result {
+	let Some(rules) = room_version_id.rules() else {
+		return Err!("Cannot redact event for unknown room version {room_version_id}");
+	};

-		self.unsigned = None;
+	self.unsigned = None;

-		let mut content = serde_json::from_str(self.content.get()).map_err(|e| {
-			err!(Request(BadJson("Failed to deserialize content into type: {e}")))
-		})?;
+	let mut content = serde_json::from_str(self.content.get())
+		.map_err(|e| err!(Request(BadJson("Failed to deserialize content into type: {e}"))))?;

-		redact_content_in_place(&mut content, &rules.redaction, self.kind.to_string());
+	redact_content_in_place(&mut content, &rules.redaction, self.kind.to_string());

-		let reason = serde_json::to_value(reason).expect("Failed to preserialize reason");
+	let reason = serde_json::to_value(reason).expect("Failed to preserialize reason");

-		let redacted_because = json!({
-			"redacted_because": reason,
-		});
+	let redacted_because = json!({
+		"redacted_because": reason,
+	});

-		self.unsigned = to_raw_value(&redacted_because)
-			.expect("Failed to serialize unsigned")
-			.into();
+	self.unsigned = to_raw_value(&redacted_because)
+		.expect("Failed to serialize unsigned")
+		.into();

-		self.content = to_raw_value(&content).expect("Failed to serialize content");
+	self.content = to_raw_value(&content).expect("Failed to serialize content");

-		Ok(())
-	}
+	Ok(())
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Allinen	d50e0f53d2	style: fixed EOF	2026-06-03 22:31:34 -04:00
Allinen	57e82f1783	fix: simplified comparison logic	2026-06-03 22:31:34 -04:00
Allinen	1d311073b9	feat: token expiration improvement	2026-06-03 22:31:34 -04:00
				`@@ -1 +0,0 @@`
				Users may now be forbidden from deactivating their own accounts with the new `allow_deactivation` config option. Contributed by @ginger.
				`@@ -1 +0,0 @@`
				Added support for Matrix 1.16's `state_after` feature, allowing clients which understand it to sync room state changes more reliably. Contributed by @ginger.
				`@@ -1 +0,0 @@`
				`Added support for authenticating clients using the new OAuth 2.0 login API. Contributed by @ginger.`
				`@@ -1 +0,0 @@`
				`Added example configuration using caddy-docker-proxy in the livekit setup section of the docs. Contributed by @Cease`
				`@@ -1 +0,0 @@`
				`Fixed admin commands being ignored when they had leading whitespace before admin commands. Contributed by @kitvonsnookerz.`
				`@@ -1 +0,0 @@`
				Added static builds using Nix, allowing for Continuwuity on musl. During this, we also introduced a `max-perf-haswell` package, separating it from `max-perf`, so you may want to swap to this if you are on NixOS. Contributed by @Henry-Hiles (QuadRadical).
				`@@ -1 +0,0 @@`
				`Added support for MSC4380 invite blocking, which has become part of the Matrix specification in v1.18. Contributed by @nex.`
				`@@ -1 +0,0 @@`
				Adjusted legacy sync logic to no longer use the `roomsynctoken_shortstatehash` database column. Once this change has been confirmed to be stable and reliable, a future update will remove it entirely, significantly decreasing database sizes. Contributed by @ginger.