diff --git a/AGENTS.md b/AGENTS.md
index 7f5f0d7..d410344 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -92,6 +92,23 @@ as project instructions, not as optional documentation.
   proof.
 - Do not hand-edit generated frontend output.
 
+## Phone Configurator parity (mandatory)
+
+- Every new, changed, renamed, moved, or removed configurable value in
+  `sky_phone/config/config.lua` or `sky_phone/config/media.lua` **must** be
+  reflected in the in-game Phone Configurator in the same change. Config-only
+  changes without matching Configurator support are incomplete and must not be
+  committed or merged.
+- Keep the Configurator's runtime schema, defaults, value types, fixed versus
+  extensible collection rules, labels, descriptions, English and German
+  locales, SQL persistence, validation, and save/load roundtrip aligned with
+  the Lua configuration.
+- The Configurator must remain complete when file-based configuration is
+  disabled. Do not introduce a setting that can only be managed by editing Lua
+  after `Config.PhoneConfigurator.Enabled` is enabled.
+- Add or update contract/fixture coverage so configuration parity regressions
+  fail automated checks.
+
 ## Working method and verification
 
 1. Trace the relevant client, server, NUI, configuration, persistence, and event
diff --git a/README.md b/README.md
index 11fc060..7597172 100644
--- a/README.md
+++ b/README.md
@@ -218,6 +218,34 @@ The files contain clearly separated sections for:
 
 Restart `sky_phone` after changing Lua configuration.
 
+### In-game phone configurator
+
+Set the switch at the beginning of `config/config.lua` to use SQL-backed configuration:
+
+```lua
+Config.PhoneConfigurator = {
+    Enabled = true,
+}
+```
+
+When enabled, `config.lua` and the server-only `media.lua` are first-run defaults. Sky Phone creates
+the `sky_phone_configurator` table automatically, loads its saved values before framework and phone
+modules initialize, and exposes the editor through `/phonepanel`. Nothing autosaves: stage changes
+in the Phone Configurator tool and press the green check. Saving verifies both SQL payloads and then
+applies the new server, client, media, app, item, command, provider, animation, and UI values through
+Sky Phone's internal runtime refresh. It does not execute a resource restart command.
+
+Every `Config.*` value from `config.lua`, including server-only sections, and every value from
+`Config.Media` is discovered automatically. The bootstrap switch above intentionally remains
+file-owned because it decides whether SQL configuration is loaded. Lists, nested objects, vectors,
+and numeric-keyed Lua tables use structured editors instead of raw JSON. Shipped schema rows stay
+editable but cannot be renamed, converted, or removed. Every list and table still accepts any number
+of additional rows; administrator-added rows remain removable. Company job keys are intentionally
+fully removable because `Config.Companies.Definitions` is a freely managed job collection.
+
+Media API keys and server peppers are never returned in plaintext to the NUI. Existing secrets are
+shown only as configured and are replaced only when an administrator enters a new value.
+
 ### Language
 
 Available locales:
@@ -541,7 +569,11 @@ Select `rtx`, `quasar`, `vms`, `rx`, `nolag`, `sn`, `esx_property`, or `qbx_prop
 
 ### Companies
 
-Company jobs, public profiles, service numbers, services, permissions, locations, and default availability are configured under `Config.Companies.Definitions`.
+Company jobs, public profiles, service numbers, services, permissions, locations, and default
+availability are configured under `Config.Companies.Definitions`. Definitions are not limited to the
+shipped jobs: add any number of company IDs in the in-game configurator and fill the freely
+configurable `Job` value in the automatically generated full company template. Existing job keys can
+also be removed; the remaining Companies settings stay available as normal individual fields.
 
 ### Weazel News
 
diff --git a/frontend/src/App.vue b/frontend/src/App.vue
index 21f575a..095f0cf 100644
--- a/frontend/src/App.vue
+++ b/frontend/src/App.vue
@@ -11,6 +11,7 @@ import {
 import { useRoute, useRouter } from 'vue-router'
 
 import { SkyProvider } from '@/ui'
+import AdminPanel from '@/components/AdminPanel.vue'
 import PhoneHomeIndicator from '@/components/PhoneHomeIndicator.vue'
 import PhoneControlCenter from '@/components/PhoneControlCenter.vue'
 import PhoneDynamicIsland from '@/components/PhoneDynamicIsland.vue'
@@ -115,8 +116,13 @@ type AppMessage = {
     | CustomAppCatalogEventData
     | CustomAppEventData
     | NavigationEventData
+    | AdminPanelOpenPayload
 }
 
+type AdminPanelOpenPayload = Required<
+  Pick<PhoneOpenPayload, 'fallbackLocales' | 'lang' | 'locales'>
+>
+
 type CustomAppCatalogEventData = {
   apps?: unknown
 }
@@ -357,6 +363,9 @@ const appTransitionName = computed(() =>
   route.query.transition === 'app-switch' ? 'app-switch' : 'app-window',
 )
 const isLocked = ref(false)
+const adminPanelOpen = ref(
+  isDevelopment && developmentParameters.has('adminPanel'),
+)
 const springboardEditing = ref(false)
 const isUnlocking = ref(false)
 const passcodeBusy = ref(false)
@@ -630,6 +639,8 @@ function loadUnlockedPhoneData(): void {
 }
 
 function completePhoneSetup(): void {
+  const requestedRoute = pendingUnlockRoute.value
+  pendingUnlockRoute.value = null
   setupPreviewDismissed.value = true
   setupAppearanceSelected.value = false
   isLocked.value = false
@@ -637,7 +648,7 @@ function completePhoneSetup(): void {
   passcodeVisible.value = false
   passcodeRequired.value = false
   controlCenterOpened.value = false
-  void router.replace('/')
+  void router.replace(requestedRoute ?? '/')
   loadUnlockedPhoneData()
 }
 
@@ -721,7 +732,15 @@ function openDevelopmentPayphonePreview(): void {
 function onMessage(event: MessageEvent<AppMessage>): void {
   if (!isTrustedRootMessageSource(event.source, window)) return
 
-  if (event.data?.type === 'custom-apps:catalog') {
+  if (event.data?.type === 'admin:open') {
+    const data = event.data.data as AdminPanelOpenPayload | undefined
+    if (data?.lang && data.locales && data.fallbackLocales) {
+      phone.setLocale(data.lang, data.locales, data.fallbackLocales)
+    }
+    adminPanelOpen.value = true
+  } else if (event.data?.type === 'admin:close') {
+    adminPanelOpen.value = false
+  } else if (event.data?.type === 'custom-apps:catalog') {
     appCatalog.replaceCatalog(event.data.data)
     const catalogPayload = event.data.data as
       | { apps?: unknown; debug?: unknown }
@@ -766,7 +785,12 @@ function onMessage(event: MessageEvent<AppMessage>): void {
       isPhoneAppId(data.appId) &&
       appStore.isInstalled(data.appId)
     ) {
-      void router.push(`/apps/${data.appId}`)
+      const requestedRoute = `/apps/${data.appId}`
+      if (setupRequired.value || isLocked.value) {
+        pendingUnlockRoute.value = requestedRoute
+      } else {
+        void router.push(requestedRoute)
+      }
     } else {
       console.error('[Navigation] Ignored an unavailable app target.')
     }
@@ -1731,6 +1755,15 @@ onBeforeUnmount(() => {
 </script>
 
 <template>
+  <SkyProvider
+    v-if="adminPanelOpen"
+    dark
+    :safe-areas="false"
+    accent="#74d66f"
+    accent-soft="rgba(116, 214, 111, 0.14)"
+  >
+    <AdminPanel @close="adminPanelOpen = false" />
+  </SkyProvider>
   <PhoneMediaCapture />
   <PhoneMemoRecorder />
   <RadioHud />
diff --git a/frontend/src/components/AdminConfigValueEditor.vue b/frontend/src/components/AdminConfigValueEditor.vue
new file mode 100644
index 0000000..ecf43d7
--- /dev/null
+++ b/frontend/src/components/AdminConfigValueEditor.vue
@@ -0,0 +1,1671 @@
+<script setup lang="ts">
+import {
+  ChevronDown,
+  Plus,
+  Rows3,
+  TableProperties,
+  Trash2,
+} from 'lucide-vue-next'
+import { computed, ref } from 'vue'
+
+import { vConfigInputWidth } from '@/directives/configInputWidth'
+import type { AdminConfiguratorStructure } from '@/types/admin'
+import type { AdminConfiguratorDescribe } from '@/utils/adminConfiguratorDescription'
+
+export type AdminConfigEditorLabels = {
+  addField: string
+  addRow: string
+  configuredSecret: string
+  convertToList: string
+  convertToMap: string
+  convertToTable: string
+  emptyList: string
+  emptyTable: string
+  entry: string
+  general: string
+  keyPlaceholder: string
+  list: string
+  remove: string
+  table: string
+  types: {
+    boolean: string
+    list: string
+    number: string
+    string: string
+    table: string
+  }
+  vector: string
+}
+
+defineOptions({ name: 'AdminConfigValueEditor' })
+
+const props = withDefaults(
+  defineProps<{
+    ariaLabel?: string
+    depth?: number
+    describe: AdminConfiguratorDescribe
+    disabled?: boolean
+    labels: AdminConfigEditorLabels
+    modelValue: unknown
+    path?: string
+    structure?: AdminConfiguratorStructure
+    tabLabel?: (key: string, value: unknown) => string
+  }>(),
+  { ariaLabel: '', depth: 0, disabled: false, path: '' },
+)
+const emit = defineEmits<{ 'update:modelValue': [value: unknown] }>()
+
+type ValueKind = 'boolean' | 'list' | 'number' | 'string' | 'table'
+type MapKeyKind = 'number' | 'string'
+type SerializedMapEntry = {
+  key: number | string
+  keyType: MapKeyKind
+  value: unknown
+}
+type RootTableTab = { count: number; id: string; key?: string; label: string }
+
+const newArrayKind = ref<ValueKind>('string')
+const newObjectKey = ref('')
+const newObjectKind = ref<ValueKind>('string')
+const newMapKey = ref('')
+const newMapKeyKind = ref<MapKeyKind>('string')
+const newMapValueKind = ref<ValueKind>('string')
+const expandedEntry = ref<string | null>(null)
+const selectedTableTab = ref('')
+
+const isList = computed(
+  () =>
+    props.structure?.kind === 'list' ||
+    (props.structure?.kind !== 'map' &&
+      props.structure?.kind !== 'table' &&
+      Array.isArray(props.modelValue)),
+)
+const listValue = computed<unknown[]>(() =>
+  Array.isArray(props.modelValue) ? props.modelValue : [],
+)
+const isTable = computed(
+  () =>
+    props.structure?.kind === 'map' ||
+    props.structure?.kind === 'table' ||
+    props.structure?.kind === 'vector' ||
+    (props.modelValue !== null &&
+      typeof props.modelValue === 'object' &&
+      !Array.isArray(props.modelValue)),
+)
+const tableValue = computed<Record<string, unknown>>(() =>
+  isTable.value && !Array.isArray(props.modelValue)
+    ? (props.modelValue as Record<string, unknown>)
+    : {},
+)
+const vectorType = computed(() => {
+  const value = tableValue.value.__skyType
+  return typeof value === 'string' && /^vector[234]$/.test(value) ? value : ''
+})
+const mapType = computed(
+  () => props.structure?.kind === 'map' || tableValue.value.__skyType === 'map',
+)
+const mapEntries = computed<SerializedMapEntry[]>(() => {
+  const entries = tableValue.value.entries
+  if (!mapType.value || !Array.isArray(entries)) return []
+  return entries.filter(
+    (entry): entry is SerializedMapEntry =>
+      entry !== null &&
+      typeof entry === 'object' &&
+      (entry.keyType === 'number' || entry.keyType === 'string'),
+  )
+})
+const listStructure = computed(() =>
+  props.structure?.kind === 'list' ? props.structure : null,
+)
+const listTemplate = computed(
+  () => listStructure.value?.template ?? listStructure.value?.items[0],
+)
+const tableStructure = computed(() =>
+  props.structure?.kind === 'table' ? props.structure : null,
+)
+const mapStructure = computed(() =>
+  props.structure?.kind === 'map' ? props.structure : null,
+)
+const mapTemplate = computed(() => mapStructure.value?.template)
+const newMapEntryKeyKind = computed<MapKeyKind>(
+  () => mapStructure.value?.keyType ?? newMapKeyKind.value,
+)
+const canAddTableField = computed(() => {
+  const key = newObjectKey.value.trim()
+  if (
+    !key ||
+    key === '__skyType' ||
+    Object.prototype.hasOwnProperty.call(tableValue.value, key)
+  )
+    return false
+  return !tableStructure.value?.mutableKeys || /^[a-z0-9_-]+$/.test(key)
+})
+const canExtendTable = computed(
+  () =>
+    !vectorType.value &&
+    (!tableStructure.value || tableStructure.value.mutableKeys === true),
+)
+const usesFixedTableLayout = computed(
+  () =>
+    Boolean(tableStructure.value) && tableStructure.value?.mutableKeys !== true,
+)
+const tableEntries = computed(() =>
+  Object.entries(tableValue.value).filter(
+    ([key]) => key !== '__skyType' && (!mapType.value || key !== 'entries'),
+  ),
+)
+const rootTableTabs = computed<RootTableTab[]>(() => {
+  if (props.depth !== 0 || !tableStructure.value || mapType.value) return []
+  const structuredEntries = tableEntries.value.filter(([key, value]) =>
+    isStructuredValue(value, tableFieldStructure(key)),
+  )
+  if (!structuredEntries.length) return []
+  const scalarCount = tableEntries.value.length - structuredEntries.length
+  return [
+    ...(scalarCount
+      ? [{ count: scalarCount, id: 'general', label: props.labels.general }]
+      : []),
+    ...structuredEntries.map(([key]) => ({
+      count: configuratorStructureSize(tableFieldStructure(key)),
+      id: `field:${key}`,
+      key,
+      label: props.tabLabel?.(key, tableValue.value[key]) ?? key,
+    })),
+  ]
+})
+const activeRootTableTab = computed(
+  () =>
+    rootTableTabs.value.find((tab) => tab.id === selectedTableTab.value) ??
+    rootTableTabs.value[0] ??
+    null,
+)
+const activeRootTableField = computed(() => {
+  const key = activeRootTableTab.value?.key
+  if (!key) return null
+  const entry = tableEntries.value.find(([candidate]) => candidate === key)
+  return entry ? { key: entry[0], value: entry[1] } : null
+})
+const visibleTableEntries = computed(() => {
+  if (!rootTableTabs.value.length) return tableEntries.value
+  if (activeRootTableField.value) return []
+  return tableEntries.value.filter(
+    ([key, value]) => !isStructuredValue(value, tableFieldStructure(key)),
+  )
+})
+const isMaskedSecret = computed(() => props.modelValue === '***REDACTED***')
+const parsedNewMapKey = computed(() => {
+  const key = newMapKey.value.trim()
+  if (!key) return null
+  if (newMapEntryKeyKind.value === 'string') return key
+  const numeric = Number(key)
+  return Number.isFinite(numeric) ? numeric : null
+})
+const canAddMapEntry = computed(() => {
+  const key = parsedNewMapKey.value
+  if (key === null) return false
+  return !mapEntries.value.some(
+    (entry) => entry.keyType === newMapEntryKeyKind.value && entry.key === key,
+  )
+})
+
+function blankValue(kind: ValueKind): unknown {
+  if (kind === 'boolean') return false
+  if (kind === 'number') return 0
+  if (kind === 'list') return []
+  if (kind === 'table') return {}
+  return ''
+}
+
+function blankLike(value: unknown): unknown {
+  if (Array.isArray(value)) return []
+  if (value !== null && typeof value === 'object') {
+    const blank: Record<string, unknown> = {}
+    for (const [key, child] of Object.entries(value)) {
+      blank[key] = key === '__skyType' ? child : blankLike(child)
+    }
+    return blank
+  }
+  if (typeof value === 'boolean') return false
+  if (typeof value === 'number') return 0
+  return ''
+}
+
+function blankCollectionValue(kind: ValueKind, siblings: unknown[]): unknown {
+  const template = siblings.find((value) => {
+    if (kind === 'list') return Array.isArray(value)
+    if (kind === 'table') {
+      return (
+        value !== null && typeof value === 'object' && !Array.isArray(value)
+      )
+    }
+    return typeof value === kind
+  })
+  return template === undefined ? blankValue(kind) : blankLike(template)
+}
+
+function isStructuredValue(
+  value: unknown,
+  structure?: AdminConfiguratorStructure,
+): boolean {
+  if (
+    structure?.kind === 'list' ||
+    structure?.kind === 'map' ||
+    structure?.kind === 'table' ||
+    structure?.kind === 'vector'
+  )
+    return true
+  return value !== null && typeof value === 'object'
+}
+
+function structuredValueLabel(
+  value: unknown,
+  structure?: AdminConfiguratorStructure,
+): string {
+  if (structure?.kind === 'vector') {
+    return `${props.labels.vector} ${structure.vectorType.slice(-1)}`
+  }
+  if (structure?.kind === 'list' || Array.isArray(value)) {
+    return props.labels.list
+  }
+  return props.labels.table
+}
+
+function structureTypeLabel(structure: AdminConfiguratorStructure): string {
+  if (structure.kind === 'optionalString') return props.labels.types.string
+  if (structure.kind === 'value') return props.labels.types[structure.valueType]
+  if (structure.kind === 'list') return props.labels.types.list
+  if (structure.kind === 'vector') {
+    return `${props.labels.vector} ${structure.vectorType.slice(-1)}`
+  }
+  return props.labels.types.table
+}
+
+function configuratorStructureSize(
+  structure: AdminConfiguratorStructure | undefined,
+): number {
+  if (
+    !structure ||
+    structure.kind === 'optionalString' ||
+    structure.kind === 'value'
+  ) {
+    return 1
+  }
+  if (structure.kind === 'vector') {
+    return Number(structure.vectorType.slice(-1))
+  }
+  if (structure.kind === 'list') {
+    return Math.max(
+      1,
+      structure.items.reduce(
+        (total, item) => total + configuratorStructureSize(item),
+        0,
+      ),
+    )
+  }
+  if (structure.kind === 'map') {
+    return Math.max(
+      1,
+      structure.entries.reduce(
+        (total, entry) => total + configuratorStructureSize(entry.structure),
+        0,
+      ),
+    )
+  }
+  return Math.max(
+    1,
+    Object.values(structure.fields).reduce(
+      (total, field) => total + configuratorStructureSize(field),
+      0,
+    ),
+  )
+}
+
+function toggleStructuredEntry(entry: string): void {
+  expandedEntry.value = expandedEntry.value === entry ? null : entry
+}
+
+function tableEntryPath(key: string): string {
+  return props.path ? `${props.path}.${key}` : key
+}
+
+function listEntryPath(index: number): string {
+  return `${props.path || props.ariaLabel}[${index + 1}]`
+}
+
+function listItemStructure(
+  index: number,
+): AdminConfiguratorStructure | undefined {
+  return listStructure.value?.items[index] ?? listTemplate.value
+}
+
+function mapValuePath(entry: SerializedMapEntry): string {
+  return props.path ? `${props.path}.${entry.key}` : String(entry.key)
+}
+
+function blankFromStructure(structure: AdminConfiguratorStructure): unknown {
+  if (structure.kind === 'optionalString') return ''
+  if (structure.kind === 'value') return blankValue(structure.valueType)
+  if (structure.kind === 'vector') {
+    const axes = ['x', 'y', 'z', 'w'].slice(
+      0,
+      Number(structure.vectorType.slice(-1)),
+    )
+    return Object.fromEntries([
+      ['__skyType', structure.vectorType],
+      ...axes.map((axis) => [axis, 0]),
+    ])
+  }
+  if (structure.kind === 'list') {
+    return structure.items.map(blankFromStructure)
+  }
+  if (structure.kind === 'map') {
+    return {
+      __skyType: 'map',
+      entries: structure.entries.map((entry) => ({
+        key: entry.key,
+        keyType: entry.keyType,
+        value: blankFromStructure(entry.structure),
+      })),
+    }
+  }
+  return Object.fromEntries(
+    Object.entries(structure.fields).map(([key, field]) => [
+      key,
+      blankFromStructure(field),
+    ]),
+  )
+}
+
+function updateScalar(event: Event): void {
+  const target = event.target
+  if (!(target instanceof HTMLInputElement)) return
+  if (typeof props.modelValue === 'number') {
+    const value = Number(target.value)
+    if (Number.isFinite(value)) emit('update:modelValue', value)
+    return
+  }
+  emit('update:modelValue', target.value)
+}
+
+function updateBoolean(event: Event): void {
+  const target = event.target
+  if (target instanceof HTMLInputElement) {
+    emit('update:modelValue', target.checked)
+  }
+}
+
+function updateOptionalString(event: Event): void {
+  const target = event.target
+  if (target instanceof HTMLInputElement) {
+    emit('update:modelValue', target.value)
+  }
+}
+
+function toggleOptionalString(event: Event): void {
+  const target = event.target
+  if (!(target instanceof HTMLInputElement)) return
+  emit('update:modelValue', target.checked ? '' : false)
+}
+
+function addListRow(): void {
+  const rows = Array.isArray(props.modelValue) ? [...props.modelValue] : []
+  const index = rows.length
+  const value = rows.length
+    ? blankLike(rows[0])
+    : listTemplate.value
+      ? blankFromStructure(listTemplate.value)
+      : blankValue(newArrayKind.value)
+  rows.push(value)
+  emit('update:modelValue', rows)
+  if (isStructuredValue(value, listTemplate.value)) {
+    expandedEntry.value = `list:${index}`
+  }
+}
+
+function updateListRow(index: number, value: unknown): void {
+  const rows = Array.isArray(props.modelValue) ? [...props.modelValue] : []
+  rows[index] = value
+  emit('update:modelValue', rows)
+}
+
+function removeListRow(index: number): void {
+  if (listStructure.value?.items[index]) return
+  const rows = Array.isArray(props.modelValue) ? [...props.modelValue] : []
+  rows.splice(index, 1)
+  emit('update:modelValue', rows)
+  expandedEntry.value = null
+}
+
+function updateTableField(key: string, value: unknown): void {
+  emit('update:modelValue', { ...tableValue.value, [key]: value })
+}
+
+function tableFieldStructure(
+  key: string,
+): AdminConfiguratorStructure | undefined {
+  if (!tableStructure.value) return undefined
+  return (
+    tableStructure.value.fields[key] ??
+    (tableStructure.value.mutableKeys
+      ? tableStructure.value.template
+      : undefined)
+  )
+}
+
+function isFixedTableField(key: string): boolean {
+  return (
+    tableStructure.value?.mutableKeys !== true &&
+    Object.prototype.hasOwnProperty.call(
+      tableStructure.value?.fields ?? {},
+      key,
+    )
+  )
+}
+
+function removeTableField(key: string): void {
+  if (isFixedTableField(key)) return
+  const next = { ...tableValue.value }
+  delete next[key]
+  emit('update:modelValue', next)
+  if (expandedEntry.value === `table:${key}`) expandedEntry.value = null
+}
+
+function addTableField(): void {
+  const key = newObjectKey.value.trim()
+  if (!canAddTableField.value) return
+  const template = tableStructure.value?.mutableKeys
+    ? tableStructure.value.template
+    : undefined
+  const value = template
+    ? blankFromStructure(template)
+    : blankCollectionValue(
+        newObjectKind.value,
+        Object.values(tableValue.value).filter((_, index) => index < 50),
+      )
+  emit('update:modelValue', {
+    ...tableValue.value,
+    [key]: value,
+  })
+  if (isStructuredValue(value, template)) {
+    expandedEntry.value = `table:${key}`
+    if (props.depth === 0) selectedTableTab.value = `field:${key}`
+  }
+  newObjectKey.value = ''
+}
+
+function emitMap(entries: SerializedMapEntry[]): void {
+  emit('update:modelValue', { __skyType: 'map', entries })
+}
+
+function convertTableToMap(): void {
+  emitMap(
+    Object.entries(tableValue.value)
+      .filter(([key]) => key !== '__skyType')
+      .map(([key, value]) => ({ key, keyType: 'string', value })),
+  )
+}
+
+function updateMapKey(index: number, event: Event): void {
+  const target = event.target
+  if (!(target instanceof HTMLInputElement)) return
+  const current = mapEntries.value[index]
+  if (!current) return
+  if (fixedMapEntryStructure(current)) {
+    target.value = String(current.key)
+    return
+  }
+  const key =
+    current.keyType === 'number' ? Number(target.value) : target.value.trim()
+  if (
+    key === '' ||
+    (typeof key === 'number' && !Number.isFinite(key)) ||
+    mapEntries.value.some(
+      (entry, candidateIndex) =>
+        candidateIndex !== index &&
+        entry.keyType === current.keyType &&
+        entry.key === key,
+    )
+  ) {
+    target.value = String(current.key)
+    return
+  }
+  const entries = mapEntries.value.map((entry, candidateIndex) =>
+    candidateIndex === index ? { ...entry, key } : entry,
+  )
+  emitMap(entries)
+}
+
+function updateMapValue(index: number, value: unknown): void {
+  emitMap(
+    mapEntries.value.map((entry, candidateIndex) =>
+      candidateIndex === index ? { ...entry, value } : entry,
+    ),
+  )
+}
+
+function removeMapEntry(index: number): void {
+  const entry = mapEntries.value[index]
+  if (!entry || fixedMapEntryStructure(entry)) return
+  emitMap(
+    mapEntries.value.filter((_, candidateIndex) => candidateIndex !== index),
+  )
+  expandedEntry.value = null
+}
+
+function addMapEntry(): void {
+  if (!canAddMapEntry.value || parsedNewMapKey.value === null) return
+  const key = parsedNewMapKey.value
+  const value = mapTemplate.value
+    ? blankFromStructure(mapTemplate.value)
+    : blankCollectionValue(
+        newMapValueKind.value,
+        mapEntries.value.slice(0, 50).map((entry) => entry.value),
+      )
+  emitMap([
+    ...mapEntries.value,
+    {
+      key,
+      keyType: newMapEntryKeyKind.value,
+      value,
+    },
+  ])
+  if (isStructuredValue(value, mapTemplate.value)) {
+    expandedEntry.value = `map:${newMapEntryKeyKind.value}:${key}`
+  }
+  newMapKey.value = ''
+}
+
+function fixedMapEntryStructure(
+  entry: SerializedMapEntry,
+): AdminConfiguratorStructure | undefined {
+  return mapStructure.value?.entries.find(
+    (candidate) =>
+      candidate.keyType === entry.keyType && candidate.key === entry.key,
+  )?.structure
+}
+
+function mapEntryStructure(
+  entry: SerializedMapEntry,
+): AdminConfiguratorStructure | undefined {
+  return fixedMapEntryStructure(entry) ?? mapTemplate.value
+}
+</script>
+
+<template>
+  <div
+    v-if="isList"
+    class="config-structured-editor"
+    :class="{
+      'has-structure': Boolean(structure),
+      'is-nested': depth > 0,
+    }"
+  >
+    <header class="config-structured-editor__bar">
+      <span><Rows3 :size="14" />{{ labels.list }}</span>
+      <div class="config-structured-editor__actions">
+        <button
+          v-if="!listValue.length && !structure"
+          type="button"
+          :disabled="disabled"
+          :title="labels.convertToTable"
+          @click="emit('update:modelValue', {})"
+        >
+          <TableProperties :size="13" />
+        </button>
+      </div>
+    </header>
+
+    <div v-if="listValue.length" class="config-structured-editor__rows">
+      <div
+        v-for="(row, index) in listValue"
+        :key="index"
+        class="config-structured-editor__row"
+        :class="{
+          'has-structured-value': isStructuredValue(
+            row,
+            listItemStructure(index),
+          ),
+          'is-expanded': expandedEntry === `list:${index}`,
+        }"
+      >
+        <span class="config-structured-editor__index">{{ index + 1 }}</span>
+        <button
+          v-if="isStructuredValue(row, listItemStructure(index))"
+          type="button"
+          class="config-structured-editor__section-toggle"
+          :aria-label="`${ariaLabel} ${index + 1}`"
+          :aria-expanded="expandedEntry === `list:${index}`"
+          @click="toggleStructuredEntry(`list:${index}`)"
+        >
+          <span class="config-structured-editor__field-copy">
+            <strong>{{ labels.entry }} {{ index + 1 }}</strong>
+            <small
+              :title="
+                describe(listEntryPath(index), row, listItemStructure(index))
+              "
+            >
+              {{
+                describe(listEntryPath(index), row, listItemStructure(index))
+              }}
+            </small>
+          </span>
+          <em>{{ structuredValueLabel(row, listItemStructure(index)) }}</em>
+          <ChevronDown :size="14" />
+        </button>
+        <span v-else class="config-structured-editor__field-copy is-list-entry">
+          <strong>{{ labels.entry }} {{ index + 1 }}</strong>
+          <small
+            :title="
+              describe(listEntryPath(index), row, listItemStructure(index))
+            "
+          >
+            {{ describe(listEntryPath(index), row, listItemStructure(index)) }}
+          </small>
+        </span>
+        <AdminConfigValueEditor
+          v-if="
+            !isStructuredValue(row, listItemStructure(index)) ||
+            expandedEntry === `list:${index}`
+          "
+          :model-value="row"
+          :structure="listItemStructure(index)"
+          :aria-label="`${ariaLabel} ${index + 1}`"
+          :describe="describe"
+          :labels="labels"
+          :tab-label="tabLabel"
+          :disabled="disabled"
+          :depth="depth + 1"
+          :path="listEntryPath(index)"
+          @update:model-value="updateListRow(index, $event)"
+        />
+        <button
+          v-if="!listStructure?.items[index]"
+          type="button"
+          class="config-structured-editor__remove"
+          :disabled="disabled"
+          :title="labels.remove"
+          @click="removeListRow(index)"
+        >
+          <Trash2 :size="13" />
+        </button>
+      </div>
+    </div>
+    <div v-else class="config-structured-editor__empty">
+      {{ labels.emptyList }}
+    </div>
+
+    <form
+      class="config-structured-editor__add-field is-list"
+      @submit.prevent="addListRow"
+    >
+      <select
+        v-if="!listValue.length && !listTemplate"
+        v-model="newArrayKind"
+        :disabled="disabled"
+      >
+        <option value="string">{{ labels.types.string }}</option>
+        <option value="number">{{ labels.types.number }}</option>
+        <option value="boolean">{{ labels.types.boolean }}</option>
+        <option value="table">{{ labels.types.table }}</option>
+      </select>
+      <span
+        v-else-if="listTemplate"
+        class="config-structured-editor__fixed-type"
+      >
+        {{ structureTypeLabel(listTemplate) }}
+      </span>
+      <button type="submit" :disabled="disabled">
+        <Plus :size="13" />{{ labels.addRow }}
+      </button>
+    </form>
+  </div>
+
+  <div
+    v-else-if="isTable"
+    class="config-structured-editor"
+    :class="{
+      'has-structure': Boolean(structure),
+      'is-fixed-table': usesFixedTableLayout,
+      'is-nested': depth > 0,
+    }"
+  >
+    <header v-if="!usesFixedTableLayout" class="config-structured-editor__bar">
+      <span>
+        <TableProperties :size="14" />
+        {{
+          vectorType ? `${labels.vector} ${vectorType.slice(-1)}` : labels.table
+        }}
+      </span>
+      <div
+        v-if="!structure && !mapType && !vectorType"
+        class="config-structured-editor__actions"
+      >
+        <button
+          type="button"
+          :disabled="disabled"
+          :title="labels.convertToMap"
+          @click="convertTableToMap"
+        >
+          <TableProperties :size="13" />{{ labels.convertToMap }}
+        </button>
+        <button
+          v-if="!tableEntries.length"
+          type="button"
+          :disabled="disabled"
+          :title="labels.convertToList"
+          @click="emit('update:modelValue', [])"
+        >
+          <Rows3 :size="13" />{{ labels.convertToList }}
+        </button>
+      </div>
+    </header>
+
+    <nav
+      v-if="rootTableTabs.length"
+      class="config-structured-editor__tabs"
+      role="tablist"
+      :aria-label="ariaLabel"
+    >
+      <button
+        v-for="tableTab in rootTableTabs"
+        :key="tableTab.id"
+        type="button"
+        role="tab"
+        :class="{ 'is-active': activeRootTableTab?.id === tableTab.id }"
+        :aria-selected="activeRootTableTab?.id === tableTab.id"
+        @click="selectedTableTab = tableTab.id"
+      >
+        <span>{{ tableTab.label }}</span>
+        <em>{{ tableTab.count }}</em>
+      </button>
+    </nav>
+
+    <div
+      v-if="activeRootTableField"
+      class="config-structured-editor__tab-panel"
+      role="tabpanel"
+    >
+      <div
+        v-if="!isFixedTableField(activeRootTableField.key)"
+        class="config-structured-editor__tab-panel-actions"
+      >
+        <strong>{{ activeRootTableField.key }}</strong>
+        <button
+          type="button"
+          :disabled="disabled"
+          :title="labels.remove"
+          @click="removeTableField(activeRootTableField.key)"
+        >
+          <Trash2 :size="13" />{{ labels.remove }}
+        </button>
+      </div>
+      <AdminConfigValueEditor
+        :model-value="activeRootTableField.value"
+        :structure="tableFieldStructure(activeRootTableField.key)"
+        :aria-label="`${ariaLabel} ${activeRootTableField.key}`"
+        :describe="describe"
+        :labels="labels"
+        :tab-label="tabLabel"
+        :disabled="disabled"
+        :depth="depth + 1"
+        :path="tableEntryPath(activeRootTableField.key)"
+        @update:model-value="updateTableField(activeRootTableField.key, $event)"
+      />
+    </div>
+
+    <div
+      v-else-if="mapType"
+      class="config-structured-editor__properties is-map"
+    >
+      <div
+        v-for="(entry, index) in mapEntries"
+        :key="`${entry.keyType}:${entry.key}`"
+        class="config-structured-editor__property is-map"
+        :class="{
+          'has-structured-value': isStructuredValue(
+            entry.value,
+            mapEntryStructure(entry),
+          ),
+          'is-expanded': expandedEntry === `map:${entry.keyType}:${entry.key}`,
+        }"
+      >
+        <span class="config-structured-editor__index">{{ index + 1 }}</span>
+        <span class="config-structured-editor__map-key">
+          <small>{{ labels.types[entry.keyType] }}</small>
+          <input
+            :type="entry.keyType === 'number' ? 'number' : 'text'"
+            :value="entry.key"
+            :aria-label="`${ariaLabel} ${labels.types[entry.keyType]} ${index + 1}`"
+            :disabled="disabled || Boolean(fixedMapEntryStructure(entry))"
+            @change="updateMapKey(index, $event)"
+          />
+          <em
+            :title="
+              describe(
+                mapValuePath(entry),
+                entry.value,
+                mapEntryStructure(entry),
+              )
+            "
+          >
+            {{
+              describe(
+                mapValuePath(entry),
+                entry.value,
+                mapEntryStructure(entry),
+              )
+            }}
+          </em>
+        </span>
+        <button
+          v-if="isStructuredValue(entry.value, mapEntryStructure(entry))"
+          type="button"
+          class="config-structured-editor__section-toggle is-map"
+          :aria-label="`${ariaLabel} ${entry.key}`"
+          :aria-expanded="expandedEntry === `map:${entry.keyType}:${entry.key}`"
+          @click="toggleStructuredEntry(`map:${entry.keyType}:${entry.key}`)"
+        >
+          <small>{{
+            structuredValueLabel(entry.value, mapEntryStructure(entry))
+          }}</small>
+          <ChevronDown :size="14" />
+        </button>
+        <AdminConfigValueEditor
+          v-if="
+            !isStructuredValue(entry.value, mapEntryStructure(entry)) ||
+            expandedEntry === `map:${entry.keyType}:${entry.key}`
+          "
+          :model-value="entry.value"
+          :structure="mapEntryStructure(entry)"
+          :aria-label="`${ariaLabel} ${entry.key}`"
+          :describe="describe"
+          :labels="labels"
+          :tab-label="tabLabel"
+          :disabled="disabled"
+          :depth="depth + 1"
+          :path="mapValuePath(entry)"
+          @update:model-value="updateMapValue(index, $event)"
+        />
+        <button
+          v-if="!fixedMapEntryStructure(entry)"
+          type="button"
+          class="config-structured-editor__remove"
+          :disabled="disabled"
+          :title="labels.remove"
+          @click="removeMapEntry(index)"
+        >
+          <Trash2 :size="13" />
+        </button>
+      </div>
+      <div v-if="!mapEntries.length" class="config-structured-editor__empty">
+        {{ labels.emptyTable }}
+      </div>
+    </div>
+
+    <div
+      v-else-if="visibleTableEntries.length"
+      class="config-structured-editor__properties"
+      :role="rootTableTabs.length ? 'tabpanel' : undefined"
+    >
+      <div
+        v-for="([key, value], index) in visibleTableEntries"
+        :key="key"
+        class="config-structured-editor__property"
+        :class="{
+          'has-structured-value': isStructuredValue(
+            value,
+            tableFieldStructure(key),
+          ),
+          'is-expanded': expandedEntry === `table:${key}`,
+        }"
+      >
+        <span class="config-structured-editor__index">{{ index + 1 }}</span>
+        <button
+          v-if="isStructuredValue(value, tableFieldStructure(key))"
+          type="button"
+          class="config-structured-editor__section-toggle"
+          :aria-label="`${ariaLabel} ${key}`"
+          :aria-expanded="expandedEntry === `table:${key}`"
+          @click="toggleStructuredEntry(`table:${key}`)"
+        >
+          <span class="config-structured-editor__field-copy">
+            <strong>{{ key }}</strong>
+            <small
+              :title="
+                describe(tableEntryPath(key), value, tableFieldStructure(key))
+              "
+            >
+              {{
+                describe(tableEntryPath(key), value, tableFieldStructure(key))
+              }}
+            </small>
+          </span>
+          <em>{{ structuredValueLabel(value, tableFieldStructure(key)) }}</em>
+          <ChevronDown :size="14" />
+        </button>
+        <span v-else class="config-structured-editor__field-copy">
+          <strong>{{ key }}</strong>
+          <small
+            :title="
+              describe(tableEntryPath(key), value, tableFieldStructure(key))
+            "
+          >
+            {{ describe(tableEntryPath(key), value, tableFieldStructure(key)) }}
+          </small>
+        </span>
+        <AdminConfigValueEditor
+          v-if="
+            !isStructuredValue(value, tableFieldStructure(key)) ||
+            expandedEntry === `table:${key}`
+          "
+          :model-value="value"
+          :structure="tableFieldStructure(key)"
+          :aria-label="`${ariaLabel} ${key}`"
+          :describe="describe"
+          :labels="labels"
+          :tab-label="tabLabel"
+          :disabled="disabled"
+          :depth="depth + 1"
+          :path="tableEntryPath(key)"
+          @update:model-value="updateTableField(key, $event)"
+        />
+        <button
+          v-if="!vectorType && !isFixedTableField(key)"
+          type="button"
+          class="config-structured-editor__remove"
+          :disabled="disabled"
+          :title="labels.remove"
+          @click="removeTableField(key)"
+        >
+          <Trash2 :size="13" />
+        </button>
+      </div>
+    </div>
+    <div
+      v-else-if="!rootTableTabs.length"
+      class="config-structured-editor__empty"
+    >
+      {{ labels.emptyTable }}
+    </div>
+
+    <form
+      v-if="mapType"
+      class="config-structured-editor__add-field is-map"
+      @submit.prevent="addMapEntry"
+    >
+      <select
+        v-if="!mapStructure?.keyType"
+        v-model="newMapKeyKind"
+        :disabled="disabled"
+      >
+        <option value="string">{{ labels.types.string }}</option>
+        <option value="number">{{ labels.types.number }}</option>
+      </select>
+      <span v-else class="config-structured-editor__fixed-type is-key-type">
+        {{ labels.types[mapStructure.keyType] }}
+      </span>
+      <input
+        v-model="newMapKey"
+        :type="newMapEntryKeyKind === 'number' ? 'number' : 'text'"
+        :disabled="disabled"
+        :placeholder="labels.keyPlaceholder"
+        :aria-label="labels.keyPlaceholder"
+      />
+      <select
+        v-if="!mapTemplate"
+        v-model="newMapValueKind"
+        :disabled="disabled"
+      >
+        <option value="string">{{ labels.types.string }}</option>
+        <option value="number">{{ labels.types.number }}</option>
+        <option value="boolean">{{ labels.types.boolean }}</option>
+        <option value="list">{{ labels.types.list }}</option>
+        <option value="table">{{ labels.types.table }}</option>
+      </select>
+      <span v-else class="config-structured-editor__fixed-type">
+        {{ structureTypeLabel(mapTemplate) }}
+      </span>
+      <button type="submit" :disabled="disabled || !canAddMapEntry">
+        <Plus :size="13" />{{ labels.addField }}
+      </button>
+    </form>
+
+    <form
+      v-else-if="canExtendTable"
+      class="config-structured-editor__add-field"
+      @submit.prevent="addTableField"
+    >
+      <input
+        v-model="newObjectKey"
+        type="text"
+        :disabled="disabled"
+        :placeholder="labels.keyPlaceholder"
+        :aria-label="labels.keyPlaceholder"
+      />
+      <select
+        v-if="!tableStructure"
+        v-model="newObjectKind"
+        :disabled="disabled"
+      >
+        <option value="string">{{ labels.types.string }}</option>
+        <option value="number">{{ labels.types.number }}</option>
+        <option value="boolean">{{ labels.types.boolean }}</option>
+        <option value="list">{{ labels.types.list }}</option>
+        <option value="table">{{ labels.types.table }}</option>
+      </select>
+      <span
+        v-else-if="tableStructure.template"
+        class="config-structured-editor__fixed-type"
+      >
+        {{ structureTypeLabel(tableStructure.template) }}
+      </span>
+      <button type="submit" :disabled="disabled || !canAddTableField">
+        <Plus :size="13" />{{ labels.addField }}
+      </button>
+    </form>
+  </div>
+
+  <span
+    v-else-if="structure?.kind === 'optionalString'"
+    class="config-value-optional"
+  >
+    <input
+      v-config-input-width
+      class="config-value-input"
+      type="text"
+      :aria-label="ariaLabel"
+      :value="modelValue === false ? '' : String(modelValue ?? '')"
+      :disabled="disabled || modelValue === false"
+      autocomplete="off"
+      @input="updateOptionalString"
+    />
+    <label class="config-value-toggle">
+      <input
+        type="checkbox"
+        :aria-label="ariaLabel"
+        :checked="modelValue !== false"
+        :disabled="disabled"
+        @change="toggleOptionalString"
+      />
+      <i></i>
+    </label>
+  </span>
+
+  <label
+    v-else-if="typeof modelValue === 'boolean'"
+    class="config-value-toggle"
+  >
+    <input
+      type="checkbox"
+      :aria-label="ariaLabel"
+      :checked="modelValue"
+      :disabled="disabled"
+      @change="updateBoolean"
+    />
+    <i></i>
+  </label>
+
+  <input
+    v-else
+    v-config-input-width
+    class="config-value-input"
+    :aria-label="ariaLabel"
+    :type="
+      isMaskedSecret
+        ? 'password'
+        : typeof modelValue === 'number'
+          ? 'number'
+          : 'text'
+    "
+    :value="isMaskedSecret ? '' : String(modelValue ?? '')"
+    :placeholder="isMaskedSecret ? labels.configuredSecret : ''"
+    :disabled="disabled"
+    :autocomplete="isMaskedSecret ? 'new-password' : 'off'"
+    @input="updateScalar"
+  />
+</template>
+
+<style scoped>
+.config-structured-editor {
+  min-width: 0;
+  overflow: hidden;
+  border-radius: 4px;
+  background: #121413;
+  outline: 1px solid rgba(255, 255, 255, 0.065);
+}
+
+.config-structured-editor.is-nested {
+  background: #0f1110;
+}
+
+.config-structured-editor.is-fixed-table {
+  overflow: visible;
+  border-radius: 0;
+  outline: 0;
+  background: transparent;
+}
+
+.config-structured-editor.is-fixed-table
+  > .config-structured-editor__properties {
+  background: transparent;
+}
+
+.config-structured-editor.is-nested.has-structure
+  > .config-structured-editor__bar {
+  display: none;
+}
+
+.config-structured-editor__bar {
+  min-height: 32px;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  padding: 5px 7px;
+  background: rgba(255, 255, 255, 0.025);
+}
+
+.config-structured-editor__bar > span,
+.config-structured-editor__bar > div {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+}
+
+.config-structured-editor__actions:empty {
+  display: none;
+}
+
+.config-structured-editor__bar > span {
+  color: var(--admin-muted);
+  font-size: 8px;
+  font-weight: 650;
+  letter-spacing: 0.05em;
+  text-transform: uppercase;
+}
+
+.config-structured-editor__tabs {
+  display: flex;
+  gap: 3px;
+  overflow-x: auto;
+  padding: 6px 7px 0;
+  background: #0c0e0d;
+  scrollbar-width: thin;
+}
+
+.config-structured-editor .config-structured-editor__tabs > button {
+  min-width: max-content;
+  min-height: 29px;
+  display: inline-flex;
+  align-items: center;
+  gap: 7px;
+  padding: 0 10px;
+  border-radius: 3px 3px 0 0;
+  outline: 0;
+  color: var(--admin-muted);
+  background: transparent;
+  font-size: 8px;
+}
+
+.config-structured-editor .config-structured-editor__tabs > button:hover,
+.config-structured-editor .config-structured-editor__tabs > button.is-active {
+  color: var(--admin-text);
+  background: #171918;
+}
+
+.config-structured-editor .config-structured-editor__tabs > button.is-active {
+  box-shadow: inset 0 -1px var(--admin-green);
+}
+
+.config-structured-editor__tabs em {
+  color: var(--admin-dim);
+  font-size: 7px;
+  font-style: normal;
+}
+
+.config-structured-editor__tab-panel {
+  min-width: 0;
+  background: #0f1110;
+}
+
+.config-structured-editor__tab-panel > .config-structured-editor {
+  border-radius: 0;
+  outline: 0;
+}
+
+.config-structured-editor__tab-panel-actions {
+  min-height: 34px;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  padding: 5px 7px;
+  background: #141615;
+}
+
+.config-structured-editor__tab-panel-actions strong {
+  color: var(--admin-text);
+  font-size: 9px;
+}
+
+.config-structured-editor .config-structured-editor__tab-panel-actions button {
+  color: #b66a6a;
+}
+
+.config-structured-editor button,
+.config-structured-editor select,
+.config-structured-editor input,
+.config-value-input {
+  border: 0;
+  border-radius: 3px;
+  outline: 1px solid rgba(255, 255, 255, 0.075);
+  color: var(--admin-text);
+  background: #1a1c1b;
+  font: inherit;
+  font-size: 9px;
+}
+
+.config-structured-editor button {
+  min-height: 23px;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 4px;
+  padding: 0 7px;
+  color: var(--admin-green);
+  cursor: pointer;
+}
+
+.config-structured-editor button:hover:not(:disabled) {
+  background: #222423;
+}
+
+.config-structured-editor button:disabled,
+.config-structured-editor input:disabled,
+.config-structured-editor select:disabled,
+.config-value-input:disabled {
+  opacity: 0.45;
+  cursor: default;
+}
+
+.config-structured-editor select {
+  height: 23px;
+  padding: 0 5px;
+}
+
+.config-structured-editor__rows,
+.config-structured-editor__properties {
+  display: grid;
+  gap: 1px;
+  background: #0d0f0d;
+}
+
+.config-structured-editor__row,
+.config-structured-editor__property {
+  display: grid;
+  grid-template-columns: 24px minmax(180px, 0.82fr) minmax(140px, 1.18fr) 27px;
+  align-items: center;
+  gap: 6px;
+  padding: 5px 6px;
+  background: #151716;
+}
+
+.config-structured-editor__property {
+  grid-template-columns: 24px minmax(200px, 0.9fr) minmax(150px, 1.1fr) 27px;
+}
+
+.config-structured-editor__property.is-map {
+  grid-template-columns: 24px minmax(180px, 0.82fr) minmax(150px, 1.18fr) 27px;
+}
+
+.config-structured-editor__row.has-structured-value,
+.config-structured-editor__property.has-structured-value {
+  align-items: start;
+  background: linear-gradient(
+    90deg,
+    rgba(255, 255, 255, 0.022),
+    rgba(255, 255, 255, 0.008)
+  );
+}
+
+.config-structured-editor__row.has-structured-value.is-expanded,
+.config-structured-editor__property.has-structured-value.is-expanded {
+  background: linear-gradient(
+    90deg,
+    color-mix(in srgb, var(--admin-green) 7%, #1a1d1a),
+    #181b18 58%
+  );
+}
+
+.config-structured-editor__row.has-structured-value > .config-structured-editor,
+.config-structured-editor__property.has-structured-value
+  > .config-structured-editor {
+  grid-column: 1 / -1;
+  grid-row: 2;
+  width: calc(100% + 12px);
+  margin-inline: -6px;
+}
+
+.config-structured-editor__row.has-structured-value
+  > .config-structured-editor__index,
+.config-structured-editor__property.has-structured-value
+  > .config-structured-editor__index {
+  grid-column: 1;
+  grid-row: 1;
+  align-self: center;
+}
+
+.config-structured-editor__property.has-structured-value > strong,
+.config-structured-editor__property.has-structured-value
+  > .config-structured-editor__section-toggle {
+  grid-column: 2 / 4;
+  grid-row: 1;
+  align-self: center;
+}
+
+.config-structured-editor__row.has-structured-value
+  > .config-structured-editor__section-toggle {
+  grid-column: 2 / 4;
+  grid-row: 1;
+}
+
+.config-structured-editor__property.is-map.has-structured-value
+  > .config-structured-editor__map-key {
+  grid-column: 2;
+  grid-row: 1;
+  align-self: center;
+}
+
+.config-structured-editor__property.is-map.has-structured-value
+  > .config-structured-editor__section-toggle {
+  grid-column: 3;
+}
+
+.config-structured-editor__row.has-structured-value
+  > .config-structured-editor__remove {
+  grid-column: 4;
+  grid-row: 1;
+}
+
+.config-structured-editor__property.has-structured-value
+  > .config-structured-editor__remove {
+  grid-column: 4;
+  grid-row: 1;
+}
+
+.config-structured-editor .config-structured-editor__section-toggle {
+  width: 100%;
+  min-width: 0;
+  min-height: 27px;
+  justify-content: flex-start;
+  padding: 0 7px;
+  outline: 0;
+  color: #c9cec9;
+  background: transparent;
+}
+
+.config-structured-editor
+  .config-structured-editor__section-toggle:hover:not(:disabled) {
+  background: rgba(255, 255, 255, 0.025);
+}
+
+.config-structured-editor__field-copy {
+  min-width: 0;
+  display: grid;
+  gap: 2px;
+  text-align: left;
+}
+
+.config-structured-editor__field-copy strong {
+  overflow: hidden;
+  min-width: 0;
+  color: #c9cec9;
+  font-size: 9px;
+  font-weight: 600;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.config-structured-editor__field-copy small {
+  overflow: hidden;
+  color: var(--admin-muted);
+  font-size: 7.5px;
+  font-weight: 450;
+  line-height: 1.25;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.config-structured-editor__section-toggle
+  > .config-structured-editor__field-copy {
+  flex: 1 1 auto;
+}
+
+.config-structured-editor__section-toggle > em {
+  margin-left: auto;
+  color: var(--admin-muted);
+  font-size: 7px;
+  font-weight: 600;
+  font-style: normal;
+  letter-spacing: 0.05em;
+  text-transform: uppercase;
+}
+
+.config-structured-editor__section-toggle svg {
+  flex: 0 0 auto;
+  color: var(--admin-muted);
+  transition: transform 150ms ease;
+}
+
+.config-structured-editor__row.is-expanded
+  > .config-structured-editor__section-toggle
+  svg,
+.config-structured-editor__property.is-expanded
+  > .config-structured-editor__section-toggle
+  svg {
+  transform: rotate(180deg);
+}
+
+.config-structured-editor__section-toggle:focus-visible {
+  outline: 1px solid color-mix(in srgb, var(--admin-green) 55%, transparent);
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .config-structured-editor__section-toggle svg {
+    transition: none;
+  }
+}
+
+.config-structured-editor__map-key {
+  min-width: 0;
+  display: grid;
+  gap: 3px;
+}
+
+.config-structured-editor__map-key > small {
+  color: var(--admin-dim);
+  font-size: 7px;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+}
+
+.config-structured-editor__map-key > em {
+  overflow: hidden;
+  color: var(--admin-muted);
+  font-size: 7px;
+  font-style: normal;
+  line-height: 1.2;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.config-structured-editor__map-key input {
+  width: 100%;
+  min-width: 0;
+  height: 25px;
+  padding: 0 7px;
+}
+
+.config-structured-editor__index {
+  color: var(--admin-dim);
+  font-family: ui-monospace, SFMono-Regular, Consolas, monospace;
+  font-size: 8px;
+  text-align: center;
+}
+
+.config-structured-editor .config-structured-editor__remove {
+  width: 25px;
+  padding: 0;
+  color: #b66a6a;
+}
+
+.config-value-optional {
+  min-width: 0;
+  max-width: 100%;
+  display: flex;
+  align-items: center;
+  justify-self: start;
+  gap: 7px;
+}
+
+.config-structured-editor__empty {
+  padding: 13px 10px;
+  color: var(--admin-dim);
+  font-size: 9px;
+  text-align: center;
+}
+
+.config-structured-editor__add-field {
+  min-height: 37px;
+  display: flex;
+  align-items: center;
+  justify-content: flex-end;
+  gap: 6px;
+  padding: 6px;
+  background: linear-gradient(
+    90deg,
+    rgba(255, 255, 255, 0.012),
+    rgba(255, 255, 255, 0.035)
+  );
+}
+
+.config-structured-editor__add-field input {
+  min-width: 0;
+  flex: 1 1 120px;
+  height: 25px;
+  padding: 0 7px;
+}
+
+.config-structured-editor__add-field select {
+  width: 90px;
+  flex: 0 0 90px;
+}
+
+.config-structured-editor__fixed-type {
+  width: 90px;
+  height: 23px;
+  flex: 0 0 90px;
+  display: inline-flex;
+  align-items: center;
+  padding: 0 7px;
+  border-radius: 3px;
+  outline: 1px solid rgba(255, 255, 255, 0.055);
+  color: var(--admin-muted);
+  background: rgba(255, 255, 255, 0.025);
+  font-size: 8px;
+}
+
+.config-structured-editor__fixed-type.is-key-type {
+  width: 76px;
+  flex-basis: 76px;
+}
+
+.config-structured-editor__add-field button {
+  min-width: 74px;
+  flex: 0 0 auto;
+}
+
+.config-structured-editor__add-field.is-map select:first-child {
+  width: 76px;
+  flex-basis: 76px;
+}
+
+.config-structured-editor__add-field.is-map select:nth-of-type(2) {
+  width: 82px;
+  flex-basis: 82px;
+}
+
+.config-structured-editor__add-field.is-list select,
+.config-structured-editor__add-field.is-list
+  .config-structured-editor__fixed-type {
+  margin-left: auto;
+}
+
+.config-value-input {
+  max-width: 100%;
+  min-width: 0;
+  height: 29px;
+  justify-self: start;
+  padding: 0 8px;
+}
+
+.config-value-input[type='number'] {
+  appearance: textfield;
+}
+
+.config-structured-editor input[type='number']::-webkit-inner-spin-button,
+.config-structured-editor input[type='number']::-webkit-outer-spin-button {
+  margin: 0;
+  appearance: none;
+}
+
+.config-value-input:focus,
+.config-structured-editor input:focus,
+.config-structured-editor select:focus {
+  outline-color: color-mix(in srgb, var(--admin-green) 45%, transparent);
+}
+
+.config-value-toggle {
+  position: relative;
+  justify-self: start;
+  width: 32px;
+  height: 18px;
+}
+
+.config-value-toggle input {
+  position: absolute;
+  inset: 0;
+  z-index: 1;
+  margin: 0;
+  opacity: 0;
+  cursor: pointer;
+}
+
+.config-value-toggle i {
+  position: absolute;
+  inset: 0;
+  border-radius: 999px;
+  background: #393d39;
+}
+
+.config-value-toggle i::after {
+  content: '';
+  position: absolute;
+  top: 3px;
+  left: 3px;
+  width: 12px;
+  height: 12px;
+  border-radius: 50%;
+  background: #c7ccc7;
+  transition: transform 150ms ease;
+}
+
+.config-value-toggle input:checked + i {
+  background: var(--admin-toggle-on);
+}
+
+.config-value-toggle input:checked + i::after {
+  transform: translateX(14px);
+  background: #f4f7f4;
+}
+</style>
diff --git a/frontend/src/components/AdminPanel.contract.test.ts b/frontend/src/components/AdminPanel.contract.test.ts
new file mode 100644
index 0000000..823c9aa
--- /dev/null
+++ b/frontend/src/components/AdminPanel.contract.test.ts
@@ -0,0 +1,455 @@
+import { readFileSync } from 'node:fs'
+
+import { describe, expect, it } from 'vitest'
+
+const source = readFileSync(
+  new URL('./AdminPanel.vue', import.meta.url),
+  'utf8',
+)
+const agentInstructions = readFileSync(
+  new URL('../../../AGENTS.md', import.meta.url),
+  'utf8',
+)
+const app = readFileSync(new URL('../App.vue', import.meta.url), 'utf8')
+const apps = readFileSync(new URL('../config/apps.ts', import.meta.url), 'utf8')
+const store = readFileSync(
+  new URL('../stores/admin.ts', import.meta.url),
+  'utf8',
+)
+const server = readFileSync(
+  new URL('../../../sky_phone/source/server/admin.lua', import.meta.url),
+  'utf8',
+)
+const phoneServer = readFileSync(
+  new URL('../../../sky_phone/source/server/phone.lua', import.meta.url),
+  'utf8',
+)
+const persistenceServer = readFileSync(
+  new URL(
+    '../../../sky_phone/source/server/phone_persistence.lua',
+    import.meta.url,
+  ),
+  'utf8',
+)
+const simServer = readFileSync(
+  new URL('../../../sky_phone/source/server/sim.lua', import.meta.url),
+  'utf8',
+)
+const phoneClient = readFileSync(
+  new URL('../../../sky_phone/source/client/main.lua', import.meta.url),
+  'utf8',
+)
+const focusClient = readFileSync(
+  new URL('../../../sky_phone/source/client/focus.lua', import.meta.url),
+  'utf8',
+)
+const bridge = readFileSync(
+  new URL(
+    '../../../sky_phone/source/client/nui_server_bridge.lua',
+    import.meta.url,
+  ),
+  'utf8',
+)
+const config = readFileSync(
+  new URL('../../../sky_phone/config/config.lua', import.meta.url),
+  'utf8',
+)
+const schema = readFileSync(
+  new URL('../../../sky_phone/sql/install.sql', import.meta.url),
+  'utf8',
+)
+const manifest = readFileSync(
+  new URL('../../../sky_phone/fxmanifest.lua', import.meta.url),
+  'utf8',
+)
+const configuratorServer = readFileSync(
+  new URL(
+    '../../../sky_phone/source/server/phone_configurator.lua',
+    import.meta.url,
+  ),
+  'utf8',
+)
+const configuratorClient = readFileSync(
+  new URL(
+    '../../../sky_phone/source/client/phone_configurator.lua',
+    import.meta.url,
+  ),
+  'utf8',
+)
+const mediaImportServer = readFileSync(
+  new URL('../../../sky_phone/source/server/media_import.lua', import.meta.url),
+  'utf8',
+)
+const configuratorValueEditor = readFileSync(
+  new URL('./AdminConfigValueEditor.vue', import.meta.url),
+  'utf8',
+)
+const configInputWidth = readFileSync(
+  new URL('../directives/configInputWidth.ts', import.meta.url),
+  'utf8',
+)
+
+describe('standalone admin panel contracts', () => {
+  it('renders as a dedicated full-screen editor outside the phone shell', () => {
+    expect(apps).not.toContain("id: 'admin'")
+    expect(app).toContain("event.data?.type === 'admin:open'")
+    expect(app).toContain('v-if="adminPanelOpen"')
+    expect(app).toContain('<AdminPanel')
+    expect(source).toContain("import { SkyButton } from '@/ui'")
+    expect(source).toContain('class="admin-panel-overlay"')
+    expect(source).toContain('class="admin-panel-rail"')
+    expect(source).toContain('class="admin-panel-directory"')
+    expect(source).toContain('class="admin-panel-editor"')
+    expect(source).toContain('pointer-events: auto')
+    expect(source).toContain('@media (prefers-reduced-motion: reduce)')
+  })
+
+  it('uses a compact transparent shell with dedicated admin workspaces', () => {
+    expect(source).toContain('background: transparent')
+    expect(source).toContain('width: min(76vw, 1220px)')
+    expect(source).toContain('height: min(74vh, 700px)')
+    expect(source).toContain('--admin-row-hover: linear-gradient')
+    expect(source).toContain('--admin-row-active: linear-gradient')
+    expect(source).toContain('background: var(--admin-nav-active)')
+    expect(source).not.toContain('admin-panel-brand__mark')
+    expect(source).not.toContain('admin-panel-profile-heading__status')
+    expect(source).not.toContain('backdrop-filter: blur(2px)')
+    expect(source).not.toContain("t('overview.recent')")
+
+    for (const tab of [
+      'overview',
+      'players',
+      'devices',
+      'apps',
+      'accounts',
+      'messages',
+      'calls',
+      'moderation',
+      'audit',
+      'configurator',
+    ]) {
+      expect(source).toContain(`selectTab('${tab}')`)
+      expect(source).toContain(`t('tabs.${tab}')`)
+    }
+  })
+
+  it('removes manual reload and applies a persistent global accent choice', () => {
+    expect(source).not.toContain('<RefreshCw')
+    expect(source).not.toContain("kind: 'refresh'")
+    expect(source).toContain("'sky-phone-admin-accent'")
+    expect(source).toContain("'sky-phone-admin-font-family'")
+    expect(source).toContain("'sky-phone-admin-font-size'")
+    expect(source).toContain("'--admin-accent': accentColor")
+    expect(source).toContain("'--admin-font-family': activeAdminFontFamily")
+    expect(source).toContain(
+      "'--admin-font-scale': String(adminFontSize / 100)",
+    )
+    expect(source).toContain('class="admin-panel-color-value"')
+    expect(source).toContain('class="admin-panel-rgb-fields"')
+    expect(source).toContain('class="admin-panel-rgb-range"')
+    expect(source).toContain('class="admin-panel-font-select"')
+    expect(source).toContain('class="admin-panel-font-select__menu"')
+    expect(source).toContain('class="admin-panel-font-size-control"')
+    expect(source).not.toContain('type="color"')
+    expect(source).toContain('color-mix(in srgb, var(--admin-green)')
+    expect(source).toContain('--admin-toggle-on: #63d471')
+    expect(source).toContain('background: var(--admin-toggle-on)')
+    expect(configuratorValueEditor).toContain(
+      'background: var(--admin-toggle-on)',
+    )
+  })
+
+  it('stages app changes locally and saves them only from the toolbar action', () => {
+    expect(source).toContain('const drafts = ref<')
+    expect(source).toContain('@click="saveChanges"')
+    expect(source).toContain("t('editor.noAutoSave')")
+    expect(store).toContain("'admin:save-apps'")
+    expect(store).not.toContain("'admin:set-app'")
+    expect(server).toContain(
+      'Bridge.Callbacks.Register("sky_phone:admin:save-apps"',
+    )
+  })
+
+  it('connects every operation through the standard NUI callback bridge', () => {
+    expect(bridge).toContain('admin = [[')
+    for (const endpoint of [
+      'admin:bootstrap',
+      'admin:player',
+      'admin:save-apps',
+      'admin:reveal-password',
+      'admin:activity',
+      'admin:reset-passcode',
+      'admin:change-number',
+      'admin:factory-reset',
+      'admin:configurator',
+      'admin:save-configurator',
+    ]) {
+      expect(store).toContain(endpoint)
+    }
+  })
+
+  it('protects activity views and device moderation with ownership and audit checks', () => {
+    for (const endpoint of [
+      'activity',
+      'reset-passcode',
+      'change-number',
+      'factory-reset',
+    ]) {
+      expect(server).toContain(
+        `Bridge.Callbacks.Register("sky_phone:admin:${endpoint}"`,
+      )
+    }
+    expect(server).toContain('data.kind ~= "messages"')
+    expect(server).toContain('data.kind ~= "calls"')
+    expect(server).toContain('"view_messages"')
+    expect(server).toContain('"view_calls"')
+    expect(server).toContain('"reset_passcode"')
+    expect(server).toContain('"change_number"')
+    expect(server).toContain('"factory_reset"')
+    expect(simServer).toContain('function SkyPhoneSim.ChangeNumber(')
+    expect(simServer).toContain('UPDATE IGNORE `sky_phone_sims`')
+    expect(persistenceServer).toContain(
+      'function SkyPhonePersistence.FactoryReset(imei)',
+    )
+  })
+
+  it('authorizes every server request without requiring a phone session', () => {
+    expect(server).not.toContain('SkyPhone.RequireSession(source)')
+    expect(server).toContain(
+      'Bridge.Framework.HasAdminGroup(source, Config.AdminPanel.AdminGroups)',
+    )
+    expect(server).toContain('Config.AdminPanel.ReadRequestsPerMinute')
+    expect(server).toContain('Config.AdminPanel.ActionRequestsPerMinute')
+    expect(server).toContain('Config.AdminPanel.CredentialRevealsPerMinute')
+    expect(config).toContain('Config.AdminPanel = {')
+  })
+
+  it('opens directly from the configurable command with dedicated focus', () => {
+    expect(config).toContain('Command = "phonepanel"')
+    expect(server).toContain('local command_name = Config.AdminPanel.Command')
+    expect(server).toContain(
+      'RegisterCommand(command_name, function(command_source)',
+    )
+    expect(server).toContain(
+      'TriggerClientEvent("sky_phone:admin:launch", player_source)',
+    )
+    expect(phoneServer).not.toContain(
+      'RegisterCommand(Config.AdminPanel.Command',
+    )
+    expect(phoneClient).toContain('RegisterNetEvent("sky_phone:admin:launch"')
+    expect(phoneClient).toContain('SkyPhoneFocus.SetAdminPanel(true)')
+    expect(focusClient).toContain('function SkyPhoneFocus.SetAdminPanel(open)')
+  })
+
+  it('validates ownership, app policy, and revision before a batch mutation', () => {
+    expect(server).toContain('find_owned_device(target_source, data.imei)')
+    expect(server).toContain('app_metadata(change.appId)')
+    expect(server).toContain('error = "device_not_owned"')
+    expect(server).toContain('error = "app_protected"')
+    expect(server).toContain('AND `revision` = ?')
+    expect(server).toContain('SkyPhone.RefreshDevice(data.imei)')
+  })
+
+  it('gates plaintext account reveals behind confirmation and audit logging', () => {
+    expect(source).toContain('revealDialogImei')
+    expect(source).toContain("t('credentials.revealTitle')")
+    expect(server).toContain('"reveal_account_password"')
+    expect(server).toContain('write_audit(')
+    expect(server).not.toContain('passcode_hash` AS')
+    expect(schema).toContain(
+      'CREATE TABLE IF NOT EXISTS `sky_phone_admin_audit`',
+    )
+  })
+
+  it('loads the SQL phone configurator before framework-owned configuration is read', () => {
+    expect(agentInstructions).toContain('Phone Configurator parity (mandatory)')
+    expect(agentInstructions).toContain(
+      'changes without matching Configurator support are incomplete',
+    )
+    expect(config).toMatch(
+      /Config\.PhoneConfigurator\s*=\s*\{[\s\S]*?Enabled\s*=\s*true[\s\S]*?Config\.Bridge\s*=/,
+    )
+    expect(schema).toContain(
+      'CREATE TABLE IF NOT EXISTS `sky_phone_configurator`',
+    )
+    expect(
+      manifest.indexOf("'source/server/phone_configurator.lua'"),
+    ).toBeLessThan(manifest.indexOf("'source/bridge/server/framework.lua'"))
+    expect(
+      manifest.indexOf("'source/client/phone_configurator.lua'"),
+    ).toBeLessThan(manifest.indexOf("'source/bridge/client/framework.lua'"))
+    expect(configuratorServer).toContain('AND `revision` = ?')
+    expect(configuratorServer).toContain('configurator_enabled')
+    expect(configuratorServer).toMatch(
+      /for key, value in pairs\(Config\)[\s\S]*?key ~= "Media"[\s\S]*?key ~= "PhoneConfigurator"/,
+    )
+    expect(configuratorServer).toContain(
+      'default_media = serialize_value(Config.Media)',
+    )
+    expect(configuratorServer).toContain(
+      'build_sections("config", stored_config',
+    )
+    expect(configuratorServer).toContain('build_sections("media", stored_media')
+    expect(configuratorServer).toContain('sensitive_path')
+    expect(configuratorServer).toContain('restore_redacted_values')
+    expect(configuratorServer).toContain(
+      '{ __skyType = "map", entries = entries }',
+    )
+    expect(configuratorServer).toContain('validate_structured_value')
+    expect(configuratorServer).toContain('validate_locked_structure')
+    expect(configuratorServer).toContain('build_structure(default_value')
+    expect(configuratorServer).toContain('path == "Companies.Definitions"')
+    expect(configuratorServer).toContain('flatten_company_fields')
+    expect(configuratorServer).toContain('structure.mutableKeys')
+    expect(configuratorServer).toContain('local function empty_structure(')
+    expect(configuratorServer).toContain('template = items[1]')
+    expect(configuratorServer).toContain('structure.template')
+    expect(configuratorServer).toContain('if not structure.fields[key] then')
+    expect(configuratorServer).toContain('field.type == "stringOrFalse"')
+    expect(configuratorServer).not.toContain('Config.Media = client_payload')
+    expect(configuratorServer).toContain(
+      'apply_runtime_table(Config[key], value)',
+    )
+    expect(configuratorServer).toContain(
+      'apply_runtime_table(Config.Media, runtime_media)',
+    )
+    expect(configuratorServer).toContain('local function read_stored_row()')
+    expect(configuratorServer).toContain('local function apply_stored_row(row)')
+    expect(configuratorServer).toContain(
+      'persisted_row.media_payload ~= media_encoded',
+    )
+    expect(configuratorServer).toContain(
+      'Phone configurator SQL verification failed',
+    )
+    expect(server).not.toContain('ExecuteCommand(("restart %s")')
+    expect(configuratorServer).not.toContain('clear_runtime_table')
+    expect(configuratorServer).toContain(
+      'TriggerEvent("sky_phone:configurator:serverUpdated", revision)',
+    )
+    expect(configuratorServer).toContain(
+      'function SkyPhoneConfigurator.Broadcast(target)',
+    )
+    expect(configuratorServer).toContain('SkyPhoneConfigurator.Broadcast(-1)')
+    expect(configuratorServer).toContain('through the internal runtime refresh')
+    expect(configuratorClient).toContain(
+      'Bridge.Callbacks.Trigger("sky_phone:configurator:runtime"',
+    )
+    expect(configuratorClient).toContain(
+      'apply_runtime_table(Config[key], value)',
+    )
+    expect(configuratorClient).not.toContain('clear_runtime_table')
+    expect(configuratorClient).toContain(
+      'TriggerEvent("sky_phone:configurator:updated"',
+    )
+    expect(phoneClient).toMatch(
+      /AddEventHandler\("sky_phone:configurator:updated"[\s\S]*?SkyPhoneLocales\.Resolve\(Config\.Bridge\.Locale\)[\s\S]*?SkyPhoneApps\.SendCatalog\(\)[\s\S]*?type = "device:updated"/,
+    )
+    expect(server).toContain(
+      'AddEventHandler("sky_phone:configurator:serverUpdated"',
+    )
+    expect(phoneServer).toContain('register_configured_phone_item()')
+    expect(phoneServer).toContain(
+      'AddEventHandler("sky_phone:configurator:serverUpdated"',
+    )
+    expect(simServer).toContain('refresh_sim_types()')
+    expect(simServer).toContain(
+      'AddEventHandler("sky_phone:configurator:serverUpdated"',
+    )
+    expect(mediaImportServer).toContain('local website = {}')
+    expect(mediaImportServer).toContain('website._adapter = adapter')
+    expect(mediaImportServer).not.toContain('definition._adapter = adapter')
+    expect(mediaImportServer).toMatch(
+      /AddEventHandler\("sky_phone:configurator:serverUpdated"[\s\S]*?if initialized then[\s\S]*?build_registry\(\)/,
+    )
+    expect(source).toContain('class="admin-panel-rail__configurator"')
+    expect(source).toContain(
+      '.admin-panel-rail .admin-panel-rail__configurator',
+    )
+    expect(source).toContain('<AdminConfigValueEditor')
+    expect(source).toContain('function configuratorFieldRepeatsSection(')
+    expect(source).toContain('v-if="!configuratorFieldRepeatsSection(field)"')
+    expect(source).toContain('class="admin-panel-config-scopes"')
+    expect(source).toContain("selectConfiguratorScope('config')")
+    expect(source).toContain("selectConfiguratorScope('media')")
+    expect(source).not.toContain('class="admin-panel-config-meta"')
+    expect(configuratorValueEditor).toContain('function addListRow()')
+    expect(configuratorValueEditor).toContain('function addTableField()')
+    expect(configuratorValueEditor).toContain(
+      'const canExtendTable = computed(',
+    )
+    expect(configuratorValueEditor).toContain(
+      'tableStructure.value.mutableKeys === true',
+    )
+    expect(configuratorValueEditor).toContain(
+      'const usesFixedTableLayout = computed(',
+    )
+    expect(configuratorValueEditor).toContain(
+      "'is-fixed-table': usesFixedTableLayout",
+    )
+    expect(configuratorValueEditor).toContain('v-if="!usesFixedTableLayout"')
+    expect(configuratorValueEditor).toContain(
+      '.config-structured-editor.is-fixed-table',
+    )
+    expect(configuratorValueEditor).toContain('v-else-if="canExtendTable"')
+    expect(configuratorValueEditor).toContain('function removeListRow(')
+    expect(configuratorValueEditor).toContain('function removeTableField(')
+    expect(configuratorValueEditor).toContain('function addMapEntry()')
+    expect(configuratorValueEditor).toContain('function updateMapKey(')
+    expect(configuratorValueEditor).toContain('fixedMapEntryStructure(current)')
+    expect(configuratorValueEditor).toContain('listStructure?.items[index]')
+    expect(configuratorValueEditor).toContain('function listItemStructure(')
+    expect(configuratorValueEditor).toContain('const listTemplate = computed(')
+    expect(configuratorValueEditor).toContain('function structureTypeLabel(')
+    expect(configuratorValueEditor).toContain(
+      'class="config-structured-editor__fixed-type"',
+    )
+    expect(configuratorValueEditor).toContain(
+      'const rootTableTabs = computed<RootTableTab[]>(',
+    )
+    expect(configuratorValueEditor).toContain(
+      'class="config-structured-editor__tabs"',
+    )
+    expect(configuratorValueEditor).toContain(
+      'class="config-structured-editor__tab-panel"',
+    )
+    expect(source).toContain(':tab-label="configuratorSubtabLabel"')
+    expect(source).toContain('configurator.table.subtabs.${key}')
+    expect(configuratorValueEditor).toContain(
+      'props.tabLabel?.(key, tableValue.value[key]) ?? key',
+    )
+    expect(source).toContain('v-config-input-width')
+    expect(configuratorValueEditor).toContain('v-config-input-width')
+    expect(configInputWidth).toContain("input.addEventListener('input'")
+    expect(configInputWidth).toContain('input.scrollWidth')
+    expect(source).toContain('filter: drop-shadow')
+    expect(source).toContain("input[type='number']::-webkit-inner-spin-button")
+    expect(configuratorValueEditor).toContain(
+      "input[type='number']::-webkit-inner-spin-button",
+    )
+    expect(source).toContain('justify-self: start')
+    expect(configuratorValueEditor).toContain('function tableFieldStructure(')
+    expect(configuratorValueEditor).toContain('function isFixedTableField(')
+    expect(configuratorValueEditor).toContain('function blankCollectionValue(')
+    expect(configuratorValueEditor).toContain('function blankFromStructure(')
+    expect(source).toContain("'is-structured': field.type === 'json'")
+    expect(configuratorValueEditor).toContain('function isStructuredValue(')
+    expect(configuratorValueEditor).toContain(
+      'class="config-structured-editor__add-field is-list"',
+    )
+    expect(configuratorValueEditor).toContain(
+      'class="config-structured-editor__actions"',
+    )
+    expect(configuratorValueEditor).toContain('function toggleStructuredEntry(')
+    expect(configuratorValueEditor).toContain(
+      'class="config-structured-editor__section-toggle"',
+    )
+    expect(configuratorValueEditor).toContain(':aria-expanded=')
+    expect(configuratorValueEditor).toContain(
+      '@media (prefers-reduced-motion: reduce)',
+    )
+    expect(configuratorValueEditor).toContain(
+      '.config-structured-editor__property.has-structured-value',
+    )
+    expect(configuratorValueEditor).not.toContain('<textarea')
+  })
+})
diff --git a/frontend/src/components/AdminPanel.vue b/frontend/src/components/AdminPanel.vue
new file mode 100644
index 0000000..1b21dc4
--- /dev/null
+++ b/frontend/src/components/AdminPanel.vue
@@ -0,0 +1,4609 @@
+<script setup lang="ts">
+import {
+  BadgeDollarSign,
+  BriefcaseBusiness,
+  Check,
+  ChevronDown,
+  ChevronRight,
+  CircleUserRound,
+  Clipboard,
+  Database,
+  Eye,
+  Grid2X2,
+  HardDrive,
+  KeyRound,
+  LayoutDashboard,
+  LoaderCircle,
+  LockKeyhole,
+  MessageSquare,
+  Palette,
+  PhoneCall,
+  PhoneForwarded,
+  Save,
+  ScrollText,
+  Search,
+  Settings2,
+  ShieldAlert,
+  Smartphone,
+  Trash2,
+  TriangleAlert,
+  UsersRound,
+  WalletCards,
+  Wifi,
+  X,
+} from 'lucide-vue-next'
+import { computed, onBeforeUnmount, onMounted, ref, watch } from 'vue'
+
+import {
+  DEFAULT_INSTALLED_PHONE_APP_IDS,
+  getPhoneApp,
+  getPhoneAppLabel,
+  isExternalPhoneApp,
+  isLaunchablePhoneApp,
+  isPhoneAppRemovable,
+  PHONE_APPS,
+} from '@/config/apps'
+import { vConfigInputWidth } from '@/directives/configInputWidth'
+import { useAdminStore } from '@/stores/admin'
+import { usePhoneStore } from '@/stores/phone'
+import type {
+  AdminAuditEntry,
+  AdminConfiguratorChange,
+  AdminConfiguratorField,
+  AdminConfiguratorStructure,
+  AdminDevice,
+} from '@/types/admin'
+import type { LaunchablePhoneAppDefinition } from '@/types/apps'
+import { SkyButton } from '@/ui'
+import {
+  configuratorPathName,
+  describeConfiguratorValue,
+} from '@/utils/adminConfiguratorDescription'
+import { copyText } from '@/utils/clipboard'
+import { parseDatabaseDate } from '@/utils/date'
+import { nuiCall } from '@/utils/nui'
+
+import AdminConfigValueEditor, {
+  type AdminConfigEditorLabels,
+} from './AdminConfigValueEditor.vue'
+
+type AdminTab =
+  | 'overview'
+  | 'players'
+  | 'devices'
+  | 'apps'
+  | 'accounts'
+  | 'messages'
+  | 'calls'
+  | 'moderation'
+  | 'audit'
+  | 'configurator'
+type ConfiguratorScope = 'config' | 'media'
+type DeviceAction = 'reset-passcode' | 'change-number' | 'factory-reset'
+type PendingAction = { kind: 'close' } | { kind: 'player'; source: number }
+type AccentChannel = 'blue' | 'green' | 'red'
+type AdminFontFamily =
+  | 'classic'
+  | 'georgia'
+  | 'inter'
+  | 'mono'
+  | 'system'
+  | 'tahoma'
+  | 'trebuchet'
+  | 'verdana'
+
+const emit = defineEmits<{ close: [] }>()
+const admin = useAdminStore()
+const phone = usePhoneStore()
+const tab = ref<AdminTab>('overview')
+const playerQuery = ref('')
+const appQuery = ref('')
+const configuratorQuery = ref('')
+const configuratorScope = ref<ConfiguratorScope>('config')
+const selectedConfiguratorSection = ref('')
+const selectedImei = ref('')
+const drafts = ref<Record<string, Record<string, boolean>>>({})
+const configuratorDrafts = ref<Record<string, unknown>>({})
+const saving = ref(false)
+const revealDialogImei = ref('')
+const deviceAction = ref<DeviceAction | null>(null)
+const deviceActionInput = ref('')
+const discardDialog = ref(false)
+const fontMenuOpen = ref(false)
+const pendingAction = ref<PendingAction | null>(null)
+const toast = ref('')
+const toastTone = ref<'error' | 'success'>('success')
+let toastTimer: number | undefined
+
+const accentOptions = [
+  { color: '#74d66f', key: 'emerald' },
+  { color: '#4f9cff', key: 'blue' },
+  { color: '#a875ff', key: 'violet' },
+  { color: '#f0a24b', key: 'orange' },
+  { color: '#ef6969', key: 'red' },
+] as const
+const accentChannels = ['red', 'green', 'blue'] as const
+const fontFamilyOptions: Array<{
+  key: AdminFontFamily
+  value: string
+}> = [
+  { key: 'inter', value: 'var(--sky-font-family, Inter, sans-serif)' },
+  {
+    key: 'system',
+    value:
+      'system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif',
+  },
+  { key: 'classic', value: 'Arial, Helvetica, sans-serif' },
+  { key: 'verdana', value: 'Verdana, Geneva, sans-serif' },
+  { key: 'tahoma', value: 'Tahoma, Geneva, sans-serif' },
+  {
+    key: 'trebuchet',
+    value: '"Trebuchet MS", "Lucida Grande", sans-serif',
+  },
+  { key: 'georgia', value: 'Georgia, "Times New Roman", serif' },
+  {
+    key: 'mono',
+    value:
+      'ui-monospace, SFMono-Regular, Consolas, "Liberation Mono", monospace',
+  },
+]
+const accentColor = ref('#74d66f')
+const adminFontFamily = ref<AdminFontFamily>('inter')
+const adminFontSize = ref(100)
+const adminFontSizePreview = ref(100)
+const activeAdminFontFamily = computed(
+  () =>
+    fontFamilyOptions.find((option) => option.key === adminFontFamily.value)
+      ?.value ?? fontFamilyOptions[0].value,
+)
+const accentRgb = computed(() => {
+  const color = accentColor.value.replace('#', '')
+  return {
+    red: Number.parseInt(color.slice(0, 2), 16),
+    green: Number.parseInt(color.slice(2, 4), 16),
+    blue: Number.parseInt(color.slice(4, 6), 16),
+  }
+})
+
+const filteredPlayers = computed(() => {
+  const needle = playerQuery.value.trim().toLocaleLowerCase(phone.lang)
+  if (!needle) return admin.players
+  return admin.players.filter((player) =>
+    [
+      player.name,
+      player.serverName,
+      player.source,
+      player.identifier,
+      player.job,
+      player.phoneNumber ?? '',
+    ]
+      .join(' ')
+      .toLocaleLowerCase(phone.lang)
+      .includes(needle),
+  )
+})
+
+const selectedDevice = computed(() => {
+  const devices = admin.selectedPlayer?.devices ?? []
+  return (
+    devices.find((device) => device.imei === selectedImei.value) ??
+    devices[0] ??
+    null
+  )
+})
+
+const manageableApps = computed(() => {
+  const needle = appQuery.value.trim().toLocaleLowerCase(phone.lang)
+  return PHONE_APPS.filter(
+    (app): app is LaunchablePhoneAppDefinition =>
+      isLaunchablePhoneApp(app) && !app.adminOnly,
+  )
+    .filter(
+      (app) =>
+        !needle ||
+        getPhoneAppLabel(app, phone.t)
+          .toLocaleLowerCase(phone.lang)
+          .includes(needle),
+    )
+    .sort((left, right) =>
+      getPhoneAppLabel(left, phone.t).localeCompare(
+        getPhoneAppLabel(right, phone.t),
+        phone.lang,
+      ),
+    )
+})
+
+const appPendingCount = computed(() =>
+  Object.values(drafts.value).reduce(
+    (total, changes) => total + Object.keys(changes).length,
+    0,
+  ),
+)
+const configuratorPendingCount = computed(
+  () => Object.keys(configuratorDrafts.value).length,
+)
+const pendingCount = computed(
+  () => appPendingCount.value + configuratorPendingCount.value,
+)
+const hasChanges = computed(() => pendingCount.value > 0)
+const selectedDeviceChanges = computed(() =>
+  selectedDevice.value
+    ? Object.keys(drafts.value[selectedDevice.value.imei] ?? {}).length
+    : 0,
+)
+const revealedCredential = computed(() =>
+  selectedDevice.value
+    ? admin.revealedCredentials[selectedDevice.value.imei]
+    : undefined,
+)
+
+function configuratorStructureCount(
+  structure: AdminConfiguratorStructure | undefined,
+): number {
+  if (
+    !structure ||
+    structure.kind === 'value' ||
+    structure.kind === 'optionalString'
+  )
+    return 1
+  if (structure.kind === 'vector') return Number(structure.vectorType.slice(-1))
+  if (structure.kind === 'list') {
+    return Math.max(
+      1,
+      structure.items.reduce(
+        (total, item) => total + configuratorStructureCount(item),
+        0,
+      ),
+    )
+  }
+  if (structure.kind === 'map') {
+    return Math.max(
+      1,
+      structure.entries.reduce(
+        (total, entry) => total + configuratorStructureCount(entry.structure),
+        0,
+      ),
+    )
+  }
+  return Math.max(
+    1,
+    Object.values(structure.fields).reduce(
+      (total, field) => total + configuratorStructureCount(field),
+      0,
+    ),
+  )
+}
+
+function configuratorSectionCount(fields: AdminConfiguratorField[]): number {
+  return fields.reduce(
+    (total, field) => total + configuratorStructureCount(field.structure),
+    0,
+  )
+}
+
+function configuratorFieldRepeatsSection(
+  field: AdminConfiguratorField,
+): boolean {
+  const section = activeConfiguratorSection.value
+  if (!section || field.type !== 'json') return false
+  const normalize = (value: string) =>
+    value.toLocaleLowerCase().replace(/[^a-z0-9]/g, '')
+  return normalize(field.label) === normalize(section.label)
+}
+
+function configuratorStructureContains(
+  structure: AdminConfiguratorStructure | undefined,
+  needle: string,
+): boolean {
+  if (
+    !structure ||
+    structure.kind === 'value' ||
+    structure.kind === 'optionalString'
+  )
+    return false
+  if (structure.kind === 'vector') return structure.vectorType.includes(needle)
+  if (structure.kind === 'list') {
+    return structure.items.some((item) =>
+      configuratorStructureContains(item, needle),
+    )
+  }
+  if (structure.kind === 'map') {
+    return structure.entries.some(
+      (entry) =>
+        String(entry.key).toLocaleLowerCase(phone.lang).includes(needle) ||
+        configuratorStructureContains(entry.structure, needle),
+    )
+  }
+  return Object.entries(structure.fields).some(
+    ([key, field]) =>
+      key.toLocaleLowerCase(phone.lang).includes(needle) ||
+      configuratorStructureContains(field, needle),
+  )
+}
+
+const selectedMessages = computed(() =>
+  selectedDevice.value
+    ? (admin.deviceActivity[selectedDevice.value.imei]?.messages ?? [])
+    : [],
+)
+const selectedCalls = computed(() =>
+  selectedDevice.value
+    ? (admin.deviceActivity[selectedDevice.value.imei]?.calls ?? [])
+    : [],
+)
+const filteredConfiguratorSections = computed(() => {
+  const sections = (admin.configurator?.sections ?? []).filter(
+    (section) => section.scope === configuratorScope.value,
+  )
+  const needle = configuratorQuery.value.trim().toLocaleLowerCase(phone.lang)
+  if (!needle) return sections
+  return sections.filter(
+    (section) =>
+      section.label.toLocaleLowerCase(phone.lang).includes(needle) ||
+      section.scope.includes(needle) ||
+      section.fields.some(
+        (field) =>
+          field.label.toLocaleLowerCase(phone.lang).includes(needle) ||
+          field.path.toLocaleLowerCase(phone.lang).includes(needle) ||
+          configuratorStructureContains(field.structure, needle),
+      ),
+  )
+})
+const configuratorScopeCounts = computed(() => {
+  const sections = admin.configurator?.sections ?? []
+  return {
+    config: sections.filter((section) => section.scope === 'config').length,
+    media: sections.filter((section) => section.scope === 'media').length,
+  }
+})
+const filteredConfiguratorFieldCount = computed(() =>
+  filteredConfiguratorSections.value.reduce(
+    (total, section) => total + configuratorSectionCount(section.fields),
+    0,
+  ),
+)
+const activeConfiguratorSection = computed(() => {
+  const sections = filteredConfiguratorSections.value
+  return (
+    sections.find(
+      (section) => section.id === selectedConfiguratorSection.value,
+    ) ??
+    sections[0] ??
+    null
+  )
+})
+
+watch(
+  () => admin.selectedPlayer,
+  (player) => {
+    if (!player?.devices.some((device) => device.imei === selectedImei.value)) {
+      selectedImei.value = player?.devices[0]?.imei ?? ''
+    }
+  },
+)
+
+watch(
+  [() => admin.configurator?.sections, configuratorScope],
+  ([sections, scope]) => {
+    if (
+      !sections?.some(
+        (section) =>
+          section.id === selectedConfiguratorSection.value &&
+          section.scope === scope,
+      )
+    ) {
+      selectedConfiguratorSection.value =
+        sections?.find((section) => section.scope === scope)?.id ?? ''
+    }
+  },
+)
+
+watch(
+  [tab, selectedImei, () => admin.selectedPlayer?.source],
+  ([currentTab, imei, source]) => {
+    if (
+      !source ||
+      !imei ||
+      (currentTab !== 'messages' && currentTab !== 'calls')
+    ) {
+      return
+    }
+    void admin.loadActivity(source, imei, currentTab).then((loaded) => {
+      if (!loaded) showToast(errorText(), 'error')
+    })
+  },
+)
+
+function t(key: string, params?: Record<string, string>): string {
+  return phone.t('AdminPanel.' + key, params)
+}
+
+function configuratorLocaleText(key: string, fallback: string): string {
+  const translated = t(key)
+  return translated === key || translated === `AdminPanel.${key}`
+    ? fallback
+    : translated
+}
+
+function configuratorSubtabLabel(key: string, value: unknown): string {
+  const record =
+    value !== null && typeof value === 'object'
+      ? (value as Record<string, unknown>)
+      : null
+  if (
+    /^[a-z0-9_-]+$/.test(key) &&
+    typeof record?.Name === 'string' &&
+    record.Name
+  ) {
+    return record.Name
+  }
+  const fallback = configuratorPathName(key)
+  return configuratorLocaleText(
+    `configurator.table.subtabs.${key}`,
+    fallback.charAt(0).toLocaleUpperCase(phone.lang) + fallback.slice(1),
+  )
+}
+
+function selectConfiguratorScope(scope: ConfiguratorScope): void {
+  configuratorScope.value = scope
+  configuratorQuery.value = ''
+}
+
+function configuratorDescription(
+  path: string,
+  value: unknown,
+  structure?: AdminConfiguratorStructure,
+  label?: string,
+): string {
+  return describeConfiguratorValue(t, path, value, structure, label)
+}
+
+const configuratorEditorLabels = computed<AdminConfigEditorLabels>(() => ({
+  addField: t('configurator.table.addField'),
+  addRow: t('configurator.table.addRow'),
+  configuredSecret: t('configurator.secretConfigured'),
+  convertToList: t('configurator.table.convertToList'),
+  convertToMap: t('configurator.table.convertToMap'),
+  convertToTable: t('configurator.table.convertToTable'),
+  emptyList: t('configurator.table.emptyList'),
+  emptyTable: t('configurator.table.emptyTable'),
+  entry: t('configurator.table.entry'),
+  general: configuratorLocaleText('configurator.table.general', 'General'),
+  keyPlaceholder: t('configurator.table.keyPlaceholder'),
+  list: t('configurator.table.list'),
+  remove: t('configurator.table.remove'),
+  table: t('configurator.table.table'),
+  types: {
+    boolean: t('configurator.table.types.boolean'),
+    list: t('configurator.table.types.list'),
+    number: t('configurator.table.types.number'),
+    string: t('configurator.table.types.string'),
+    table: t('configurator.table.types.table'),
+  },
+  vector: t('configurator.table.vector'),
+}))
+
+function showToast(
+  message: string,
+  tone: 'error' | 'success' = 'success',
+): void {
+  if (toastTimer) window.clearTimeout(toastTimer)
+  toast.value = message
+  toastTone.value = tone
+  toastTimer = window.setTimeout(() => (toast.value = ''), 2800)
+}
+
+function formatMoney(value: number, currency: string): string {
+  const formatted = new Intl.NumberFormat(phone.lang, {
+    maximumFractionDigits: 0,
+  }).format(value)
+  return `${currency}${formatted}`
+}
+
+function formatDate(value: string): string {
+  const date = parseDatabaseDate(value)
+  return Number.isNaN(date.getTime())
+    ? value
+    : new Intl.DateTimeFormat(phone.lang, {
+        dateStyle: 'medium',
+        timeStyle: 'short',
+      }).format(date)
+}
+
+function formatDuration(seconds: number): string {
+  const minutes = Math.floor(seconds / 60)
+  const remainder = Math.max(0, seconds % 60)
+  return `${minutes}:${String(remainder).padStart(2, '0')}`
+}
+
+function initials(name: string): string {
+  return name
+    .split(/\s+/)
+    .filter(Boolean)
+    .slice(0, 2)
+    .map((part) => part.charAt(0).toLocaleUpperCase(phone.lang))
+    .join('')
+}
+
+function baseInstalled(
+  device: AdminDevice,
+  app: LaunchablePhoneAppDefinition,
+): boolean {
+  if (device.apps.uninstalled.includes(app.id)) return false
+  if (device.apps.claimed.includes(app.id)) return true
+  return isExternalPhoneApp(app)
+    ? app.defaultInstalled
+    : DEFAULT_INSTALLED_PHONE_APP_IDS.has(app.id)
+}
+
+function isInstalled(
+  device: AdminDevice,
+  app: LaunchablePhoneAppDefinition,
+): boolean {
+  const deviceDraft = drafts.value[device.imei]
+  return deviceDraft &&
+    Object.prototype.hasOwnProperty.call(deviceDraft, app.id)
+    ? deviceDraft[app.id]
+    : baseInstalled(device, app)
+}
+
+function toggleApp(app: LaunchablePhoneAppDefinition): void {
+  const device = selectedDevice.value
+  if (!device) return
+  const nextInstalled = !isInstalled(device, app)
+  if (!nextInstalled && !isPhoneAppRemovable(app)) return
+
+  const deviceDraft = drafts.value[device.imei] ?? {}
+  if (nextInstalled === baseInstalled(device, app)) {
+    delete deviceDraft[app.id]
+  } else {
+    deviceDraft[app.id] = nextInstalled
+  }
+  if (Object.keys(deviceDraft).length) drafts.value[device.imei] = deviceDraft
+  else delete drafts.value[device.imei]
+}
+
+function errorText(error = admin.error): string {
+  return t('errors.' + (error || 'default'))
+}
+
+async function loadPlayer(source: number): Promise<void> {
+  if (await admin.openPlayer(source)) return
+  showToast(errorText(), 'error')
+}
+
+async function refreshData(): Promise<void> {
+  const selectedSource = admin.selectedPlayer?.source
+  if (!(await admin.load())) {
+    showToast(errorText(), 'error')
+    return
+  }
+  const nextSource =
+    admin.players.find((player) => player.source === selectedSource)?.source ??
+    admin.players[0]?.source
+  if (nextSource) await loadPlayer(nextSource)
+}
+
+function queueAction(action: PendingAction): void {
+  if (!hasChanges.value) {
+    void runAction(action)
+    return
+  }
+  pendingAction.value = action
+  discardDialog.value = true
+}
+
+function selectTab(nextTab: AdminTab): void {
+  tab.value = nextTab
+  fontMenuOpen.value = false
+  if (nextTab === 'configurator' && !admin.configurator) {
+    void admin.loadConfigurator().then((loaded) => {
+      if (!loaded) showToast(errorText(), 'error')
+    })
+  }
+}
+
+function selectAccent(color: string): void {
+  if (!/^#[0-9a-f]{6}$/i.test(color)) return
+  accentColor.value = color.toLowerCase()
+  window.localStorage.setItem('sky-phone-admin-accent', accentColor.value)
+}
+
+function updateAccent(event: Event): void {
+  const input = event.currentTarget as HTMLInputElement
+  if (/^#[0-9a-f]{6}$/i.test(input.value)) selectAccent(input.value)
+  else input.value = accentColor.value.toUpperCase()
+}
+
+function updateAccentChannel(channel: AccentChannel, event: Event): void {
+  const input = event.currentTarget as HTMLInputElement
+  const value = Math.min(255, Math.max(0, Number(input.value) || 0))
+  const channels = { ...accentRgb.value, [channel]: value }
+  selectAccent(
+    `#${channels.red.toString(16).padStart(2, '0')}${channels.green
+      .toString(16)
+      .padStart(2, '0')}${channels.blue.toString(16).padStart(2, '0')}`,
+  )
+}
+
+function accentChannelGradient(channel: AccentChannel): string {
+  const { red, green, blue } = accentRgb.value
+  if (channel === 'red') {
+    return `linear-gradient(90deg, rgb(0, ${green}, ${blue}), rgb(255, ${green}, ${blue}))`
+  }
+  if (channel === 'green') {
+    return `linear-gradient(90deg, rgb(${red}, 0, ${blue}), rgb(${red}, 255, ${blue}))`
+  }
+  return `linear-gradient(90deg, rgb(${red}, ${green}, 0), rgb(${red}, ${green}, 255))`
+}
+
+function selectAdminFontFamily(family: AdminFontFamily): void {
+  adminFontFamily.value = family
+  fontMenuOpen.value = false
+  window.localStorage.setItem('sky-phone-admin-font-family', family)
+}
+
+function closeFontMenu(event: FocusEvent): void {
+  const menu = event.currentTarget as HTMLElement
+  if (!menu.contains(event.relatedTarget as Node | null)) {
+    fontMenuOpen.value = false
+  }
+}
+
+function updateAdminFontSize(event: Event): void {
+  const size = Number((event.currentTarget as HTMLInputElement).value)
+  adminFontSize.value = Math.min(115, Math.max(90, size))
+  adminFontSizePreview.value = adminFontSize.value
+  window.localStorage.setItem(
+    'sky-phone-admin-font-size',
+    String(adminFontSize.value),
+  )
+}
+
+async function runAction(action: PendingAction): Promise<void> {
+  if (action.kind === 'close') {
+    const response = await nuiCall('admin:close')
+    if (response.success) emit('close')
+    else showToast(errorText(response.error), 'error')
+    return
+  }
+  await loadPlayer(action.source)
+}
+
+async function discardAndContinue(): Promise<void> {
+  const action = pendingAction.value
+  drafts.value = {}
+  configuratorDrafts.value = {}
+  pendingAction.value = null
+  discardDialog.value = false
+  if (action) await runAction(action)
+}
+
+function configuratorFieldKey(field: AdminConfiguratorField): string {
+  return `${field.scope}:${field.path}`
+}
+
+function configuratorFieldValue(field: AdminConfiguratorField): unknown {
+  const key = configuratorFieldKey(field)
+  if (Object.prototype.hasOwnProperty.call(configuratorDrafts.value, key)) {
+    return configuratorDrafts.value[key]
+  }
+  return field.value
+}
+
+function updateConfiguratorField(
+  field: AdminConfiguratorField,
+  value: unknown,
+): void {
+  const key = configuratorFieldKey(field)
+  const matchesInitial =
+    field.type === 'json'
+      ? JSON.stringify(value) === JSON.stringify(field.value)
+      : field.type === 'number'
+        ? String(value) === String(field.value)
+        : value === field.value
+  if (!field.sensitive && matchesInitial) {
+    delete configuratorDrafts.value[key]
+    return
+  }
+  configuratorDrafts.value[key] = value
+}
+
+function updateConfiguratorInput(
+  field: AdminConfiguratorField,
+  event: Event,
+): void {
+  const target = event.target
+  if (target instanceof HTMLInputElement) {
+    updateConfiguratorField(field, target.value)
+  }
+}
+
+function updateConfiguratorToggle(
+  field: AdminConfiguratorField,
+  event: Event,
+): void {
+  const target = event.target
+  if (target instanceof HTMLInputElement) {
+    updateConfiguratorField(field, target.checked)
+  }
+}
+
+function updateOptionalStringToggle(
+  field: AdminConfiguratorField,
+  event: Event,
+): void {
+  const target = event.target
+  if (!(target instanceof HTMLInputElement)) return
+  const current = configuratorFieldValue(field)
+  updateConfiguratorField(
+    field,
+    target.checked ? (current === false ? '' : String(current ?? '')) : false,
+  )
+}
+
+function findConfiguratorField(key: string): AdminConfiguratorField | null {
+  for (const section of admin.configurator?.sections ?? []) {
+    const field = section.fields.find(
+      (candidate) => configuratorFieldKey(candidate) === key,
+    )
+    if (field) return field
+  }
+  return null
+}
+
+function buildConfiguratorChanges(): AdminConfiguratorChange[] | null {
+  const changes: AdminConfiguratorChange[] = []
+  for (const [key, draft] of Object.entries(configuratorDrafts.value)) {
+    const field = findConfiguratorField(key)
+    if (!field) return null
+
+    let value: unknown = draft
+    if (field.type === 'number') {
+      value = Number(draft)
+      if (!Number.isFinite(value)) return null
+    } else if (field.type === 'json') {
+      value = draft
+      if (!value || typeof value !== 'object') return null
+    } else if (field.type === 'string') {
+      value = String(draft)
+    } else if (field.type === 'stringOrFalse') {
+      if (value !== false && typeof value !== 'string') return null
+    } else if (field.type === 'boolean' && typeof value !== 'boolean') {
+      return null
+    }
+
+    changes.push({ path: field.path, scope: field.scope, value })
+  }
+  return changes
+}
+
+function cancelDiscard(): void {
+  discardDialog.value = false
+  pendingAction.value = null
+}
+
+async function saveChanges(): Promise<void> {
+  const player = admin.selectedPlayer
+  if (!hasChanges.value || saving.value) return
+  saving.value = true
+
+  if (configuratorPendingCount.value) {
+    const changes = buildConfiguratorChanges()
+    if (!changes) {
+      saving.value = false
+      showToast(t('configurator.invalidValue'), 'error')
+      return
+    }
+    const response = await admin.saveConfigurator(changes)
+    if (!response.success) {
+      saving.value = false
+      showToast(errorText(response.error), 'error')
+      return
+    }
+    configuratorDrafts.value = {}
+  }
+
+  if (!appPendingCount.value) {
+    saving.value = false
+    showToast(t('configurator.saved'))
+    return
+  }
+  if (!player) {
+    saving.value = false
+    showToast(t('editor.saveFailed'), 'error')
+    return
+  }
+  const pendingDevices = Object.entries(drafts.value)
+  for (const [imei, deviceChanges] of pendingDevices) {
+    const device = admin.selectedPlayer?.devices.find(
+      (candidate) => candidate.imei === imei,
+    )
+    if (!device) {
+      saving.value = false
+      showToast(t('editor.saveFailed'), 'error')
+      return
+    }
+    const changes = Object.entries(deviceChanges).map(([appId, installed]) => ({
+      appId,
+      installed,
+    }))
+    const response = await admin.saveApps(
+      player.source,
+      imei,
+      device.apps.revision,
+      changes,
+    )
+    if (!response.success) {
+      saving.value = false
+      showToast(errorText(response.error), 'error')
+      return
+    }
+    delete drafts.value[imei]
+  }
+  saving.value = false
+  await admin.load()
+  showToast(t('editor.saved'))
+}
+
+async function revealPassword(): Promise<void> {
+  const player = admin.selectedPlayer
+  const imei = revealDialogImei.value
+  revealDialogImei.value = ''
+  if (!player || !imei) return
+  const response = await admin.revealPassword(player.source, imei)
+  if (!response.success) showToast(errorText(response.error), 'error')
+}
+
+async function copyPassword(): Promise<void> {
+  if (!revealedCredential.value) return
+  if (await copyText(revealedCredential.value.password)) {
+    showToast(t('credentials.copied'))
+  }
+}
+
+function openDeviceAction(action: DeviceAction): void {
+  if (!selectedDevice.value) return
+  deviceActionInput.value =
+    action === 'change-number' ? (selectedDevice.value.number ?? '') : ''
+  deviceAction.value = action
+}
+
+function cancelDeviceAction(): void {
+  deviceAction.value = null
+  deviceActionInput.value = ''
+}
+
+async function confirmDeviceAction(): Promise<void> {
+  const player = admin.selectedPlayer
+  const device = selectedDevice.value
+  const action = deviceAction.value
+  if (!player || !device || !action || admin.actionKey) return
+
+  let response
+  if (action === 'reset-passcode') {
+    response = await admin.resetPasscode(player.source, device.imei)
+  } else if (action === 'change-number') {
+    response = await admin.changeNumber(
+      player.source,
+      device.imei,
+      deviceActionInput.value,
+    )
+  } else {
+    response = await admin.factoryReset(player.source, device.imei)
+  }
+  if (!response.success) {
+    showToast(errorText(response.error), 'error')
+    return
+  }
+
+  if (action === 'factory-reset') delete drafts.value[device.imei]
+  deviceAction.value = null
+  deviceActionInput.value = ''
+  showToast(t(`moderation.${action}Success`))
+  await admin.load()
+}
+
+function auditDescription(entry: AdminAuditEntry): string {
+  const appId =
+    typeof entry.details.appId === 'string' ? entry.details.appId : ''
+  const app = appId ? getPhoneApp(appId) : undefined
+  return app
+    ? getPhoneAppLabel(app, phone.t)
+    : typeof entry.details.email === 'string'
+      ? entry.details.email
+      : entry.deviceImei || entry.targetIdentifier
+}
+
+function onKeydown(event: KeyboardEvent): void {
+  if (event.key !== 'Escape') return
+  event.preventDefault()
+  if (fontMenuOpen.value) {
+    fontMenuOpen.value = false
+    return
+  }
+  if (revealDialogImei.value) {
+    revealDialogImei.value = ''
+    return
+  }
+  if (deviceAction.value) {
+    deviceAction.value = null
+    deviceActionInput.value = ''
+    return
+  }
+  if (discardDialog.value) {
+    discardDialog.value = false
+    pendingAction.value = null
+    return
+  }
+  queueAction({ kind: 'close' })
+}
+
+onMounted(() => {
+  document.addEventListener('keydown', onKeydown)
+  const storedAccent = window.localStorage.getItem('sky-phone-admin-accent')
+  if (storedAccent && /^#[0-9a-f]{6}$/i.test(storedAccent)) {
+    accentColor.value = storedAccent.toLowerCase()
+  }
+  const storedFontFamily = window.localStorage.getItem(
+    'sky-phone-admin-font-family',
+  )
+  if (
+    storedFontFamily &&
+    fontFamilyOptions.some((option) => option.key === storedFontFamily)
+  ) {
+    adminFontFamily.value = storedFontFamily as AdminFontFamily
+  }
+  const storedFontSize = Number(
+    window.localStorage.getItem('sky-phone-admin-font-size'),
+  )
+  if (storedFontSize >= 90 && storedFontSize <= 115) {
+    adminFontSize.value = storedFontSize
+    adminFontSizePreview.value = storedFontSize
+  }
+  void refreshData()
+})
+
+onBeforeUnmount(() => {
+  document.removeEventListener('keydown', onKeydown)
+  if (toastTimer) window.clearTimeout(toastTimer)
+})
+</script>
+
+<template>
+  <div
+    class="admin-panel-overlay"
+    role="dialog"
+    :aria-label="t('name')"
+    :style="{
+      '--admin-accent': accentColor,
+      '--admin-font-family': activeAdminFontFamily,
+      '--admin-font-scale': String(adminFontSize / 100),
+    }"
+  >
+    <div class="admin-panel-window">
+      <header class="admin-panel-header">
+        <div class="admin-panel-brand">
+          <div>
+            <strong>{{ t('editor.brand') }}</strong>
+            <span>{{ t('editor.workspace') }}</span>
+          </div>
+        </div>
+
+        <div class="admin-panel-context">
+          <span class="admin-panel-context__path">
+            {{ t('tabs.' + tab) }}
+          </span>
+          <ChevronRight :size="14" />
+          <strong>{{
+            tab === 'configurator'
+              ? t('configurator.context')
+              : admin.selectedPlayer?.name || t('editor.noSelection')
+          }}</strong>
+        </div>
+
+        <div class="admin-panel-actions">
+          <span v-if="hasChanges" class="admin-panel-dirty">
+            <span></span>{{ t('editor.unsaved') }} · {{ pendingCount }}
+          </span>
+          <button
+            type="button"
+            class="admin-panel-save"
+            :class="{ 'is-ready': hasChanges }"
+            :aria-label="t('editor.save')"
+            :title="hasChanges ? t('editor.saveHint') : t('editor.save')"
+            :disabled="!hasChanges || saving"
+            @click="saveChanges"
+          >
+            <LoaderCircle v-if="saving" :size="18" class="is-spinning" />
+            <Check v-else :size="19" stroke-width="3" />
+          </button>
+          <button
+            type="button"
+            class="admin-panel-icon-button admin-panel-close"
+            :aria-label="t('editor.close')"
+            :title="t('editor.close')"
+            @click="queueAction({ kind: 'close' })"
+          >
+            <X :size="18" />
+          </button>
+        </div>
+      </header>
+
+      <div class="admin-panel-body">
+        <nav class="admin-panel-rail" :aria-label="t('navigation')">
+          <button
+            type="button"
+            :class="{ 'is-active': tab === 'overview' }"
+            :aria-label="t('tabs.overview')"
+            :title="t('tabs.overview')"
+            @click="selectTab('overview')"
+          >
+            <LayoutDashboard :size="19" />
+          </button>
+          <button
+            type="button"
+            :class="{ 'is-active': tab === 'players' }"
+            :aria-label="t('tabs.players')"
+            :title="t('tabs.players')"
+            @click="selectTab('players')"
+          >
+            <UsersRound :size="19" />
+          </button>
+          <button
+            type="button"
+            :class="{ 'is-active': tab === 'devices' }"
+            :aria-label="t('tabs.devices')"
+            :title="t('tabs.devices')"
+            @click="selectTab('devices')"
+          >
+            <Smartphone :size="19" />
+          </button>
+          <button
+            type="button"
+            :class="{ 'is-active': tab === 'apps' }"
+            :aria-label="t('tabs.apps')"
+            :title="t('tabs.apps')"
+            @click="selectTab('apps')"
+          >
+            <Grid2X2 :size="19" />
+          </button>
+          <button
+            type="button"
+            :class="{ 'is-active': tab === 'accounts' }"
+            :aria-label="t('tabs.accounts')"
+            :title="t('tabs.accounts')"
+            @click="selectTab('accounts')"
+          >
+            <KeyRound :size="19" />
+          </button>
+          <button
+            type="button"
+            :class="{ 'is-active': tab === 'messages' }"
+            :aria-label="t('tabs.messages')"
+            :title="t('tabs.messages')"
+            @click="selectTab('messages')"
+          >
+            <MessageSquare :size="19" />
+          </button>
+          <button
+            type="button"
+            :class="{ 'is-active': tab === 'calls' }"
+            :aria-label="t('tabs.calls')"
+            :title="t('tabs.calls')"
+            @click="selectTab('calls')"
+          >
+            <PhoneCall :size="19" />
+          </button>
+          <button
+            type="button"
+            :class="{ 'is-active': tab === 'moderation' }"
+            :aria-label="t('tabs.moderation')"
+            :title="t('tabs.moderation')"
+            @click="selectTab('moderation')"
+          >
+            <ShieldAlert :size="19" />
+          </button>
+          <button
+            type="button"
+            :class="{ 'is-active': tab === 'audit' }"
+            :aria-label="t('tabs.audit')"
+            :title="t('tabs.audit')"
+            @click="selectTab('audit')"
+          >
+            <ScrollText :size="19" />
+          </button>
+          <button
+            type="button"
+            class="admin-panel-rail__configurator"
+            :class="{ 'is-active': tab === 'configurator' }"
+            :aria-label="t('tabs.configurator')"
+            :title="t('tabs.configurator')"
+            @click="selectTab('configurator')"
+          >
+            <Settings2 :size="19" />
+          </button>
+        </nav>
+
+        <aside class="admin-panel-directory">
+          <template v-if="tab === 'overview'">
+            <div class="admin-panel-directory__header">
+              <div>
+                <span>{{ t('overview.eyebrow') }}</span>
+                <h2>{{ t('overview.features') }}</h2>
+              </div>
+              <strong>{{ admin.stats.online }}</strong>
+            </div>
+            <div class="admin-panel-overview-directory">
+              <button type="button" @click="selectTab('players')">
+                <UsersRound :size="17" />
+                <span>
+                  <strong>{{ t('tabs.players') }}</strong>
+                  <small>{{ t('overview.playerFeature') }}</small>
+                </span>
+                <ChevronRight :size="14" />
+              </button>
+              <button type="button" @click="selectTab('devices')">
+                <Smartphone :size="17" />
+                <span>
+                  <strong>{{ t('tabs.devices') }}</strong>
+                  <small>{{ t('overview.deviceFeature') }}</small>
+                </span>
+                <ChevronRight :size="14" />
+              </button>
+              <button type="button" @click="selectTab('apps')">
+                <Grid2X2 :size="17" />
+                <span>
+                  <strong>{{ t('tabs.apps') }}</strong>
+                  <small>{{ t('overview.appFeature') }}</small>
+                </span>
+                <ChevronRight :size="14" />
+              </button>
+              <button type="button" @click="selectTab('accounts')">
+                <KeyRound :size="17" />
+                <span>
+                  <strong>{{ t('tabs.accounts') }}</strong>
+                  <small>{{ t('overview.accountFeature') }}</small>
+                </span>
+                <ChevronRight :size="14" />
+              </button>
+              <button type="button" @click="selectTab('messages')">
+                <MessageSquare :size="17" />
+                <span>
+                  <strong>{{ t('tabs.messages') }}</strong>
+                  <small>{{ t('overview.messageFeature') }}</small>
+                </span>
+                <ChevronRight :size="14" />
+              </button>
+              <button type="button" @click="selectTab('calls')">
+                <PhoneCall :size="17" />
+                <span>
+                  <strong>{{ t('tabs.calls') }}</strong>
+                  <small>{{ t('overview.callFeature') }}</small>
+                </span>
+                <ChevronRight :size="14" />
+              </button>
+              <button type="button" @click="selectTab('moderation')">
+                <ShieldAlert :size="17" />
+                <span>
+                  <strong>{{ t('tabs.moderation') }}</strong>
+                  <small>{{ t('overview.moderationFeature') }}</small>
+                </span>
+                <ChevronRight :size="14" />
+              </button>
+              <button type="button" @click="selectTab('audit')">
+                <ScrollText :size="17" />
+                <span>
+                  <strong>{{ t('tabs.audit') }}</strong>
+                  <small>{{ t('overview.auditFeature') }}</small>
+                </span>
+                <ChevronRight :size="14" />
+              </button>
+              <button type="button" @click="selectTab('configurator')">
+                <Settings2 :size="17" />
+                <span>
+                  <strong>{{ t('tabs.configurator') }}</strong>
+                  <small>{{ t('overview.configuratorFeature') }}</small>
+                </span>
+                <ChevronRight :size="14" />
+              </button>
+            </div>
+          </template>
+
+          <template v-else-if="tab === 'configurator'">
+            <div class="admin-panel-directory__header">
+              <div>
+                <span>{{ t('configurator.eyebrow') }}</span>
+                <h2>{{ t('configurator.sections') }}</h2>
+              </div>
+              <strong>{{ filteredConfiguratorFieldCount }}</strong>
+            </div>
+            <label class="admin-panel-search">
+              <Search :size="16" />
+              <input
+                v-model="configuratorQuery"
+                type="search"
+                :placeholder="t('configurator.search')"
+                :aria-label="t('configurator.search')"
+              />
+            </label>
+            <div
+              class="admin-panel-config-scopes"
+              role="tablist"
+              :aria-label="t('configurator.sections')"
+            >
+              <button
+                type="button"
+                role="tab"
+                :aria-selected="configuratorScope === 'config'"
+                :class="{ 'is-active': configuratorScope === 'config' }"
+                @click="selectConfiguratorScope('config')"
+              >
+                <span>{{ t('configurator.configScope') }}</span>
+                <em>{{ configuratorScopeCounts.config }}</em>
+              </button>
+              <button
+                type="button"
+                role="tab"
+                :aria-selected="configuratorScope === 'media'"
+                :class="{ 'is-active': configuratorScope === 'media' }"
+                @click="selectConfiguratorScope('media')"
+              >
+                <span>{{ t('configurator.mediaScope') }}</span>
+                <em>{{ configuratorScopeCounts.media }}</em>
+              </button>
+            </div>
+            <div class="admin-panel-config-sections">
+              <button
+                v-for="section in filteredConfiguratorSections"
+                :key="section.id"
+                type="button"
+                :class="{
+                  'is-active': activeConfiguratorSection?.id === section.id,
+                }"
+                @click="selectedConfiguratorSection = section.id"
+              >
+                <Settings2 :size="16" />
+                <span>
+                  <strong>{{ section.label }}</strong>
+                  <small>{{
+                    section.scope === 'media'
+                      ? t('configurator.mediaScope')
+                      : t('configurator.configScope')
+                  }}</small>
+                </span>
+                <em>{{ configuratorSectionCount(section.fields) }}</em>
+              </button>
+              <div
+                v-if="!filteredConfiguratorSections.length"
+                class="admin-panel-empty-list"
+              >
+                <Search :size="24" />
+                <strong>{{ t('configurator.noResults') }}</strong>
+              </div>
+            </div>
+          </template>
+
+          <template v-else-if="tab !== 'audit'">
+            <div class="admin-panel-directory__header">
+              <div>
+                <span>{{ t('players.eyebrow') }}</span>
+                <h2>{{ t('players.title') }}</h2>
+              </div>
+              <strong>{{ filteredPlayers.length }}</strong>
+            </div>
+            <label class="admin-panel-search">
+              <Search :size="16" />
+              <input
+                v-model="playerQuery"
+                type="search"
+                :placeholder="t('search.players')"
+                :aria-label="t('search.players')"
+              />
+            </label>
+
+            <div class="admin-panel-player-list">
+              <button
+                v-for="player in filteredPlayers"
+                :key="player.source"
+                type="button"
+                :class="{
+                  'is-active': admin.selectedPlayer?.source === player.source,
+                }"
+                @click="queueAction({ kind: 'player', source: player.source })"
+              >
+                <span class="admin-panel-avatar">{{
+                  initials(player.name)
+                }}</span>
+                <span class="admin-panel-player-list__copy">
+                  <strong>{{ player.name }}</strong>
+                  <small>{{ player.job }} · ID {{ player.source }}</small>
+                </span>
+                <span class="admin-panel-player-list__meta">
+                  <span class="admin-panel-online-dot"></span>
+                  {{ player.deviceCount }}
+                </span>
+              </button>
+
+              <div
+                v-if="!filteredPlayers.length"
+                class="admin-panel-empty-list"
+              >
+                <UsersRound :size="26" />
+                <strong>{{ t('players.empty') }}</strong>
+                <span>{{ t('players.emptyBody') }}</span>
+              </div>
+            </div>
+          </template>
+
+          <template v-else>
+            <div class="admin-panel-directory__header">
+              <div>
+                <span>{{ t('audit.eyebrow') }}</span>
+                <h2>{{ t('audit.title') }}</h2>
+              </div>
+              <strong>{{ admin.audit.length }}</strong>
+            </div>
+            <div class="admin-panel-audit-mini-list">
+              <article v-for="entry in admin.audit" :key="entry.id">
+                <span class="admin-panel-audit-icon"
+                  ><ScrollText :size="15"
+                /></span>
+                <div>
+                  <strong>{{ t('audit.actions.' + entry.action) }}</strong>
+                  <span>{{ entry.actorName }}</span>
+                  <small>{{ formatDate(entry.createdAt) }}</small>
+                </div>
+              </article>
+            </div>
+          </template>
+        </aside>
+
+        <main class="admin-panel-editor">
+          <div
+            v-if="admin.loading && !admin.initialized"
+            class="admin-panel-loading"
+          >
+            <LoaderCircle :size="26" class="is-spinning" />
+            <span>{{ t('loading') }}</span>
+          </div>
+
+          <section
+            v-else-if="tab === 'overview'"
+            class="admin-panel-editor__scroll"
+          >
+            <div class="admin-panel-page-heading">
+              <div>
+                <span>{{ t('overview.eyebrow') }}</span>
+                <h1>{{ t('overview.title') }}</h1>
+                <p>{{ t('overview.body') }}</p>
+              </div>
+            </div>
+
+            <div class="admin-panel-stat-grid">
+              <article>
+                <UsersRound :size="18" />
+                <span>{{ t('overview.online') }}</span>
+                <strong>{{ admin.stats.online }}</strong>
+              </article>
+              <article>
+                <Smartphone :size="18" />
+                <span>{{ t('overview.devices') }}</span>
+                <strong>{{ admin.stats.devices }}</strong>
+              </article>
+              <article>
+                <Database :size="18" />
+                <span>{{ t('overview.accounts') }}</span>
+                <strong>{{ admin.stats.accounts }}</strong>
+              </article>
+              <article>
+                <ScrollText :size="18" />
+                <span>{{ t('overview.audit') }}</span>
+                <strong>{{ admin.audit.length }}</strong>
+              </article>
+            </div>
+
+            <article
+              class="admin-panel-section-card admin-panel-section-card--compact"
+            >
+              <div class="admin-panel-section-card__heading">
+                <div>
+                  <span>{{ t('appearance.eyebrow') }}</span>
+                  <h2>{{ t('appearance.title') }}</h2>
+                  <p>{{ t('appearance.body') }}</p>
+                </div>
+                <Palette :size="20" />
+              </div>
+              <div class="admin-panel-accent-picker">
+                <button
+                  v-for="option in accentOptions"
+                  :key="option.color"
+                  type="button"
+                  :class="{ 'is-active': accentColor === option.color }"
+                  :aria-label="t('appearance.colors.' + option.key)"
+                  :title="t('appearance.colors.' + option.key)"
+                  @click="selectAccent(option.color)"
+                >
+                  <span :style="{ backgroundColor: option.color }"></span>
+                  <strong>{{ t('appearance.colors.' + option.key) }}</strong>
+                  <Check v-if="accentColor === option.color" :size="15" />
+                </button>
+              </div>
+              <div class="admin-panel-appearance-controls">
+                <section class="admin-panel-appearance-control is-color">
+                  <div>
+                    <strong>{{ t('appearance.controls.customColor') }}</strong>
+                    <small>{{
+                      t('appearance.controls.customColorBody')
+                    }}</small>
+                  </div>
+                  <div class="admin-panel-rgb-picker">
+                    <label class="admin-panel-color-value">
+                      <span :style="{ backgroundColor: accentColor }"></span>
+                      <input
+                        v-config-input-width
+                        type="text"
+                        maxlength="7"
+                        :value="accentColor.toUpperCase()"
+                        :aria-label="t('appearance.controls.hex')"
+                        @change="updateAccent"
+                      />
+                    </label>
+                    <div class="admin-panel-rgb-fields">
+                      <label v-for="channel in accentChannels" :key="channel">
+                        <span>{{ t(`appearance.controls.${channel}`) }}</span>
+                        <input
+                          class="admin-panel-rgb-range"
+                          type="range"
+                          min="0"
+                          max="255"
+                          :value="accentRgb[channel]"
+                          :style="{
+                            background: accentChannelGradient(channel),
+                          }"
+                          :aria-label="t(`appearance.controls.${channel}`)"
+                          @input="updateAccentChannel(channel, $event)"
+                        />
+                        <input
+                          v-config-input-width
+                          type="number"
+                          min="0"
+                          max="255"
+                          :value="accentRgb[channel]"
+                          :aria-label="`${t(`appearance.controls.${channel}`)} ${t('appearance.controls.value')}`"
+                          @input="updateAccentChannel(channel, $event)"
+                        />
+                      </label>
+                    </div>
+                  </div>
+                </section>
+
+                <section class="admin-panel-appearance-control">
+                  <span>
+                    <strong>{{ t('appearance.controls.fontFamily') }}</strong>
+                    <small>{{ t('appearance.controls.fontFamilyBody') }}</small>
+                  </span>
+                  <div
+                    class="admin-panel-font-select"
+                    @focusout="closeFontMenu"
+                  >
+                    <button
+                      type="button"
+                      :aria-label="t('appearance.controls.fontFamily')"
+                      aria-haspopup="listbox"
+                      :aria-expanded="fontMenuOpen"
+                      @click="fontMenuOpen = !fontMenuOpen"
+                    >
+                      <span :style="{ fontFamily: activeAdminFontFamily }">
+                        {{ t(`appearance.controls.fonts.${adminFontFamily}`) }}
+                      </span>
+                      <ChevronDown :size="14" />
+                    </button>
+                    <div
+                      v-if="fontMenuOpen"
+                      class="admin-panel-font-select__menu"
+                      role="listbox"
+                      :aria-label="t('appearance.controls.fontFamily')"
+                    >
+                      <button
+                        v-for="option in fontFamilyOptions"
+                        :key="option.key"
+                        type="button"
+                        role="option"
+                        :aria-selected="adminFontFamily === option.key"
+                        :class="{ 'is-active': adminFontFamily === option.key }"
+                        :style="{ fontFamily: option.value }"
+                        @click="selectAdminFontFamily(option.key)"
+                      >
+                        <span>{{
+                          t(`appearance.controls.fonts.${option.key}`)
+                        }}</span>
+                        <Check
+                          v-if="adminFontFamily === option.key"
+                          :size="13"
+                        />
+                      </button>
+                    </div>
+                  </div>
+                </section>
+
+                <label class="admin-panel-appearance-control">
+                  <span>
+                    <strong>{{ t('appearance.controls.fontSize') }}</strong>
+                    <small>{{ t('appearance.controls.fontSizeBody') }}</small>
+                  </span>
+                  <div class="admin-panel-font-size-control">
+                    <input
+                      v-model.number="adminFontSizePreview"
+                      type="range"
+                      min="90"
+                      max="115"
+                      step="5"
+                      :aria-label="t('appearance.controls.fontSize')"
+                      @change="updateAdminFontSize"
+                    />
+                    <strong>{{ adminFontSizePreview }}%</strong>
+                  </div>
+                </label>
+              </div>
+            </article>
+
+          </section>
+
+          <section
+            v-else-if="tab === 'configurator'"
+            class="admin-panel-editor__scroll"
+          >
+            <div
+              v-if="admin.configuratorLoading && !admin.configurator"
+              class="admin-panel-loading"
+            >
+              <LoaderCircle :size="26" class="is-spinning" />
+              <span>{{ t('configurator.loading') }}</span>
+            </div>
+
+            <template v-else-if="admin.configurator">
+              <div class="admin-panel-page-heading">
+                <div class="admin-panel-heading-icon">
+                  <Settings2 :size="23" />
+                </div>
+                <div class="admin-panel-config-heading-copy">
+                  <span>{{ t('configurator.eyebrow') }}</span>
+                  <h1>{{ t('configurator.title') }}</h1>
+                  <p>{{ t('configurator.body') }}</p>
+                </div>
+              </div>
+
+              <article
+                v-if="!admin.configurator.enabled"
+                class="admin-panel-config-disabled"
+              >
+                <TriangleAlert :size="20" />
+                <div>
+                  <strong>{{ t('configurator.disabledTitle') }}</strong>
+                  <p>{{ t('configurator.disabledBody') }}</p>
+                  <code>Config.PhoneConfigurator.Enabled = true</code>
+                </div>
+              </article>
+
+              <article class="admin-panel-config-notice">
+                <Save :size="18" />
+                <div>
+                  <strong>{{ t('configurator.manualSave') }}</strong>
+                  <p>{{ t('configurator.refreshNotice') }}</p>
+                </div>
+              </article>
+
+              <section
+                v-if="activeConfiguratorSection"
+                class="admin-panel-config-workspace"
+              >
+                <header>
+                  <div>
+                    <span>{{
+                      activeConfiguratorSection.scope === 'media'
+                        ? t('configurator.mediaScope')
+                        : t('configurator.configScope')
+                    }}</span>
+                    <h2>{{ activeConfiguratorSection.label }}</h2>
+                  </div>
+                  <strong>{{
+                    t('configurator.fieldCount', {
+                      count: String(
+                        configuratorSectionCount(
+                          activeConfiguratorSection.fields,
+                        ),
+                      ),
+                    })
+                  }}</strong>
+                </header>
+
+                <div class="admin-panel-config-fields">
+                  <div
+                    v-for="field in activeConfiguratorSection.fields"
+                    :key="configuratorFieldKey(field)"
+                    class="admin-panel-config-field"
+                    :class="{
+                      'is-structured': field.type === 'json',
+                      'is-dirty': Object.prototype.hasOwnProperty.call(
+                        configuratorDrafts,
+                        configuratorFieldKey(field),
+                      ),
+                    }"
+                  >
+                    <span
+                      v-if="!configuratorFieldRepeatsSection(field)"
+                      class="admin-panel-config-field__copy"
+                    >
+                      <strong>{{ field.label }}</strong>
+                      <small
+                        :title="
+                          configuratorDescription(
+                            field.path,
+                            configuratorFieldValue(field),
+                            field.structure,
+                            field.label,
+                          )
+                        "
+                      >
+                        {{
+                          configuratorDescription(
+                            field.path,
+                            configuratorFieldValue(field),
+                            field.structure,
+                            field.label,
+                          )
+                        }}
+                      </small>
+                      <code>{{ field.path }}</code>
+                    </span>
+
+                    <span
+                      v-if="field.type === 'boolean'"
+                      class="admin-panel-config-toggle"
+                    >
+                      <input
+                        type="checkbox"
+                        :aria-label="`${field.label} ${field.path}`"
+                        :checked="Boolean(configuratorFieldValue(field))"
+                        :disabled="!admin.configurator.enabled"
+                        @change="updateConfiguratorToggle(field, $event)"
+                      />
+                      <i></i>
+                    </span>
+
+                    <AdminConfigValueEditor
+                      v-else-if="field.type === 'json'"
+                      :model-value="configuratorFieldValue(field)"
+                      :structure="field.structure"
+                      :aria-label="`${field.label} ${field.path}`"
+                      :describe="configuratorDescription"
+                      :labels="configuratorEditorLabels"
+                      :disabled="!admin.configurator.enabled"
+                      :path="field.path"
+                      :tab-label="configuratorSubtabLabel"
+                      @update:model-value="
+                        updateConfiguratorField(field, $event)
+                      "
+                    />
+
+                    <span
+                      v-else-if="field.type === 'stringOrFalse'"
+                      class="admin-panel-config-optional"
+                    >
+                      <input
+                        v-config-input-width
+                        type="text"
+                        :aria-label="`${field.label} ${field.path}`"
+                        :value="
+                          configuratorFieldValue(field) === false
+                            ? ''
+                            : String(configuratorFieldValue(field) ?? '')
+                        "
+                        :disabled="
+                          !admin.configurator.enabled ||
+                          configuratorFieldValue(field) === false
+                        "
+                        autocomplete="off"
+                        @input="updateConfiguratorInput(field, $event)"
+                      />
+                      <span class="admin-panel-config-toggle">
+                        <input
+                          type="checkbox"
+                          :aria-label="`${field.label} ${field.path}`"
+                          :checked="configuratorFieldValue(field) !== false"
+                          :disabled="!admin.configurator.enabled"
+                          @change="updateOptionalStringToggle(field, $event)"
+                        />
+                        <i></i>
+                      </span>
+                    </span>
+
+                    <input
+                      v-else
+                      v-config-input-width
+                      :aria-label="`${field.label} ${field.path}`"
+                      :type="
+                        field.sensitive
+                          ? 'password'
+                          : field.type === 'number'
+                            ? 'number'
+                            : 'text'
+                      "
+                      :value="String(configuratorFieldValue(field) ?? '')"
+                      :placeholder="
+                        field.sensitive && field.configured
+                          ? t('configurator.secretConfigured')
+                          : ''
+                      "
+                      :disabled="!admin.configurator.enabled"
+                      :autocomplete="field.sensitive ? 'new-password' : 'off'"
+                      @input="updateConfiguratorInput(field, $event)"
+                    />
+                  </div>
+                </div>
+              </section>
+            </template>
+          </section>
+
+          <section
+            v-else-if="tab === 'audit'"
+            class="admin-panel-editor__scroll"
+          >
+            <div class="admin-panel-page-heading">
+              <div class="admin-panel-heading-icon">
+                <ScrollText :size="23" />
+              </div>
+              <div>
+                <span>{{ t('audit.eyebrow') }}</span>
+                <h1>{{ t('audit.title') }}</h1>
+                <p>{{ t('audit.body') }}</p>
+              </div>
+            </div>
+            <div v-if="admin.audit.length" class="admin-panel-audit-grid">
+              <article v-for="entry in admin.audit" :key="entry.id">
+                <div class="admin-panel-audit-grid__topline">
+                  <span>{{ t('audit.actions.' + entry.action) }}</span>
+                  <time>{{ formatDate(entry.createdAt) }}</time>
+                </div>
+                <strong>{{ auditDescription(entry) }}</strong>
+                <p>
+                  {{
+                    t('audit.by', {
+                      actor: entry.actorName,
+                      target: String(entry.targetSource ?? '—'),
+                    })
+                  }}
+                </p>
+              </article>
+            </div>
+            <div v-else class="admin-panel-empty-editor">
+              <ScrollText :size="34" />
+              <h2>{{ t('audit.empty') }}</h2>
+              <p>{{ t('audit.emptyBody') }}</p>
+            </div>
+          </section>
+
+          <section
+            v-else-if="admin.selectedPlayer"
+            class="admin-panel-editor__scroll"
+          >
+            <div class="admin-panel-profile-heading">
+              <span class="admin-panel-profile-avatar">
+                {{ initials(admin.selectedPlayer.name) }}
+              </span>
+              <div>
+                <span>{{ t('detail.character') }}</span>
+                <h1>{{ admin.selectedPlayer.name }}</h1>
+                <p>{{ admin.selectedPlayer.serverName }}</p>
+              </div>
+              <div v-if="selectedDevice" class="admin-panel-player-actions">
+                <button
+                  type="button"
+                  :disabled="
+                    !selectedDevice.security.enabled || !!admin.actionKey
+                  "
+                  @click="openDeviceAction('reset-passcode')"
+                >
+                  <KeyRound :size="15" />{{ t('moderation.resetPasscode') }}
+                </button>
+                <button
+                  type="button"
+                  :disabled="!selectedDevice.number || !!admin.actionKey"
+                  @click="openDeviceAction('change-number')"
+                >
+                  <PhoneForwarded :size="15" />{{
+                    t('moderation.changeNumber')
+                  }}
+                </button>
+                <button
+                  type="button"
+                  class="is-danger"
+                  :disabled="hasChanges || !!admin.actionKey"
+                  :title="hasChanges ? t('moderation.saveFirst') : ''"
+                  @click="openDeviceAction('factory-reset')"
+                >
+                  <Trash2 :size="15" />{{ t('moderation.factoryReset') }}
+                </button>
+              </div>
+            </div>
+
+            <div
+              v-if="
+                tab === 'devices' ||
+                tab === 'apps' ||
+                tab === 'accounts' ||
+                tab === 'messages' ||
+                tab === 'calls' ||
+                tab === 'moderation'
+              "
+              class="admin-panel-device-tabs"
+              :aria-label="t('devices.choose')"
+            >
+              <button
+                v-for="device in admin.selectedPlayer.devices"
+                :key="device.imei"
+                type="button"
+                :class="{
+                  'is-active': device.imei === selectedDevice?.imei,
+                  'is-dirty': Boolean(
+                    Object.keys(drafts[device.imei] ?? {}).length,
+                  ),
+                }"
+                @click="selectedImei = device.imei"
+              >
+                <Smartphone :size="16" />
+                <span>{{ device.name }}</span>
+                <small>{{ device.number || device.imei.slice(-4) }}</small>
+              </button>
+            </div>
+
+            <div v-if="tab === 'players'" class="admin-panel-stat-grid">
+              <article>
+                <WalletCards :size="18" />
+                <span>{{ t('detail.cash') }}</span>
+                <strong>{{
+                  formatMoney(
+                    admin.selectedPlayer.money.cash,
+                    admin.selectedPlayer.money.currency,
+                  )
+                }}</strong>
+              </article>
+              <article>
+                <BadgeDollarSign :size="18" />
+                <span>{{ t('detail.bank') }}</span>
+                <strong>{{
+                  formatMoney(
+                    admin.selectedPlayer.money.bank,
+                    admin.selectedPlayer.money.currency,
+                  )
+                }}</strong>
+              </article>
+              <article>
+                <BriefcaseBusiness :size="18" />
+                <span>{{ t('detail.job') }}</span>
+                <strong>{{
+                  admin.selectedPlayer.job.label ||
+                  admin.selectedPlayer.job.name
+                }}</strong>
+              </article>
+              <article>
+                <Wifi :size="18" />
+                <span>{{ t('detail.duty') }}</span>
+                <strong>{{
+                  admin.selectedPlayer.job.onDuty
+                    ? t('detail.onDuty')
+                    : t('detail.offDuty')
+                }}</strong>
+              </article>
+            </div>
+
+            <div v-if="tab === 'players'" class="admin-panel-section-grid">
+              <article class="admin-panel-section-card">
+                <div class="admin-panel-section-card__heading">
+                  <div>
+                    <span>{{ t('editor.profile') }}</span>
+                    <h2>{{ t('detail.playerData') }}</h2>
+                  </div>
+                  <CircleUserRound :size="20" />
+                </div>
+                <dl class="admin-panel-field-list">
+                  <div>
+                    <dt>{{ t('detail.identifier') }}</dt>
+                    <dd>{{ admin.selectedPlayer.identifier }}</dd>
+                  </div>
+                  <div>
+                    <dt>{{ t('detail.birthdate') }}</dt>
+                    <dd>
+                      {{
+                        admin.selectedPlayer.birthdate || t('detail.unknown')
+                      }}
+                    </dd>
+                  </div>
+                  <div>
+                    <dt>{{ t('detail.grade') }}</dt>
+                    <dd>
+                      {{ admin.selectedPlayer.job.grade }} ·
+                      {{
+                        admin.selectedPlayer.job.gradeLabel ||
+                        t('detail.unknown')
+                      }}
+                    </dd>
+                  </div>
+                </dl>
+              </article>
+
+              <article class="admin-panel-section-card">
+                <div class="admin-panel-section-card__heading">
+                  <div>
+                    <span>{{ t('editor.device') }}</span>
+                    <h2>{{ t('devices.title') }}</h2>
+                  </div>
+                  <HardDrive :size="20" />
+                </div>
+                <div v-if="selectedDevice" class="admin-panel-device-summary">
+                  <span class="admin-panel-device-summary__icon">
+                    <Smartphone :size="23" />
+                  </span>
+                  <div>
+                    <strong>{{ selectedDevice.name }}</strong>
+                    <span>{{
+                      selectedDevice.number || t('devices.noNumber')
+                    }}</span>
+                  </div>
+                  <small>{{
+                    selectedDevice.simType || t('devices.noSim')
+                  }}</small>
+                </div>
+                <dl v-if="selectedDevice" class="admin-panel-field-list">
+                  <div>
+                    <dt>{{ t('devices.imei') }}</dt>
+                    <dd>{{ selectedDevice.imei }}</dd>
+                  </div>
+                  <div>
+                    <dt>{{ t('devices.updated') }}</dt>
+                    <dd>{{ formatDate(selectedDevice.updatedAt) }}</dd>
+                  </div>
+                </dl>
+                <div v-else class="admin-panel-inline-empty">
+                  {{ t('devices.emptyBody') }}
+                </div>
+              </article>
+            </div>
+
+            <article
+              v-if="tab === 'devices'"
+              class="admin-panel-section-card admin-panel-section-card--focused"
+            >
+              <div class="admin-panel-section-card__heading">
+                <div>
+                  <span>{{ t('editor.device') }}</span>
+                  <h2>{{ t('devices.title') }}</h2>
+                  <p>{{ t('devices.body') }}</p>
+                </div>
+                <HardDrive :size="20" />
+              </div>
+              <div v-if="selectedDevice" class="admin-panel-device-summary">
+                <span class="admin-panel-device-summary__icon">
+                  <Smartphone :size="23" />
+                </span>
+                <div>
+                  <strong>{{ selectedDevice.name }}</strong>
+                  <span>{{
+                    selectedDevice.number || t('devices.noNumber')
+                  }}</span>
+                </div>
+                <small>{{
+                  selectedDevice.simType || t('devices.noSim')
+                }}</small>
+              </div>
+              <dl v-if="selectedDevice" class="admin-panel-field-list">
+                <div>
+                  <dt>{{ t('devices.imei') }}</dt>
+                  <dd>{{ selectedDevice.imei }}</dd>
+                </div>
+                <div>
+                  <dt>{{ t('devices.updated') }}</dt>
+                  <dd>{{ formatDate(selectedDevice.updatedAt) }}</dd>
+                </div>
+                <div>
+                  <dt>{{ t('devices.apps') }}</dt>
+                  <dd>{{ selectedDevice.apps.claimed.length }}</dd>
+                </div>
+                <div>
+                  <dt>{{ t('devices.account') }}</dt>
+                  <dd>
+                    {{
+                      selectedDevice.account?.email ||
+                      t('credentials.noAccount')
+                    }}
+                  </dd>
+                </div>
+              </dl>
+              <div v-else class="admin-panel-inline-empty">
+                {{ t('devices.emptyBody') }}
+              </div>
+            </article>
+
+            <article
+              v-if="tab === 'messages' && selectedDevice"
+              class="admin-panel-section-card admin-panel-section-card--focused"
+            >
+              <div class="admin-panel-section-card__heading">
+                <div>
+                  <span>{{ t('activity.protected') }}</span>
+                  <h2>{{ t('activity.messagesTitle') }}</h2>
+                  <p>{{ t('activity.messagesBody') }}</p>
+                </div>
+                <MessageSquare :size="20" />
+              </div>
+              <div
+                v-if="admin.activityKey === selectedDevice.imei + ':messages'"
+                class="admin-panel-inline-empty"
+              >
+                <LoaderCircle :size="20" class="is-spinning" />
+                {{ t('activity.loading') }}
+              </div>
+              <div
+                v-else-if="selectedMessages.length"
+                class="admin-panel-activity-list"
+              >
+                <article v-for="entry in selectedMessages" :key="entry.id">
+                  <span class="admin-panel-activity-icon">
+                    <MessageSquare :size="17" />
+                  </span>
+                  <div>
+                    <span class="admin-panel-activity-meta">
+                      {{ t('activity.' + entry.direction) }} ·
+                      {{ entry.otherNumber }}
+                    </span>
+                    <strong>{{
+                      entry.body ||
+                      t('activity.mediaMessage', { type: entry.messageType })
+                    }}</strong>
+                    <small>{{ formatDate(entry.createdAt) }}</small>
+                  </div>
+                </article>
+              </div>
+              <div v-else class="admin-panel-inline-empty">
+                {{ t('activity.noMessages') }}
+              </div>
+            </article>
+
+            <article
+              v-if="tab === 'calls' && selectedDevice"
+              class="admin-panel-section-card admin-panel-section-card--focused"
+            >
+              <div class="admin-panel-section-card__heading">
+                <div>
+                  <span>{{ t('activity.protected') }}</span>
+                  <h2>{{ t('activity.callsTitle') }}</h2>
+                  <p>{{ t('activity.callsBody') }}</p>
+                </div>
+                <PhoneCall :size="20" />
+              </div>
+              <div
+                v-if="admin.activityKey === selectedDevice.imei + ':calls'"
+                class="admin-panel-inline-empty"
+              >
+                <LoaderCircle :size="20" class="is-spinning" />
+                {{ t('activity.loading') }}
+              </div>
+              <div
+                v-else-if="selectedCalls.length"
+                class="admin-panel-activity-list"
+              >
+                <article v-for="entry in selectedCalls" :key="entry.id">
+                  <span class="admin-panel-activity-icon">
+                    <PhoneCall :size="17" />
+                  </span>
+                  <div>
+                    <span class="admin-panel-activity-meta">
+                      {{ t('activity.' + entry.direction) }} ·
+                      {{ entry.otherNumber }}
+                    </span>
+                    <strong>
+                      {{ t('activity.status.' + entry.status) }} ·
+                      {{ formatDuration(entry.durationSeconds) }}
+                    </strong>
+                    <small>{{ formatDate(entry.startedAt) }}</small>
+                  </div>
+                </article>
+              </div>
+              <div v-else class="admin-panel-inline-empty">
+                {{ t('activity.noCalls') }}
+              </div>
+            </article>
+
+            <article
+              v-if="tab === 'moderation' && selectedDevice"
+              class="admin-panel-section-card admin-panel-section-card--focused"
+            >
+              <div class="admin-panel-section-card__heading">
+                <div>
+                  <span>{{ t('moderation.eyebrow') }}</span>
+                  <h2>{{ t('moderation.title') }}</h2>
+                  <p>{{ t('moderation.body') }}</p>
+                </div>
+                <ShieldAlert :size="20" />
+              </div>
+              <div class="admin-panel-moderation-grid">
+                <button
+                  type="button"
+                  :disabled="
+                    !selectedDevice.security.enabled || !!admin.actionKey
+                  "
+                  @click="openDeviceAction('reset-passcode')"
+                >
+                  <KeyRound :size="20" />
+                  <span>
+                    <strong>{{ t('moderation.resetPasscode') }}</strong>
+                    <small>{{ t('moderation.resetPasscodeBody') }}</small>
+                  </span>
+                  <ChevronRight :size="15" />
+                </button>
+                <button
+                  type="button"
+                  :disabled="!selectedDevice.number || !!admin.actionKey"
+                  @click="openDeviceAction('change-number')"
+                >
+                  <PhoneForwarded :size="20" />
+                  <span>
+                    <strong>{{ t('moderation.changeNumber') }}</strong>
+                    <small>{{ t('moderation.changeNumberBody') }}</small>
+                  </span>
+                  <ChevronRight :size="15" />
+                </button>
+                <button
+                  type="button"
+                  class="is-danger"
+                  :disabled="hasChanges || !!admin.actionKey"
+                  @click="openDeviceAction('factory-reset')"
+                >
+                  <Trash2 :size="20" />
+                  <span>
+                    <strong>{{ t('moderation.factoryReset') }}</strong>
+                    <small>{{ t('moderation.factoryResetBody') }}</small>
+                  </span>
+                  <ChevronRight :size="15" />
+                </button>
+              </div>
+            </article>
+
+            <article
+              v-if="tab === 'accounts' && selectedDevice"
+              class="admin-panel-section-card admin-panel-section-card--focused"
+            >
+              <div class="admin-panel-section-card__heading">
+                <div>
+                  <span>{{ t('editor.security') }}</span>
+                  <h2>{{ t('credentials.title') }}</h2>
+                </div>
+                <KeyRound :size="20" />
+              </div>
+              <div class="admin-panel-security-grid">
+                <div class="admin-panel-credential-box">
+                  <span>{{ t('credentials.email') }}</span>
+                  <strong>{{
+                    selectedDevice.account?.email || t('credentials.noAccount')
+                  }}</strong>
+                </div>
+                <div class="admin-panel-credential-box">
+                  <span>{{ t('credentials.password') }}</span>
+                  <strong class="admin-panel-password">
+                    {{ revealedCredential?.password || '••••••••••••' }}
+                  </strong>
+                  <button
+                    v-if="selectedDevice.account && !revealedCredential"
+                    type="button"
+                    :disabled="
+                      admin.actionKey === selectedDevice.imei + ':password'
+                    "
+                    @click="revealDialogImei = selectedDevice.imei"
+                  >
+                    <Eye :size="15" />{{ t('credentials.reveal') }}
+                  </button>
+                  <button
+                    v-else-if="revealedCredential"
+                    type="button"
+                    @click="copyPassword"
+                  >
+                    <Clipboard :size="15" />{{ t('credentials.copy') }}
+                  </button>
+                </div>
+                <div
+                  class="admin-panel-credential-box admin-panel-credential-box--pin"
+                >
+                  <LockKeyhole :size="18" />
+                  <div>
+                    <span>{{ t('credentials.passcode') }}</span>
+                    <strong>{{
+                      selectedDevice.security.enabled
+                        ? t('credentials.passcodeHashed', {
+                            length: String(selectedDevice.security.length ?? 0),
+                          })
+                        : t('credentials.passcodeDisabled')
+                    }}</strong>
+                  </div>
+                </div>
+              </div>
+            </article>
+
+            <article
+              v-if="tab === 'apps' && selectedDevice"
+              class="admin-panel-section-card admin-panel-section-card--focused"
+            >
+              <div
+                class="admin-panel-section-card__heading admin-panel-app-heading"
+              >
+                <div>
+                  <span>{{ t('apps.eyebrow') }}</span>
+                  <h2>{{ t('apps.title') }}</h2>
+                  <p>{{ t('apps.description') }}</p>
+                </div>
+                <div class="admin-panel-app-heading__actions">
+                  <span v-if="selectedDeviceChanges">
+                    {{
+                      t('apps.changes', {
+                        count: String(selectedDeviceChanges),
+                      })
+                    }}
+                  </span>
+                  <label class="admin-panel-search admin-panel-search--apps">
+                    <Search :size="15" />
+                    <input
+                      v-model="appQuery"
+                      type="search"
+                      :placeholder="t('search.apps')"
+                      :aria-label="t('search.apps')"
+                    />
+                  </label>
+                </div>
+              </div>
+
+              <div class="admin-panel-manual-save-note">
+                <Save :size="17" />
+                <div>
+                  <strong>{{ t('editor.noAutoSave') }}</strong>
+                  <span>{{ t('editor.noAutoSaveBody') }}</span>
+                </div>
+              </div>
+
+              <div class="admin-panel-app-grid">
+                <button
+                  v-for="app in manageableApps"
+                  :key="app.id"
+                  type="button"
+                  :class="{
+                    'is-enabled': isInstalled(selectedDevice, app),
+                    'is-dirty': Object.prototype.hasOwnProperty.call(
+                      drafts[selectedDevice.imei] ?? {},
+                      app.id,
+                    ),
+                  }"
+                  :disabled="
+                    isInstalled(selectedDevice, app) &&
+                    !isPhoneAppRemovable(app)
+                  "
+                  @click="toggleApp(app)"
+                >
+                  <span class="admin-panel-app-icon" :class="app.iconClass">
+                    <component :is="app.icon" :size="18" />
+                  </span>
+                  <span class="admin-panel-app-copy">
+                    <strong>{{ getPhoneAppLabel(app, phone.t) }}</strong>
+                    <small>{{
+                      !isPhoneAppRemovable(app)
+                        ? t('apps.protected')
+                        : isInstalled(selectedDevice, app)
+                          ? t('apps.installed')
+                          : t('apps.available')
+                    }}</small>
+                  </span>
+                  <span class="admin-panel-switch" aria-hidden="true">
+                    <span></span>
+                  </span>
+                </button>
+              </div>
+            </article>
+
+            <article
+              v-if="
+                (tab === 'apps' ||
+                  tab === 'accounts' ||
+                  tab === 'messages' ||
+                  tab === 'calls' ||
+                  tab === 'moderation') &&
+                !selectedDevice
+              "
+              class="admin-panel-section-card admin-panel-section-card--focused"
+            >
+              <div class="admin-panel-inline-empty">
+                {{ t('devices.emptyBody') }}
+              </div>
+            </article>
+          </section>
+
+          <section v-else class="admin-panel-empty-editor">
+            <span class="admin-panel-empty-editor__icon">
+              <LayoutDashboard :size="34" />
+            </span>
+            <span>{{ t('overview.eyebrow') }}</span>
+            <h1>{{ t('overview.title') }}</h1>
+            <p>{{ t('editor.selectPlayer') }}</p>
+            <div class="admin-panel-empty-stats">
+              <article>
+                <UsersRound :size="18" />
+                <strong>{{ admin.stats.online }}</strong>
+                <span>{{ t('overview.online') }}</span>
+              </article>
+              <article>
+                <Smartphone :size="18" />
+                <strong>{{ admin.stats.devices }}</strong>
+                <span>{{ t('overview.devices') }}</span>
+              </article>
+              <article>
+                <Database :size="18" />
+                <strong>{{ admin.stats.accounts }}</strong>
+                <span>{{ t('overview.accounts') }}</span>
+              </article>
+            </div>
+          </section>
+        </main>
+      </div>
+    </div>
+
+    <Transition name="admin-toast">
+      <div v-if="toast" class="admin-panel-toast" :class="`is-${toastTone}`">
+        <Check v-if="toastTone === 'success'" :size="17" />
+        <TriangleAlert v-else :size="17" />
+        {{ toast }}
+      </div>
+    </Transition>
+
+    <div v-if="revealDialogImei" class="admin-panel-dialog-backdrop">
+      <section class="admin-panel-dialog" role="alertdialog">
+        <span class="admin-panel-dialog__icon"><KeyRound :size="21" /></span>
+        <div>
+          <h2>{{ t('credentials.revealTitle') }}</h2>
+          <p>{{ t('credentials.revealBody') }}</p>
+        </div>
+        <div class="admin-panel-dialog__actions">
+          <SkyButton variant="secondary" @click="revealDialogImei = ''">
+            {{ t('credentials.cancel') }}
+          </SkyButton>
+          <SkyButton class="is-primary" @click="revealPassword">
+            <Eye :size="15" />{{ t('credentials.confirmReveal') }}
+          </SkyButton>
+        </div>
+      </section>
+    </div>
+
+    <div v-if="deviceAction" class="admin-panel-dialog-backdrop">
+      <section class="admin-panel-dialog" role="alertdialog">
+        <span
+          class="admin-panel-dialog__icon"
+          :class="{ 'is-warning': deviceAction === 'factory-reset' }"
+        >
+          <Trash2 v-if="deviceAction === 'factory-reset'" :size="21" />
+          <PhoneForwarded
+            v-else-if="deviceAction === 'change-number'"
+            :size="21"
+          />
+          <KeyRound v-else :size="21" />
+        </span>
+        <div>
+          <h2>{{ t(`moderation.dialogs.${deviceAction}Title`) }}</h2>
+          <p>{{ t(`moderation.dialogs.${deviceAction}Body`) }}</p>
+        </div>
+        <label
+          v-if="deviceAction === 'change-number'"
+          class="admin-panel-action-input"
+        >
+          <span>{{ t('moderation.phoneNumber') }}</span>
+          <input
+            v-model="deviceActionInput"
+            type="text"
+            maxlength="24"
+            :placeholder="t('moderation.phoneNumberPlaceholder')"
+          />
+        </label>
+        <label
+          v-else-if="deviceAction === 'factory-reset'"
+          class="admin-panel-action-input"
+        >
+          <span>{{
+            t('moderation.typeToConfirm', {
+              word: t('moderation.confirmWord'),
+            })
+          }}</span>
+          <input
+            v-model="deviceActionInput"
+            type="text"
+            maxlength="16"
+            :placeholder="t('moderation.confirmWord')"
+          />
+        </label>
+        <div class="admin-panel-dialog__actions">
+          <SkyButton variant="secondary" @click="cancelDeviceAction">
+            {{ t('moderation.cancel') }}
+          </SkyButton>
+          <SkyButton
+            :class="{ 'is-danger': deviceAction === 'factory-reset' }"
+            :variant="deviceAction === 'factory-reset' ? 'danger' : 'primary'"
+            :disabled="
+              !!admin.actionKey ||
+              (deviceAction === 'change-number' && !deviceActionInput.trim()) ||
+              (deviceAction === 'factory-reset' &&
+                deviceActionInput !== t('moderation.confirmWord'))
+            "
+            @click="confirmDeviceAction"
+          >
+            <LoaderCircle
+              v-if="admin.actionKey"
+              :size="15"
+              class="is-spinning"
+            />
+            {{ t(`moderation.confirm.${deviceAction}`) }}
+          </SkyButton>
+        </div>
+      </section>
+    </div>
+
+    <div v-if="discardDialog" class="admin-panel-dialog-backdrop">
+      <section class="admin-panel-dialog" role="alertdialog">
+        <span class="admin-panel-dialog__icon is-warning">
+          <TriangleAlert :size="21" />
+        </span>
+        <div>
+          <h2>{{ t('editor.discardTitle') }}</h2>
+          <p>{{ t('editor.discardBody') }}</p>
+        </div>
+        <div class="admin-panel-dialog__actions">
+          <SkyButton variant="secondary" @click="cancelDiscard">
+            {{ t('editor.keepEditing') }}
+          </SkyButton>
+          <SkyButton
+            class="is-danger"
+            variant="danger"
+            @click="discardAndContinue"
+          >
+            {{ t('editor.discard') }}
+          </SkyButton>
+        </div>
+      </section>
+    </div>
+  </div>
+</template>
+
+<style scoped>
+.admin-panel-overlay {
+  --admin-bg: #070908;
+  --admin-panel: #0d0f0e;
+  --admin-panel-raised: #131514;
+  --admin-panel-hover: #191b1a;
+  --admin-nav-active: #202220;
+  --admin-border: rgba(255, 255, 255, 0.045);
+  --admin-border-strong: rgba(255, 255, 255, 0.085);
+  --admin-text: #f0f3f0;
+  --admin-muted: #818781;
+  --admin-dim: #555b55;
+  --admin-green: var(--admin-accent, #74d66f);
+  --admin-green-soft: color-mix(in srgb, var(--admin-green) 9%, transparent);
+  --admin-toggle-on: #63d471;
+  --admin-row-hover: linear-gradient(
+    90deg,
+    #1a1c1b 0%,
+    rgba(24, 26, 25, 0.52) 48%,
+    transparent 100%
+  );
+  --admin-row-active: linear-gradient(
+    90deg,
+    #212321 0%,
+    #171918 45%,
+    transparent 100%
+  );
+  --admin-red: #ef6969;
+  position: fixed;
+  z-index: 10000;
+  inset: 0;
+  display: grid;
+  place-items: center;
+  padding: 2.5vh 2.5vw;
+  color: var(--admin-text);
+  background: transparent;
+  font-family: var(
+    --admin-font-family,
+    var(--sky-font-family, Inter, sans-serif)
+  );
+  pointer-events: auto;
+}
+
+.admin-panel-window {
+  width: min(76vw, 1220px);
+  height: min(74vh, 700px);
+  overflow: hidden;
+  border: 1px solid rgba(255, 255, 255, 0.065);
+  border-radius: 4px;
+  background: var(--admin-bg);
+  box-shadow:
+    0 20px 56px rgba(0, 0, 0, 0.72),
+    inset 0 1px rgba(255, 255, 255, 0.018);
+  zoom: var(--admin-font-scale, 1);
+}
+
+.admin-panel-header {
+  height: 50px;
+  display: grid;
+  grid-template-columns: 320px 1fr auto;
+  align-items: center;
+  border-bottom: 1px solid var(--admin-border);
+  background: #0b0d0c;
+}
+
+.admin-panel-brand,
+.admin-panel-context,
+.admin-panel-actions,
+.admin-panel-profile-heading,
+.admin-panel-section-card__heading,
+.admin-panel-device-summary,
+.admin-panel-manual-save-note,
+.admin-panel-dialog__actions {
+  display: flex;
+  align-items: center;
+}
+
+.admin-panel-brand {
+  height: 100%;
+  padding: 0 17px;
+  border-right: 1px solid var(--admin-border);
+}
+
+.admin-panel-brand div,
+.admin-panel-profile-heading > div:nth-child(2),
+.admin-panel-device-summary div,
+.admin-panel-manual-save-note div {
+  display: grid;
+  min-width: 0;
+}
+
+.admin-panel-brand strong {
+  font-size: 11px;
+  letter-spacing: 0.13em;
+}
+
+.admin-panel-brand span:last-child {
+  color: var(--admin-muted);
+  font-size: 9px;
+  letter-spacing: 0.11em;
+}
+
+.admin-panel-context {
+  gap: 7px;
+  min-width: 0;
+  padding: 0 16px;
+  color: var(--admin-dim);
+  font-size: 11px;
+}
+
+.admin-panel-context strong {
+  overflow: hidden;
+  color: #bfc4bf;
+  font-weight: 550;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.admin-panel-actions {
+  gap: 6px;
+  padding-right: 10px;
+}
+
+.admin-panel-dirty {
+  display: flex;
+  align-items: center;
+  gap: 7px;
+  margin-right: 5px;
+  color: #d2a861;
+  font-size: 10px;
+}
+
+.admin-panel-dirty > span,
+.admin-panel-online-dot {
+  width: 6px;
+  height: 6px;
+  border-radius: 50%;
+  background: var(--admin-green);
+  box-shadow: 0 0 8px color-mix(in srgb, var(--admin-green) 75%, transparent);
+}
+
+.admin-panel-dirty > span {
+  background: #d8aa5e;
+  box-shadow: 0 0 8px rgba(216, 170, 94, 0.65);
+}
+
+.admin-panel-icon-button,
+.admin-panel-save,
+.admin-panel-rail button {
+  border: 0;
+  color: var(--admin-muted);
+  background: transparent;
+}
+
+.admin-panel-icon-button,
+.admin-panel-save {
+  width: 40px;
+  height: 40px;
+  display: grid;
+  place-items: center;
+  border-radius: 6px;
+  cursor: pointer;
+}
+
+.admin-panel-icon-button:hover:not(:disabled) {
+  color: var(--admin-text);
+  background: var(--admin-panel-hover);
+}
+
+.admin-panel-save {
+  border: 0;
+  color: #555b55;
+  background: transparent;
+  box-shadow: none;
+}
+
+.admin-panel-save.is-ready {
+  color: #74d66f;
+  background: transparent;
+  filter: drop-shadow(0 0 5px rgba(116, 214, 111, 0.42));
+}
+
+.admin-panel-save.is-ready:hover:not(:disabled) {
+  color: color-mix(in srgb, #74d66f 82%, white);
+  background: transparent;
+  filter: drop-shadow(0 0 7px rgba(116, 214, 111, 0.65));
+}
+
+.admin-panel-close:hover {
+  color: var(--admin-red) !important;
+  background: rgba(239, 105, 105, 0.09) !important;
+}
+
+button:disabled {
+  cursor: not-allowed !important;
+  opacity: 0.5;
+}
+
+.admin-panel-body {
+  height: calc(100% - 50px);
+  display: grid;
+  grid-template-columns: 50px 270px minmax(0, 1fr);
+}
+
+.admin-panel-rail {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 5px;
+  padding: 8px 0;
+  border-right: 1px solid var(--admin-border);
+  background: #111311;
+}
+
+.admin-panel-rail button {
+  width: 38px;
+  height: 38px;
+  display: grid;
+  place-items: center;
+  border-radius: 6px;
+  cursor: pointer;
+}
+
+.admin-panel-rail button:hover,
+.admin-panel-rail button.is-active {
+  color: var(--admin-text);
+  background: #222522;
+}
+
+.admin-panel-rail .admin-panel-rail__configurator {
+  margin-top: auto;
+}
+
+.admin-panel-rail button.is-active {
+  color: #f4f6f4;
+  background: var(--admin-nav-active);
+}
+
+.admin-panel-directory {
+  min-width: 0;
+  overflow: hidden;
+  border-right: 1px solid var(--admin-border);
+  background: #101210;
+}
+
+.admin-panel-directory__header {
+  height: 62px;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 0 16px;
+}
+
+.admin-panel-directory__header div,
+.admin-panel-section-card__heading > div:first-child,
+.admin-panel-app-heading > div:first-child,
+.admin-panel-page-heading > div:last-child {
+  display: grid;
+  gap: 2px;
+}
+
+.admin-panel-directory__header span,
+.admin-panel-section-card__heading span,
+.admin-panel-page-heading span,
+.admin-panel-profile-heading > div > span {
+  color: var(--admin-muted);
+  font-size: 9px;
+  font-weight: 650;
+  letter-spacing: 0.08em;
+}
+
+.admin-panel-directory__header h2,
+.admin-panel-section-card__heading h2,
+.admin-panel-page-heading h1,
+.admin-panel-profile-heading h1,
+.admin-panel-empty-editor h1,
+.admin-panel-dialog h2 {
+  margin: 0;
+  font-weight: 600;
+}
+
+.admin-panel-directory__header h2 {
+  font-size: 14px;
+}
+
+.admin-panel-directory__header > strong {
+  min-width: 28px;
+  padding: 4px 7px;
+  border-radius: 5px;
+  color: #b7bcb7;
+  background: #1b1e1b;
+  font-size: 10px;
+  text-align: center;
+}
+
+.admin-panel-overview-directory {
+  height: calc(100% - 62px);
+  display: grid;
+  align-content: start;
+  gap: 0;
+  overflow-y: auto;
+  margin: 0 14px;
+}
+
+.admin-panel-overview-directory button,
+.admin-panel-feature-grid button {
+  display: grid;
+  grid-template-columns: 30px minmax(0, 1fr) auto;
+  align-items: center;
+  gap: 9px;
+  min-height: 47px;
+  padding: 7px 4px;
+  border: 0;
+  border-radius: 3px;
+  color: var(--admin-muted);
+  background: transparent;
+  text-align: left;
+  cursor: pointer;
+}
+
+.admin-panel-overview-directory button:hover,
+.admin-panel-feature-grid button:hover {
+  color: var(--admin-green);
+  background: var(--admin-row-hover);
+}
+
+.admin-panel-overview-directory button > svg:first-child,
+.admin-panel-feature-grid button > svg:first-child {
+  color: var(--admin-green);
+}
+
+.admin-panel-overview-directory button > span,
+.admin-panel-feature-grid button > span {
+  display: grid;
+  min-width: 0;
+  gap: 2px;
+}
+
+.admin-panel-overview-directory strong,
+.admin-panel-feature-grid strong {
+  overflow: hidden;
+  color: var(--admin-text);
+  font-size: 10px;
+  font-weight: 600;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.admin-panel-overview-directory small,
+.admin-panel-feature-grid small {
+  overflow: hidden;
+  color: var(--admin-muted);
+  font-size: 8px;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.admin-panel-search {
+  height: 38px;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin: 0 12px 11px;
+  padding: 0 10px;
+  border: 1px solid var(--admin-border);
+  border-radius: 6px;
+  color: var(--admin-dim);
+  background: #161816;
+}
+
+.admin-panel-search:focus-within {
+  border-color: color-mix(in srgb, var(--admin-green) 30%, transparent);
+  color: var(--admin-green);
+}
+
+.admin-panel-search input {
+  width: 100%;
+  min-width: 0;
+  border: 0;
+  outline: 0;
+  color: var(--admin-text);
+  background: transparent;
+  font: inherit;
+  font-size: 11px;
+}
+
+.admin-panel-search input::placeholder {
+  color: #5f655f;
+}
+
+.admin-panel-config-scopes {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 2px;
+  margin: 0 12px 8px;
+  padding: 3px;
+  border-radius: 4px;
+  background: #171917;
+}
+
+.admin-panel-config-scopes button {
+  min-width: 0;
+  height: 27px;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 6px;
+  padding: 0 8px;
+  border: 0;
+  border-radius: 3px;
+  color: var(--admin-muted);
+  background: transparent;
+  font: inherit;
+  font-size: 8px;
+  cursor: pointer;
+}
+
+.admin-panel-config-scopes button:hover,
+.admin-panel-config-scopes button.is-active {
+  color: var(--admin-text);
+  background: var(--admin-row-active);
+}
+
+.admin-panel-config-scopes button.is-active {
+  box-shadow: inset 0 -1px var(--admin-green);
+}
+
+.admin-panel-config-scopes em {
+  color: var(--admin-dim);
+  font-size: 7px;
+  font-style: normal;
+}
+
+.admin-panel-player-list,
+.admin-panel-audit-mini-list,
+.admin-panel-config-sections {
+  height: calc(100% - 115px);
+  overflow-y: auto;
+  padding: 0 8px 16px;
+  scrollbar-color: #343834 transparent;
+  scrollbar-width: thin;
+}
+
+.admin-panel-config-sections {
+  height: calc(100% - 149px);
+  overflow-y: auto;
+  padding: 0 8px 16px;
+  scrollbar-color: #343834 transparent;
+  scrollbar-width: thin;
+}
+
+.admin-panel-config-sections > button {
+  width: 100%;
+  min-height: 44px;
+  display: grid;
+  grid-template-columns: 28px minmax(0, 1fr) auto;
+  align-items: center;
+  gap: 8px;
+  padding: 7px 9px;
+  border: 0;
+  border-radius: 3px;
+  color: var(--admin-muted);
+  background: transparent;
+  text-align: left;
+  cursor: pointer;
+}
+
+.admin-panel-config-sections > button:hover {
+  color: var(--admin-text);
+  background: var(--admin-row-hover);
+}
+
+.admin-panel-config-sections > button.is-active {
+  color: var(--admin-green);
+  background: var(--admin-row-active);
+  box-shadow: inset 2px 0 var(--admin-green);
+}
+
+.admin-panel-config-sections > button > svg {
+  color: var(--admin-green);
+}
+
+.admin-panel-config-sections > button > span {
+  display: grid;
+  min-width: 0;
+  gap: 2px;
+}
+
+.admin-panel-config-sections strong,
+.admin-panel-config-sections small {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.admin-panel-config-sections strong {
+  color: var(--admin-text);
+  font-size: 10px;
+  font-weight: 600;
+}
+
+.admin-panel-config-sections small,
+.admin-panel-config-sections em {
+  color: var(--admin-muted);
+  font-size: 8px;
+  font-style: normal;
+}
+
+.admin-panel-config-sections em {
+  min-width: 23px;
+  padding: 3px 5px;
+  border-radius: 4px;
+  background: #1d201d;
+  text-align: center;
+}
+
+.admin-panel-player-list > button {
+  width: 100%;
+  display: grid;
+  grid-template-columns: 34px minmax(0, 1fr) auto;
+  align-items: center;
+  gap: 10px;
+  padding: 9px 9px;
+  border: 0;
+  border-radius: 3px;
+  color: var(--admin-text);
+  background: transparent;
+  text-align: left;
+  cursor: pointer;
+}
+
+.admin-panel-player-list > button:hover {
+  background: var(--admin-row-hover);
+}
+
+.admin-panel-player-list > button.is-active {
+  background: var(--admin-row-active);
+  box-shadow: inset 2px 0 var(--admin-green);
+}
+
+.admin-panel-avatar,
+.admin-panel-profile-avatar {
+  display: grid;
+  place-items: center;
+  flex: 0 0 auto;
+  border: 0;
+  border-radius: 7px;
+  color: #c7e8c4;
+  background: linear-gradient(145deg, #263126, #182018);
+  font-size: 10px;
+  font-weight: 700;
+}
+
+.admin-panel-avatar {
+  width: 32px;
+  height: 32px;
+}
+
+.admin-panel-player-list__copy {
+  display: grid;
+  min-width: 0;
+  gap: 2px;
+}
+
+.admin-panel-player-list__copy strong,
+.admin-panel-player-list__copy small {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.admin-panel-player-list__copy strong {
+  font-size: 11px;
+  font-weight: 580;
+}
+
+.admin-panel-player-list__copy small,
+.admin-panel-player-list__meta {
+  color: var(--admin-muted);
+  font-size: 9px;
+}
+
+.admin-panel-player-list__meta {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+}
+
+.admin-panel-empty-list,
+.admin-panel-empty-editor,
+.admin-panel-loading {
+  display: grid;
+  place-items: center;
+  align-content: center;
+  text-align: center;
+}
+
+.admin-panel-empty-list {
+  gap: 5px;
+  padding: 40px 22px;
+  color: var(--admin-muted);
+}
+
+.admin-panel-empty-list strong {
+  color: var(--admin-text);
+  font-size: 12px;
+}
+
+.admin-panel-empty-list span {
+  font-size: 10px;
+  line-height: 1.5;
+}
+
+.admin-panel-audit-mini-list {
+  height: calc(100% - 62px);
+  padding-inline: 10px;
+}
+
+.admin-panel-audit-mini-list article {
+  display: grid;
+  grid-template-columns: 28px 1fr;
+  gap: 9px;
+  padding: 10px 5px;
+  border-radius: 3px;
+}
+
+.admin-panel-audit-mini-list article:hover {
+  background: var(--admin-row-hover);
+}
+
+.admin-panel-audit-icon {
+  width: 27px;
+  height: 27px;
+  display: grid;
+  place-items: center;
+  border-radius: 5px;
+  color: var(--admin-green);
+  background: var(--admin-green-soft);
+}
+
+.admin-panel-audit-mini-list div {
+  display: grid;
+  gap: 2px;
+  min-width: 0;
+}
+
+.admin-panel-audit-mini-list strong {
+  font-size: 10px;
+}
+
+.admin-panel-audit-mini-list span,
+.admin-panel-audit-mini-list small {
+  color: var(--admin-muted);
+  font-size: 9px;
+}
+
+.admin-panel-editor {
+  min-width: 0;
+  overflow: hidden;
+  background: #0b0d0c;
+}
+
+.admin-panel-editor__scroll {
+  height: 100%;
+  overflow-y: auto;
+  padding: 14px;
+  scrollbar-color: #343834 transparent;
+  scrollbar-width: thin;
+}
+
+.admin-panel-loading,
+.admin-panel-empty-editor {
+  height: 100%;
+  gap: 9px;
+  color: var(--admin-muted);
+}
+
+.admin-panel-profile-heading {
+  gap: 13px;
+  min-height: 64px;
+  padding: 2px 3px 12px;
+}
+
+.admin-panel-profile-avatar {
+  width: 42px;
+  height: 42px;
+  border-radius: 6px;
+  font-size: 12px;
+}
+
+.admin-panel-profile-heading h1 {
+  font-size: 18px;
+  letter-spacing: -0.025em;
+}
+
+.admin-panel-profile-heading p,
+.admin-panel-section-card__heading p,
+.admin-panel-page-heading p,
+.admin-panel-empty-editor p,
+.admin-panel-dialog p {
+  margin: 0;
+  color: var(--admin-muted);
+  font-size: 10px;
+  line-height: 1.55;
+}
+
+.admin-panel-player-actions {
+  display: flex;
+  align-items: center;
+  gap: 5px;
+  margin-left: auto;
+}
+
+.admin-panel-player-actions button {
+  min-height: 38px;
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  padding: 0 9px;
+  border: 1px solid var(--admin-border);
+  border-radius: 5px;
+  color: #b9beb9;
+  background: #181a18;
+  font-size: 8px;
+  font-weight: 600;
+  cursor: pointer;
+}
+
+.admin-panel-player-actions button:hover:not(:disabled) {
+  border-color: var(--admin-border-strong);
+  color: var(--admin-text);
+  background: var(--admin-panel-hover);
+}
+
+.admin-panel-player-actions button.is-danger {
+  border-color: rgba(239, 105, 105, 0.22);
+  color: #efaaaa;
+  background: rgba(239, 105, 105, 0.08);
+}
+
+.admin-panel-device-tabs {
+  display: flex;
+  gap: 6px;
+  overflow-x: auto;
+  margin-bottom: 12px;
+  padding-bottom: 2px;
+}
+
+.admin-panel-device-tabs button {
+  min-width: 155px;
+  display: grid;
+  grid-template-columns: 20px 1fr;
+  grid-template-rows: auto auto;
+  align-items: center;
+  gap: 1px 7px;
+  padding: 8px 10px;
+  border: 0;
+  border-radius: 3px;
+  color: var(--admin-muted);
+  background: #121412;
+  text-align: left;
+  cursor: pointer;
+}
+
+.admin-panel-device-tabs button svg {
+  grid-row: 1 / 3;
+}
+
+.admin-panel-device-tabs button span {
+  color: #c8cdc8;
+  font-size: 10px;
+}
+
+.admin-panel-device-tabs button small {
+  font-size: 8px;
+}
+
+.admin-panel-device-tabs button.is-active {
+  color: var(--admin-green);
+  background: var(--admin-row-active);
+  box-shadow: inset 2px 0 var(--admin-green);
+}
+
+.admin-panel-device-tabs button:hover:not(.is-active) {
+  background: var(--admin-row-hover);
+}
+
+.admin-panel-device-tabs button.is-dirty::after {
+  content: '';
+  width: 5px;
+  height: 5px;
+  grid-column: 2;
+  grid-row: 1 / 3;
+  align-self: center;
+  justify-self: end;
+  border-radius: 50%;
+  background: #d8aa5e;
+}
+
+.admin-panel-stat-grid,
+.admin-panel-section-grid,
+.admin-panel-security-grid,
+.admin-panel-app-grid,
+.admin-panel-audit-grid,
+.admin-panel-empty-stats {
+  display: grid;
+  gap: 10px;
+}
+
+.admin-panel-stat-grid {
+  grid-template-columns: repeat(4, minmax(0, 1fr));
+  margin-bottom: 10px;
+  gap: 2px;
+  overflow: hidden;
+  border-radius: 3px;
+  background: transparent;
+}
+
+.admin-panel-stat-grid article {
+  display: grid;
+  grid-template-columns: 26px 1fr;
+  align-items: center;
+  gap: 1px 8px;
+  min-width: 0;
+  padding: 10px 12px;
+  border: 0;
+  border-right: 0;
+  border-radius: 0;
+  background: var(--admin-panel);
+}
+
+.admin-panel-stat-grid svg {
+  grid-row: 1 / 3;
+  color: var(--admin-muted);
+}
+
+.admin-panel-stat-grid span {
+  color: var(--admin-muted);
+  font-size: 8px;
+  text-transform: uppercase;
+}
+
+.admin-panel-stat-grid strong {
+  overflow: hidden;
+  font-size: 12px;
+  font-weight: 600;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.admin-panel-section-grid {
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+}
+
+.admin-panel-section-card {
+  margin-bottom: 10px;
+  padding: 13px;
+  border: 0;
+  border-radius: 3px;
+  background: #0f110f;
+}
+
+.admin-panel-section-card--compact {
+  padding: 11px 12px;
+}
+
+.admin-panel-section-card--focused {
+  min-height: 210px;
+}
+
+.admin-panel-feature-grid {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 8px;
+}
+
+.admin-panel-accent-picker {
+  display: grid;
+  grid-template-columns: repeat(5, minmax(0, 1fr));
+  gap: 3px;
+  padding: 3px;
+  border: 0;
+  border-radius: 3px;
+  background: #0b0d0c;
+}
+
+.admin-panel-accent-picker button {
+  min-height: 38px;
+  display: grid;
+  grid-template-columns: 18px minmax(0, 1fr) 16px;
+  align-items: center;
+  gap: 7px;
+  padding: 7px 9px;
+  border: 1px solid transparent;
+  border-radius: 2px;
+  color: var(--admin-muted);
+  background: transparent;
+  text-align: left;
+  cursor: pointer;
+}
+
+.admin-panel-accent-picker button:hover,
+.admin-panel-accent-picker button.is-active {
+  color: var(--admin-text);
+  background: var(--admin-row-active);
+}
+
+.admin-panel-accent-picker button > span {
+  width: 16px;
+  height: 16px;
+  border: 2px solid rgba(255, 255, 255, 0.2);
+  border-radius: 50%;
+}
+
+.admin-panel-accent-picker strong {
+  overflow: hidden;
+  font-size: 9px;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.admin-panel-accent-picker svg {
+  color: var(--admin-green);
+}
+
+.admin-panel-appearance-controls {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 1px;
+  margin-top: 8px;
+  background: #0a0c0b;
+}
+
+.admin-panel-appearance-control {
+  min-height: 62px;
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) minmax(120px, 0.8fr);
+  align-items: center;
+  gap: 12px;
+  padding: 10px 12px;
+  background: #121412;
+}
+
+.admin-panel-appearance-control.is-color {
+  grid-column: 1 / -1;
+  grid-template-columns: minmax(170px, 0.7fr) minmax(320px, 1.3fr);
+}
+
+.admin-panel-appearance-control > div:first-child,
+.admin-panel-appearance-control > span:first-child {
+  min-width: 0;
+  display: grid;
+  gap: 3px;
+}
+
+.admin-panel-appearance-control strong {
+  color: #d9ddd9;
+  font-size: 9px;
+  font-weight: 600;
+}
+
+.admin-panel-appearance-control small {
+  color: var(--admin-muted);
+  font-size: 8px;
+  line-height: 1.3;
+}
+
+.admin-panel-rgb-picker {
+  min-width: 0;
+  display: grid;
+  grid-template-columns: auto minmax(230px, 1fr);
+  align-items: center;
+  gap: 14px;
+}
+
+.admin-panel-color-value {
+  min-width: 96px;
+  height: 32px;
+  display: flex;
+  align-items: center;
+  gap: 7px;
+  padding: 0 8px;
+  border-radius: 3px;
+  outline: 1px solid var(--admin-border-strong);
+  background: #1a1d1b;
+}
+
+.admin-panel-color-value > span {
+  width: 16px;
+  height: 16px;
+  flex: 0 0 auto;
+  border-radius: 3px;
+  box-shadow: 0 0 8px color-mix(in srgb, var(--admin-green) 48%, transparent);
+}
+
+.admin-panel-color-value input {
+  min-width: 0;
+  height: 24px;
+  padding: 0;
+  border: 0;
+  outline: 0;
+  color: #cbd0cb;
+  background: transparent;
+  font: inherit;
+  font-family: ui-monospace, SFMono-Regular, Consolas, monospace;
+  font-size: 8px;
+  text-transform: uppercase;
+}
+
+.admin-panel-rgb-fields {
+  display: grid;
+  gap: 6px;
+}
+
+.admin-panel-rgb-fields label {
+  min-width: 0;
+  display: grid;
+  grid-template-columns: 12px minmax(90px, 1fr) 42px;
+  align-items: center;
+  gap: 7px;
+}
+
+.admin-panel-rgb-fields span {
+  color: var(--admin-muted);
+  font-size: 8px;
+  font-weight: 650;
+  text-transform: uppercase;
+}
+
+.admin-panel-rgb-fields input[type='number'] {
+  width: 42px !important;
+  max-width: 42px;
+  height: 24px;
+  padding: 0 6px;
+  border: 0;
+  border-radius: 3px;
+  outline: 1px solid var(--admin-border-strong);
+  color: var(--admin-text);
+  background: #1a1d1b;
+  font: inherit;
+  font-size: 8px;
+  appearance: textfield;
+}
+
+.admin-panel-rgb-fields input[type='number']::-webkit-inner-spin-button,
+.admin-panel-rgb-fields input[type='number']::-webkit-outer-spin-button {
+  appearance: none;
+}
+
+.admin-panel-rgb-range {
+  width: 100%;
+  height: 4px;
+  padding: 0;
+  border: 0;
+  border-radius: 999px;
+  outline: 0;
+  appearance: none;
+  cursor: pointer;
+}
+
+.admin-panel-rgb-range::-webkit-slider-thumb {
+  width: 13px;
+  height: 13px;
+  border: 2px solid #f3f5f3;
+  border-radius: 50%;
+  background: var(--admin-green);
+  box-shadow: 0 0 0 2px #171a18;
+  appearance: none;
+}
+
+.admin-panel-font-select {
+  position: relative;
+  min-width: 0;
+}
+
+.admin-panel-font-select > button {
+  width: 100%;
+  height: 32px;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  padding: 0 9px;
+  border: 0;
+  border-radius: 3px;
+  outline: 1px solid var(--admin-border-strong);
+  color: var(--admin-text);
+  background: #1a1d1b;
+  font: inherit;
+  font-size: 9px;
+  text-align: left;
+  cursor: pointer;
+}
+
+.admin-panel-font-select > button svg {
+  color: var(--admin-muted);
+  transition: transform 150ms ease;
+}
+
+.admin-panel-font-select > button[aria-expanded='true'] svg {
+  transform: rotate(180deg);
+}
+
+.admin-panel-font-select__menu {
+  position: absolute;
+  z-index: 12;
+  top: calc(100% + 5px);
+  right: 0;
+  left: 0;
+  max-height: 210px;
+  overflow-y: auto;
+  display: grid;
+  gap: 1px;
+  padding: 4px;
+  border-radius: 4px;
+  outline: 1px solid rgba(255, 255, 255, 0.09);
+  background: #101211;
+  box-shadow: 0 12px 28px rgba(0, 0, 0, 0.58);
+}
+
+.admin-panel-font-select__menu button {
+  min-height: 30px;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  padding: 0 8px;
+  border: 0;
+  border-radius: 2px;
+  color: var(--admin-muted);
+  background: transparent;
+  font-size: 9px;
+  text-align: left;
+  cursor: pointer;
+}
+
+.admin-panel-font-select__menu button:hover,
+.admin-panel-font-select__menu button.is-active {
+  color: var(--admin-text);
+  background: var(--admin-row-active);
+}
+
+.admin-panel-font-select__menu svg {
+  color: var(--admin-green);
+}
+
+.admin-panel-font-size-control {
+  display: grid;
+  grid-template-columns: minmax(80px, 1fr) 38px;
+  align-items: center;
+  gap: 9px;
+}
+
+.admin-panel-font-size-control input {
+  width: 100%;
+  height: 3px;
+  accent-color: var(--admin-green);
+  cursor: pointer;
+}
+
+.admin-panel-font-size-control > strong {
+  color: var(--admin-green);
+  text-align: right;
+}
+
+.admin-panel-section-card__heading {
+  justify-content: space-between;
+  gap: 12px;
+  margin-bottom: 12px;
+  padding-bottom: 10px;
+  border-bottom: 1px solid var(--admin-border);
+}
+
+.admin-panel-section-card__heading h2 {
+  font-size: 12px;
+}
+
+.admin-panel-section-card__heading > svg {
+  color: var(--admin-muted);
+}
+
+.admin-panel-field-list {
+  display: grid;
+  gap: 7px;
+  margin: 0;
+}
+
+.admin-panel-field-list > div {
+  display: grid;
+  grid-template-columns: minmax(110px, 0.75fr) minmax(0, 1.25fr);
+  align-items: center;
+  gap: 10px;
+}
+
+.admin-panel-field-list dt {
+  color: var(--admin-muted);
+  font-size: 9px;
+}
+
+.admin-panel-field-list dd {
+  min-width: 0;
+  overflow: hidden;
+  margin: 0;
+  padding: 7px 9px;
+  border: 1px solid var(--admin-border);
+  border-radius: 5px;
+  color: #d8dcd8;
+  background: #191b19;
+  font-size: 9px;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.admin-panel-device-summary {
+  gap: 9px;
+  margin-bottom: 10px;
+}
+
+.admin-panel-device-summary__icon,
+.admin-panel-heading-icon,
+.admin-panel-empty-editor__icon {
+  display: grid;
+  place-items: center;
+  border: 1px solid color-mix(in srgb, var(--admin-green) 16%, transparent);
+  color: var(--admin-green);
+  background: var(--admin-green-soft);
+}
+
+.admin-panel-device-summary__icon {
+  width: 38px;
+  height: 38px;
+  border-radius: 7px;
+}
+
+.admin-panel-device-summary strong {
+  font-size: 11px;
+}
+
+.admin-panel-device-summary span,
+.admin-panel-device-summary small {
+  color: var(--admin-muted);
+  font-size: 9px;
+}
+
+.admin-panel-device-summary small {
+  margin-left: auto;
+  padding: 4px 7px;
+  border-radius: 4px;
+  background: #1b1e1b;
+}
+
+.admin-panel-inline-empty {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 8px;
+  padding: 18px;
+  color: var(--admin-muted);
+  font-size: 10px;
+  text-align: center;
+}
+
+.admin-panel-security-grid {
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+}
+
+.admin-panel-credential-box {
+  position: relative;
+  display: grid;
+  align-content: center;
+  min-height: 66px;
+  gap: 5px;
+  padding: 9px 10px;
+  border: 1px solid var(--admin-border);
+  border-radius: 5px;
+  background: #181a18;
+}
+
+.admin-panel-credential-box > span,
+.admin-panel-credential-box--pin div span {
+  color: var(--admin-muted);
+  font-size: 8px;
+  text-transform: uppercase;
+}
+
+.admin-panel-credential-box > strong,
+.admin-panel-credential-box--pin strong {
+  overflow: hidden;
+  padding-right: 82px;
+  font-size: 10px;
+  font-weight: 550;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.admin-panel-credential-box button {
+  position: absolute;
+  right: 7px;
+  bottom: 8px;
+  display: flex;
+  align-items: center;
+  gap: 5px;
+  padding: 5px 7px;
+  border: 1px solid var(--admin-border-strong);
+  border-radius: 4px;
+  color: #bbc0bb;
+  background: #242724;
+  font-size: 8px;
+  cursor: pointer;
+  min-height: 44px;
+}
+
+.admin-panel-password {
+  font-family: ui-monospace, SFMono-Regular, Consolas, monospace;
+  letter-spacing: 0.06em;
+}
+
+.admin-panel-credential-box--pin {
+  grid-column: 1 / -1;
+  grid-template-columns: 24px 1fr;
+  align-items: center;
+  min-height: 46px;
+}
+
+.admin-panel-credential-box--pin > svg {
+  color: var(--admin-muted);
+}
+
+.admin-panel-credential-box--pin div {
+  display: grid;
+  gap: 3px;
+}
+
+.admin-panel-credential-box--pin strong {
+  padding: 0;
+  color: #b8bdb8;
+  font-size: 9px;
+}
+
+.admin-panel-app-heading {
+  align-items: flex-end;
+}
+
+.admin-panel-app-heading__actions {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+}
+
+.admin-panel-app-heading__actions > span {
+  color: #d8aa5e;
+  font-size: 9px;
+}
+
+.admin-panel-search--apps {
+  width: 190px;
+  height: 44px;
+  margin: 0;
+}
+
+.admin-panel-manual-save-note {
+  gap: 9px;
+  margin-bottom: 10px;
+  padding: 8px 10px;
+  border: 0;
+  border-radius: 5px;
+  color: var(--admin-green);
+  background: color-mix(in srgb, var(--admin-green) 5.5%, transparent);
+}
+
+.admin-panel-manual-save-note strong {
+  font-size: 9px;
+}
+
+.admin-panel-manual-save-note span {
+  color: #849184;
+  font-size: 8px;
+}
+
+.admin-panel-app-grid {
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+}
+
+.admin-panel-app-grid > button {
+  display: grid;
+  grid-template-columns: 32px minmax(0, 1fr) auto;
+  align-items: center;
+  gap: 8px;
+  min-width: 0;
+  padding: 8px;
+  border: 0;
+  border-radius: 3px;
+  color: var(--admin-text);
+  background: #161816;
+  text-align: left;
+  cursor: pointer;
+}
+
+.admin-panel-app-grid > button:hover:not(:disabled) {
+  background: var(--admin-row-hover);
+}
+
+.admin-panel-app-grid > button.is-dirty {
+  background: linear-gradient(
+    90deg,
+    rgba(216, 170, 94, 0.19) 0%,
+    rgba(216, 170, 94, 0.04) 52%,
+    transparent 100%
+  );
+  box-shadow: inset 2px 0 #d8aa5e;
+}
+
+.admin-panel-app-icon {
+  width: 30px;
+  height: 30px;
+  display: grid;
+  place-items: center;
+  border-radius: 7px;
+  color: white;
+  background: #292c29;
+}
+
+.admin-panel-app-copy {
+  display: grid;
+  min-width: 0;
+  gap: 2px;
+}
+
+.admin-panel-app-copy strong,
+.admin-panel-app-copy small {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.admin-panel-app-copy strong {
+  font-size: 9px;
+  font-weight: 550;
+}
+
+.admin-panel-app-copy small {
+  color: var(--admin-muted);
+  font-size: 8px;
+}
+
+.admin-panel-switch {
+  width: 27px;
+  height: 15px;
+  padding: 2px;
+  border-radius: 999px;
+  background: #353935;
+  transition: background 150ms ease;
+}
+
+.admin-panel-switch span {
+  width: 11px;
+  height: 11px;
+  display: block;
+  border-radius: 50%;
+  background: #c8cdc8;
+  transition: transform 150ms ease;
+}
+
+.admin-panel-app-grid > button.is-enabled .admin-panel-switch {
+  background: var(--admin-green);
+}
+
+.admin-panel-app-grid > button.is-enabled .admin-panel-switch span {
+  transform: translateX(12px);
+  background: #0b100b;
+}
+
+.admin-panel-activity-list {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr);
+  gap: 2px;
+  overflow: hidden;
+  border: 0;
+  border-radius: 3px;
+}
+
+.admin-panel-activity-list article {
+  display: grid;
+  grid-template-columns: 34px minmax(0, 1fr);
+  align-items: center;
+  gap: 9px;
+  min-width: 0;
+  padding: 9px 10px;
+  border: 0;
+  border-bottom: 0;
+  border-radius: 3px;
+  background: #141614;
+}
+
+.admin-panel-activity-list article:hover {
+  background: var(--admin-row-hover);
+}
+
+.admin-panel-activity-icon {
+  width: 32px;
+  height: 32px;
+  display: grid;
+  place-items: center;
+  border-radius: 6px;
+  color: var(--admin-green);
+  background: var(--admin-green-soft);
+}
+
+.admin-panel-activity-list article > div {
+  display: grid;
+  min-width: 0;
+  gap: 3px;
+}
+
+.admin-panel-activity-list strong,
+.admin-panel-activity-list small,
+.admin-panel-activity-meta {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.admin-panel-activity-list strong {
+  font-size: 10px;
+  font-weight: 550;
+}
+
+.admin-panel-activity-list small,
+.admin-panel-activity-meta {
+  color: var(--admin-muted);
+  font-size: 8px;
+}
+
+.admin-panel-moderation-grid {
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  gap: 8px;
+}
+
+.admin-panel-moderation-grid button {
+  min-height: 84px;
+  display: grid;
+  grid-template-columns: 28px minmax(0, 1fr) auto;
+  align-items: center;
+  gap: 9px;
+  padding: 11px;
+  border: 1px solid var(--admin-border);
+  border-radius: 5px;
+  color: var(--admin-green);
+  background: #161816;
+  text-align: left;
+  cursor: pointer;
+}
+
+.admin-panel-moderation-grid button:hover:not(:disabled) {
+  border-color: color-mix(in srgb, var(--admin-green) 30%, transparent);
+  background: var(--admin-green-soft);
+}
+
+.admin-panel-moderation-grid button > span {
+  display: grid;
+  min-width: 0;
+  gap: 4px;
+}
+
+.admin-panel-moderation-grid strong {
+  color: var(--admin-text);
+  font-size: 10px;
+}
+
+.admin-panel-moderation-grid small {
+  color: var(--admin-muted);
+  font-size: 8px;
+  line-height: 1.4;
+}
+
+.admin-panel-moderation-grid button.is-danger {
+  border-color: rgba(239, 105, 105, 0.22);
+  color: #ef6969;
+  background: rgba(239, 105, 105, 0.07);
+}
+
+.admin-panel-page-heading {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  margin-bottom: 12px;
+  padding: 2px 0;
+}
+
+.admin-panel-config-heading-copy {
+  display: grid;
+  gap: 2px;
+}
+
+.admin-panel-config-disabled,
+.admin-panel-config-notice {
+  display: grid;
+  grid-template-columns: 26px minmax(0, 1fr);
+  align-items: start;
+  gap: 9px;
+  margin-bottom: 8px;
+  padding: 10px 11px;
+  border-radius: 3px;
+  background: linear-gradient(90deg, rgba(240, 162, 75, 0.13), transparent 80%);
+}
+
+.admin-panel-config-notice {
+  background: linear-gradient(
+    90deg,
+    color-mix(in srgb, var(--admin-green) 11%, transparent),
+    transparent 82%
+  );
+}
+
+.admin-panel-config-disabled > svg {
+  color: #f0a24b;
+}
+
+.admin-panel-config-notice > svg {
+  color: var(--admin-green);
+}
+
+.admin-panel-config-disabled div,
+.admin-panel-config-notice div {
+  display: grid;
+  gap: 3px;
+}
+
+.admin-panel-config-disabled strong,
+.admin-panel-config-notice strong {
+  font-size: 10px;
+}
+
+.admin-panel-config-disabled p,
+.admin-panel-config-notice p {
+  margin: 0;
+  color: var(--admin-muted);
+  font-size: 9px;
+  line-height: 1.45;
+}
+
+.admin-panel-config-disabled code {
+  width: fit-content;
+  margin-top: 3px;
+  padding: 4px 6px;
+  border-radius: 3px;
+  color: #f6c889;
+  background: rgba(0, 0, 0, 0.25);
+  font-size: 9px;
+}
+
+.admin-panel-config-workspace {
+  margin-top: 10px;
+  overflow: hidden;
+  border-radius: 3px;
+  background: #111311;
+}
+
+.admin-panel-config-workspace > header {
+  min-height: 52px;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+  padding: 9px 12px;
+  background: #171917;
+}
+
+.admin-panel-config-workspace > header > div {
+  display: grid;
+  gap: 2px;
+}
+
+.admin-panel-config-workspace > header span,
+.admin-panel-config-workspace > header > strong {
+  color: var(--admin-muted);
+  font-size: 8px;
+  font-weight: 600;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+}
+
+.admin-panel-config-workspace h2 {
+  margin: 0;
+  font-size: 13px;
+  font-weight: 600;
+}
+
+.admin-panel-config-fields {
+  display: grid;
+  gap: 1px;
+  background: #0b0d0c;
+}
+
+.admin-panel-config-field {
+  min-height: 51px;
+  display: grid;
+  grid-template-columns: minmax(220px, 0.9fr) minmax(210px, 1.1fr);
+  align-items: center;
+  gap: 14px;
+  padding: 8px 12px;
+  background: #121412;
+}
+
+.admin-panel-config-field.is-structured {
+  grid-template-columns: minmax(0, 1fr);
+  align-items: stretch;
+  gap: 7px;
+}
+
+.admin-panel-config-field:hover {
+  background: var(--admin-row-hover);
+}
+
+.admin-panel-config-field.is-dirty {
+  background: var(--admin-row-active);
+  box-shadow: inset 2px 0 var(--admin-green);
+}
+
+.admin-panel-config-field__copy {
+  display: grid;
+  min-width: 0;
+  gap: 3px;
+}
+
+.admin-panel-config-field__copy strong,
+.admin-panel-config-field__copy small,
+.admin-panel-config-field__copy code {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.admin-panel-config-field__copy strong {
+  font-size: 10px;
+  font-weight: 600;
+}
+
+.admin-panel-config-field__copy small {
+  color: var(--admin-muted);
+  font-size: 8px;
+  line-height: 1.25;
+}
+
+.admin-panel-config-field__copy code {
+  color: var(--admin-dim);
+  font-family: ui-monospace, SFMono-Regular, Consolas, monospace;
+  font-size: 7px;
+}
+
+.admin-panel-config-field > input,
+.admin-panel-config-optional > input {
+  max-width: 100%;
+  min-width: 0;
+  border: 0;
+  border-radius: 4px;
+  outline: 1px solid rgba(255, 255, 255, 0.07);
+  color: var(--admin-text);
+  background: #1b1e1b;
+  font: inherit;
+  font-size: 10px;
+}
+
+.admin-panel-config-field > input {
+  justify-self: start;
+}
+
+.admin-panel-config-field > input[type='number'] {
+  appearance: textfield;
+}
+
+.admin-panel-config-field > input[type='number']::-webkit-inner-spin-button,
+.admin-panel-config-field > input[type='number']::-webkit-outer-spin-button {
+  margin: 0;
+  appearance: none;
+}
+
+.admin-panel-config-field > input,
+.admin-panel-config-optional > input {
+  height: 31px;
+  padding: 0 9px;
+}
+
+.admin-panel-config-field > input:focus,
+.admin-panel-config-optional > input:focus {
+  outline-color: color-mix(in srgb, var(--admin-green) 45%, transparent);
+}
+
+.admin-panel-config-field > input:disabled,
+.admin-panel-config-optional > input:disabled {
+  opacity: 0.45;
+}
+
+.admin-panel-config-optional {
+  min-width: 0;
+  max-width: 100%;
+  display: flex;
+  align-items: center;
+  justify-self: start;
+  gap: 8px;
+}
+
+.admin-panel-config-toggle {
+  position: relative;
+  justify-self: start;
+  width: 32px;
+  height: 18px;
+}
+
+.admin-panel-config-toggle input {
+  position: absolute;
+  inset: 0;
+  z-index: 1;
+  margin: 0;
+  opacity: 0;
+  cursor: pointer;
+}
+
+.admin-panel-config-toggle i {
+  position: absolute;
+  inset: 0;
+  border-radius: 999px;
+  background: #393d39;
+  transition: background 150ms ease;
+}
+
+.admin-panel-config-toggle i::after {
+  content: '';
+  position: absolute;
+  top: 3px;
+  left: 3px;
+  width: 12px;
+  height: 12px;
+  border-radius: 50%;
+  background: #c7ccc7;
+  transition: transform 150ms ease;
+}
+
+.admin-panel-config-toggle input:checked + i {
+  background: var(--admin-toggle-on);
+}
+
+.admin-panel-config-toggle input:checked + i::after {
+  transform: translateX(14px);
+  background: #f4f7f4;
+}
+
+.admin-panel-config-toggle input:disabled + i {
+  opacity: 0.45;
+}
+
+.admin-panel-heading-icon,
+.admin-panel-empty-editor__icon {
+  width: 44px;
+  height: 44px;
+  border-radius: 8px;
+}
+
+.admin-panel-page-heading h1,
+.admin-panel-empty-editor h1 {
+  font-size: 17px;
+}
+
+.admin-panel-audit-grid {
+  grid-template-columns: minmax(0, 1fr);
+  gap: 2px;
+  overflow: hidden;
+  border: 0;
+  border-radius: 3px;
+}
+
+.admin-panel-audit-grid article {
+  display: grid;
+  gap: 5px;
+  padding: 10px 11px;
+  border: 0;
+  border-bottom: 0;
+  border-radius: 3px;
+  background: #141614;
+}
+
+.admin-panel-audit-grid article:hover {
+  background: var(--admin-row-hover);
+}
+
+.admin-panel-audit-grid__topline {
+  display: flex;
+  justify-content: space-between;
+  gap: 10px;
+  color: var(--admin-green);
+  font-size: 9px;
+}
+
+.admin-panel-audit-grid time,
+.admin-panel-audit-grid p {
+  color: var(--admin-muted);
+  font-size: 8px;
+}
+
+.admin-panel-audit-grid strong {
+  font-size: 11px;
+}
+
+.admin-panel-empty-editor {
+  padding: 30px;
+}
+
+.admin-panel-empty-editor > p {
+  max-width: 430px;
+}
+
+.admin-panel-empty-stats {
+  grid-template-columns: repeat(3, 130px);
+  margin-top: 14px;
+}
+
+.admin-panel-empty-stats article {
+  display: grid;
+  grid-template-columns: 28px 1fr;
+  align-items: center;
+  padding: 10px;
+  border: 1px solid var(--admin-border);
+  border-radius: 6px;
+  background: var(--admin-panel);
+  text-align: left;
+}
+
+.admin-panel-empty-stats svg {
+  grid-row: 1 / 3;
+  color: var(--admin-muted);
+}
+
+.admin-panel-empty-stats strong {
+  font-size: 13px;
+}
+
+.admin-panel-empty-stats span {
+  color: var(--admin-muted);
+  font-size: 8px;
+}
+
+.admin-panel-toast {
+  position: fixed;
+  z-index: 10002;
+  right: 4vw;
+  bottom: 4vh;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  max-width: 390px;
+  padding: 10px 13px;
+  border: 1px solid color-mix(in srgb, var(--admin-green) 25%, transparent);
+  border-radius: 6px;
+  color: #d7ecd5;
+  background: #152015;
+  box-shadow: 0 16px 40px rgba(0, 0, 0, 0.45);
+  font-size: 10px;
+}
+
+.admin-panel-toast.is-error {
+  border-color: rgba(239, 105, 105, 0.3);
+  color: #f2c4c4;
+  background: #241414;
+}
+
+.admin-panel-dialog-backdrop {
+  position: fixed;
+  z-index: 10001;
+  inset: 0;
+  display: grid;
+  place-items: center;
+  background: rgba(0, 0, 0, 0.66);
+  backdrop-filter: blur(3px);
+}
+
+.admin-panel-dialog {
+  width: min(420px, 90vw);
+  display: grid;
+  grid-template-columns: 38px 1fr;
+  gap: 12px;
+  padding: 16px;
+  border: 1px solid var(--admin-border-strong);
+  border-radius: 8px;
+  background: #121412;
+  box-shadow: 0 25px 75px rgba(0, 0, 0, 0.65);
+}
+
+.admin-panel-dialog__icon {
+  width: 36px;
+  height: 36px;
+  display: grid;
+  place-items: center;
+  border-radius: 7px;
+  color: var(--admin-green);
+  background: var(--admin-green-soft);
+}
+
+.admin-panel-dialog__icon.is-warning {
+  color: #e0ad5f;
+  background: rgba(224, 173, 95, 0.12);
+}
+
+.admin-panel-dialog h2 {
+  margin-bottom: 5px;
+  font-size: 14px;
+}
+
+.admin-panel-dialog__actions {
+  grid-column: 1 / -1;
+  justify-content: flex-end;
+  gap: 7px;
+  margin-top: 5px;
+}
+
+.admin-panel-action-input {
+  grid-column: 1 / -1;
+  display: grid;
+  gap: 6px;
+}
+
+.admin-panel-action-input span {
+  color: var(--admin-muted);
+  font-size: 9px;
+}
+
+.admin-panel-action-input input {
+  width: 100%;
+  height: 44px;
+  padding: 0 11px;
+  border: 1px solid var(--admin-border-strong);
+  border-radius: 5px;
+  outline: 0;
+  color: var(--admin-text);
+  background: #1a1c1a;
+  font: inherit;
+  font-size: 10px;
+}
+
+.admin-panel-action-input input:focus {
+  border-color: color-mix(in srgb, var(--admin-green) 45%, transparent);
+}
+
+.admin-panel-dialog__actions button {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  padding: 7px 10px;
+  border: 1px solid var(--admin-border-strong);
+  border-radius: 5px;
+  color: #c6cbc6;
+  background: #202320;
+  font-size: 9px;
+  cursor: pointer;
+}
+
+.admin-panel-overlay button:focus-visible,
+.admin-panel-overlay input:focus-visible {
+  outline: 2px solid var(--admin-green);
+  outline-offset: 2px;
+}
+
+.admin-panel-overlay .admin-panel-rail button:focus-visible {
+  outline: 0;
+  box-shadow: inset 0 0 0 1px rgba(255, 255, 255, 0.13);
+}
+
+.admin-panel-dialog__actions button.is-primary {
+  border-color: color-mix(in srgb, var(--admin-green) 30%, transparent);
+  color: #d9eed7;
+  background: var(--admin-green-soft);
+}
+
+.admin-panel-dialog__actions button.is-danger {
+  border-color: rgba(239, 105, 105, 0.3);
+  color: #efaaaa;
+  background: rgba(239, 105, 105, 0.1);
+}
+
+.is-spinning {
+  animation: admin-spin 800ms linear infinite;
+}
+
+.admin-toast-enter-active,
+.admin-toast-leave-active {
+  transition:
+    opacity 160ms ease,
+    transform 160ms ease;
+}
+
+.admin-toast-enter-from,
+.admin-toast-leave-to {
+  opacity: 0;
+  transform: translateY(8px);
+}
+
+@keyframes admin-spin {
+  to {
+    transform: rotate(360deg);
+  }
+}
+
+@media (max-width: 1100px) {
+  .admin-panel-window {
+    width: 97vw;
+    height: 94vh;
+  }
+
+  .admin-panel-body {
+    grid-template-columns: 50px 250px minmax(0, 1fr);
+  }
+
+  .admin-panel-header {
+    grid-template-columns: 225px 1fr auto;
+  }
+
+  .admin-panel-stat-grid,
+  .admin-panel-app-grid {
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+  }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .admin-panel-overlay *,
+  .admin-panel-overlay *::before,
+  .admin-panel-overlay *::after {
+    animation-duration: 0.01ms !important;
+    transition-duration: 0.01ms !important;
+  }
+}
+</style>
diff --git a/frontend/src/components/AppIcon.vue b/frontend/src/components/AppIcon.vue
index d3b447c..4a2fd29 100644
--- a/frontend/src/components/AppIcon.vue
+++ b/frontend/src/components/AppIcon.vue
@@ -328,7 +328,10 @@ onBeforeUnmount(() => {
           class="app-icon"
           :class="[
             app.iconClass,
-            { 'app-icon--image': !iconFailed && app.id !== 'calendar' },
+            {
+              'app-icon--image':
+                !iconFailed && Boolean(app.iconImage) && app.id !== 'calendar',
+            },
           ]"
           :style="iconStyle"
         >
@@ -337,7 +340,7 @@ onBeforeUnmount(() => {
             <b>{{ calendarDay }}</b>
           </span>
           <img
-            v-else-if="!iconFailed"
+            v-else-if="!iconFailed && app.iconImage"
             :src="app.iconImage"
             alt=""
             draggable="false"
diff --git a/frontend/src/config/apps.ts b/frontend/src/config/apps.ts
index 0cda34d..40709e5 100644
--- a/frontend/src/config/apps.ts
+++ b/frontend/src/config/apps.ts
@@ -748,6 +748,7 @@ export function getPhoneAppLabel(
 }
 
 export function isPhoneAppRemovable(app: PhoneAppDefinition): boolean {
+  if (app.adminOnly) return false
   return app.kind === 'external'
     ? app.removable && !app.defaultInstalled
     : !DEFAULT_INSTALLED_PHONE_APP_IDS.has(app.id) &&
diff --git a/frontend/src/directives/configInputWidth.ts b/frontend/src/directives/configInputWidth.ts
new file mode 100644
index 0000000..18d14db
--- /dev/null
+++ b/frontend/src/directives/configInputWidth.ts
@@ -0,0 +1,26 @@
+import type { Directive } from 'vue'
+
+const inputListeners = new WeakMap<HTMLInputElement, () => void>()
+const MINIMUM_INPUT_WIDTH = 42
+
+function syncInputWidth(input: HTMLInputElement): void {
+  input.style.width = '1px'
+  input.style.width = `${Math.max(MINIMUM_INPUT_WIDTH, Math.ceil(input.scrollWidth) + 2)}px`
+}
+
+export const vConfigInputWidth: Directive<HTMLInputElement> = {
+  mounted(input) {
+    const listener = () => syncInputWidth(input)
+    inputListeners.set(input, listener)
+    input.addEventListener('input', listener)
+    syncInputWidth(input)
+  },
+  updated(input) {
+    syncInputWidth(input)
+  },
+  beforeUnmount(input) {
+    const listener = inputListeners.get(input)
+    if (listener) input.removeEventListener('input', listener)
+    inputListeners.delete(input)
+  },
+}
diff --git a/frontend/src/phoneInventory.contract.test.ts b/frontend/src/phoneInventory.contract.test.ts
index 9af37bd..4a1114b 100644
--- a/frontend/src/phoneInventory.contract.test.ts
+++ b/frontend/src/phoneInventory.contract.test.ts
@@ -34,9 +34,12 @@ describe('phone inventory contracts', () => {
     const phoneServer = readResourceFile('source/server/phone.lua')
 
     expect(phoneServer).toContain(
-      'Bridge.Inventory.RegisterUsableItem(Config.Phone.Item, open_phone)',
+      'Bridge.Inventory.RegisterUsableItem(item_name, function(...)',
+    )
+    expect(phoneServer).toContain('if Config.Phone.Item == item_name then')
+    expect(phoneServer).toContain(
+      'if not Bridge.Inventory.RegisterUsableItem(item_name, function(...)',
     )
-    expect(phoneServer).toContain('if not usable_registered then')
   })
 
   it('auto-detects HEX and limits count-based ESX inventories to metadata-free modes', () => {
@@ -221,8 +224,12 @@ describe('phone inventory contracts', () => {
     const phoneServer = readResourceFile('source/server/phone.lua')
 
     expect(config).toContain('Keybind = "F1"')
+    expect(phoneClient).toContain('refresh_phone_key_mapping = function()')
     expect(phoneClient).toContain(
-      'RegisterKeyMapping("sky_phone_toggle", locale.Controls.OpenPhone, "keyboard", Config.Phone.Keybind)',
+      'RegisterKeyMapping(command_name, locale.Controls.OpenPhone, "keyboard", key_name)',
+    )
+    expect(phoneClient).toContain(
+      'if active_key_mapping_command == command_name then',
     )
     expect(phoneClient).toContain(
       'Bridge.Callbacks.Trigger("sky_phone:device:open-request", {})',
@@ -232,6 +239,26 @@ describe('phone inventory contracts', () => {
     )
   })
 
+  it('applies development command changes immediately without a resource restart', () => {
+    const phoneClient = readResourceFile('source/client/main.lua')
+
+    expect(phoneClient).toContain('local active_development_command = nil')
+    expect(phoneClient).toContain('refresh_development_command = function()')
+    expect(phoneClient).toContain(
+      'local command_name = Config.Phone.DevelopmentCommand and Config.Command or nil',
+    )
+    expect(phoneClient).toContain('RegisterCommand(command_name, function()')
+    expect(phoneClient).toContain(
+      'if active_development_command == command_name and Config.Phone.DevelopmentCommand then',
+    )
+    expect(phoneClient).toContain(
+      'TriggerEvent("chat:removeSuggestion", "/" .. active_development_command)',
+    )
+    expect(phoneClient).toMatch(
+      /AddEventHandler\("sky_phone:configurator:updated", function\(\)[\s\S]*?refresh_development_command\(\)/,
+    )
+  })
+
   it('opens a running live activity with Space without affecting normal gameplay', () => {
     const phoneClient = readResourceFile('source/client/main.lua')
 
@@ -262,7 +289,7 @@ describe('phone inventory contracts', () => {
     const phoneServer = readResourceFile('source/server/phone.lua')
     const migration = readResourceFile('source/server/db_migrate.lua')
 
-    expect(phoneServer).toContain('if not unique_phones then')
+    expect(phoneServer).toContain('if Config.Phone.Unique == false then')
     expect(phoneServer).toContain('return map_character_device(source, slot)')
     expect(phoneServer).toContain('FROM `sky_phone_character_devices`')
     expect(phoneServer).toContain('WHERE `owner_identifier` = ?')
diff --git a/frontend/src/phoneNavigation.contract.test.ts b/frontend/src/phoneNavigation.contract.test.ts
index 973eb17..2f5d743 100644
--- a/frontend/src/phoneNavigation.contract.test.ts
+++ b/frontend/src/phoneNavigation.contract.test.ts
@@ -29,4 +29,10 @@ describe('neutral phone navigation contract', () => {
     expect(navigationSource).toContain('if not installed_apps[normalized_app_id] then')
     expect(navigationSource).toContain('if current_app_id ~= normalized_app_id then')
   })
+
+  it('defers command-driven app routes until setup or device unlock completes', () => {
+    expect(appSource).toContain('if (setupRequired.value || isLocked.value)')
+    expect(appSource).toContain('pendingUnlockRoute.value = requestedRoute')
+    expect(appSource).toContain("void router.replace(requestedRoute ?? '/')")
+  })
 })
diff --git a/frontend/src/stores/admin.ts b/frontend/src/stores/admin.ts
new file mode 100644
index 0000000..14627b0
--- /dev/null
+++ b/frontend/src/stores/admin.ts
@@ -0,0 +1,238 @@
+import { defineStore } from 'pinia'
+
+import type {
+  AdminAuditEntry,
+  AdminActivityResponse,
+  AdminBootstrap,
+  AdminCallActivity,
+  AdminConfigurator,
+  AdminConfiguratorChange,
+  AdminCredential,
+  AdminMessageActivity,
+  AdminPlayerDetail,
+  AdminPlayerSummary,
+  AdminStats,
+} from '@/types/admin'
+import { nuiCall, type NuiResponse } from '@/utils/nui'
+
+const EMPTY_STATS: AdminStats = { accounts: 0, devices: 0, online: 0 }
+
+export const useAdminStore = defineStore('admin', {
+  state: () => ({
+    actionKey: '',
+    activityKey: '',
+    audit: [] as AdminAuditEntry[],
+    configurator: null as AdminConfigurator | null,
+    configuratorLoading: false,
+    detailLoading: false,
+    error: '',
+    initialized: false,
+    loading: false,
+    players: [] as AdminPlayerSummary[],
+    revealedCredentials: {} as Record<string, AdminCredential>,
+    deviceActivity: {} as Record<
+      string,
+      { calls?: AdminCallActivity[]; messages?: AdminMessageActivity[] }
+    >,
+    selectedPlayer: null as AdminPlayerDetail | null,
+    stats: { ...EMPTY_STATS },
+  }),
+  actions: {
+    async load(): Promise<boolean> {
+      this.loading = true
+      const response = await nuiCall<AdminBootstrap>('admin:bootstrap')
+      this.loading = false
+      if (!response.success || !response.data) {
+        this.error = response.error ?? 'request_failed'
+        return false
+      }
+      this.players = response.data.players
+      this.stats = response.data.stats
+      this.audit = response.data.audit
+      this.error = ''
+      this.initialized = true
+      return true
+    },
+    async openPlayer(source: number): Promise<boolean> {
+      this.detailLoading = true
+      this.revealedCredentials = {}
+      const response = await nuiCall<AdminPlayerDetail>('admin:player', {
+        source,
+      })
+      this.detailLoading = false
+      if (!response.success || !response.data) {
+        this.error = response.error ?? 'request_failed'
+        return false
+      }
+      this.selectedPlayer = response.data
+      this.error = ''
+      return true
+    },
+    closePlayer(): void {
+      this.selectedPlayer = null
+      this.revealedCredentials = {}
+    },
+    async saveApps(
+      source: number,
+      imei: string,
+      revision: number,
+      changes: Array<{ appId: string; installed: boolean }>,
+    ): Promise<NuiResponse<AdminPlayerDetail>> {
+      this.actionKey = `${imei}:save`
+      const response = await nuiCall<AdminPlayerDetail>('admin:save-apps', {
+        changes,
+        imei,
+        revision,
+        source,
+      })
+      this.actionKey = ''
+      if (response.success && response.data) {
+        this.selectedPlayer = response.data
+        this.error = ''
+      } else {
+        this.error = response.error ?? 'request_failed'
+      }
+      return response
+    },
+    async revealPassword(
+      source: number,
+      imei: string,
+    ): Promise<NuiResponse<AdminCredential>> {
+      this.actionKey = `${imei}:password`
+      const response = await nuiCall<AdminCredential>('admin:reveal-password', {
+        imei,
+        source,
+      })
+      this.actionKey = ''
+      if (response.success && response.data) {
+        this.revealedCredentials[imei] = response.data
+        this.error = ''
+      } else {
+        this.error = response.error ?? 'request_failed'
+      }
+      return response
+    },
+    async loadActivity(
+      source: number,
+      imei: string,
+      kind: 'messages' | 'calls',
+    ): Promise<boolean> {
+      this.activityKey = `${imei}:${kind}`
+      const response = await nuiCall<AdminActivityResponse>('admin:activity', {
+        imei,
+        kind,
+        source,
+      })
+      this.activityKey = ''
+      if (!response.success || !response.data) {
+        this.error = response.error ?? 'request_failed'
+        return false
+      }
+      const activity = this.deviceActivity[imei] ?? {}
+      if (response.data.kind === 'messages') {
+        activity.messages = response.data.entries
+      } else {
+        activity.calls = response.data.entries
+      }
+      this.deviceActivity[imei] = activity
+      this.error = ''
+      return true
+    },
+    async loadConfigurator(): Promise<boolean> {
+      this.configuratorLoading = true
+      const response = await nuiCall<AdminConfigurator>('admin:configurator')
+      this.configuratorLoading = false
+      if (!response.success || !response.data) {
+        this.error = response.error ?? 'request_failed'
+        return false
+      }
+      this.configurator = response.data
+      this.error = ''
+      return true
+    },
+    async saveConfigurator(
+      changes: AdminConfiguratorChange[],
+    ): Promise<NuiResponse<AdminConfigurator>> {
+      const current = this.configurator
+      if (!current) return { error: 'request_failed', success: false }
+
+      this.actionKey = 'configurator:save'
+      const response = await nuiCall<AdminConfigurator>(
+        'admin:save-configurator',
+        {
+          changes,
+          revision: current.revision,
+        },
+      )
+      this.actionKey = ''
+      if (response.success && response.data) {
+        this.configurator = response.data
+        this.error = ''
+      } else {
+        if (response.data) this.configurator = response.data
+        this.error = response.error ?? 'request_failed'
+      }
+      return response
+    },
+    async resetPasscode(
+      source: number,
+      imei: string,
+    ): Promise<NuiResponse<AdminPlayerDetail>> {
+      this.actionKey = `${imei}:reset-passcode`
+      const response = await nuiCall<AdminPlayerDetail>(
+        'admin:reset-passcode',
+        { imei, source },
+      )
+      this.actionKey = ''
+      if (response.success && response.data) {
+        this.selectedPlayer = response.data
+        delete this.revealedCredentials[imei]
+        this.error = ''
+      } else {
+        this.error = response.error ?? 'request_failed'
+      }
+      return response
+    },
+    async changeNumber(
+      source: number,
+      imei: string,
+      phoneNumber: string,
+    ): Promise<NuiResponse<AdminPlayerDetail>> {
+      this.actionKey = `${imei}:change-number`
+      const response = await nuiCall<AdminPlayerDetail>('admin:change-number', {
+        imei,
+        phoneNumber,
+        source,
+      })
+      this.actionKey = ''
+      if (response.success && response.data) {
+        this.selectedPlayer = response.data
+        delete this.deviceActivity[imei]
+        this.error = ''
+      } else {
+        this.error = response.error ?? 'request_failed'
+      }
+      return response
+    },
+    async factoryReset(
+      source: number,
+      imei: string,
+    ): Promise<NuiResponse<AdminPlayerDetail>> {
+      this.actionKey = `${imei}:factory-reset`
+      const response = await nuiCall<AdminPlayerDetail>('admin:factory-reset', {
+        imei,
+        source,
+      })
+      this.actionKey = ''
+      if (response.success && response.data) {
+        this.selectedPlayer = response.data
+        delete this.deviceActivity[imei]
+        delete this.revealedCredentials[imei]
+        this.error = ''
+      } else {
+        this.error = response.error ?? 'request_failed'
+      }
+      return response
+    },
+  },
+})
diff --git a/frontend/src/stores/app-store.test.ts b/frontend/src/stores/app-store.test.ts
index 47c414f..649eaf3 100644
--- a/frontend/src/stores/app-store.test.ts
+++ b/frontend/src/stores/app-store.test.ts
@@ -75,6 +75,13 @@ describe('app store', () => {
     }
   })
 
+  it('drops the retired admin app from persisted phone layouts', () => {
+    const apps = useAppStoreStore()
+
+    apps.hydrate({ claimedApps: ['admin'] })
+    expect(apps.homeLayout.grid).not.toContain('admin')
+  })
+
   it('migrates current layouts so dock apps are not repeated in the grid', () => {
     const apps = useAppStoreStore()
 
diff --git a/frontend/src/stores/app-store.ts b/frontend/src/stores/app-store.ts
index 990799d..892b223 100644
--- a/frontend/src/stores/app-store.ts
+++ b/frontend/src/stores/app-store.ts
@@ -58,11 +58,12 @@ function getDefaultDockIds(): LaunchablePhoneAppId[] {
 }
 
 function getDefaultInstalledIds(): LaunchablePhoneAppId[] {
-  return PHONE_APPS.filter((app) =>
-    isExternalPhoneApp(app)
+  return PHONE_APPS.filter((app) => {
+    if (app.adminOnly) return false
+    return isExternalPhoneApp(app)
       ? app.defaultInstalled
-      : DEFAULT_INSTALLED_PHONE_APP_IDS.has(app.id),
-  ).map((app) => app.id)
+      : DEFAULT_INSTALLED_PHONE_APP_IDS.has(app.id)
+  }).map((app) => app.id)
 }
 
 function isProtectedHomeApp(appId: LaunchablePhoneAppId): boolean {
@@ -237,13 +238,15 @@ export const useAppStoreStore = defineStore('app-store', {
         layoutVersion === 5 ||
         layoutVersion === 6
       this.claimedApps = Array.isArray(data?.claimedApps)
-        ? data.claimedApps.filter(
-            (id): id is LaunchablePhoneAppId =>
-              typeof id === 'string' &&
-              (isPhoneAppId(id) ||
-                (supportsPersistedExternalApps &&
-                  isValidExternalPhoneAppId(id))),
-          )
+        ? data.claimedApps.filter((id): id is LaunchablePhoneAppId => {
+            if (typeof id !== 'string') return false
+            const app = getPhoneApp(id)
+            if (app?.adminOnly) return false
+            return (
+              isPhoneAppId(id) ||
+              (supportsPersistedExternalApps && isValidExternalPhoneAppId(id))
+            )
+          })
         : []
       this.uninstalledApps = Array.isArray(data?.uninstalledApps)
         ? data.uninstalledApps.filter((id): id is LaunchablePhoneAppId => {
@@ -308,9 +311,10 @@ export const useAppStoreStore = defineStore('app-store', {
       }
     },
     isInstalled(appId: LaunchablePhoneAppId): boolean {
+      const app = getPhoneApp(appId)
+      if (app?.adminOnly) return false
       if (this.uninstalledApps.includes(appId)) return false
       if (this.claimedApps.includes(appId)) return true
-      const app = getPhoneApp(appId)
       if (!app) return false
       return isExternalPhoneApp(app)
         ? app.defaultInstalled
diff --git a/frontend/src/stores/phone-locale-contract.test.ts b/frontend/src/stores/phone-locale-contract.test.ts
index e42c6cb..03e6a40 100644
--- a/frontend/src/stores/phone-locale-contract.test.ts
+++ b/frontend/src/stores/phone-locale-contract.test.ts
@@ -118,6 +118,29 @@ function collectLuaLocaleValues(source: string): Map<string, string> {
   }
 
   parseTable([])
+  while (position < tokens.length) {
+    const assignment = tokens.findIndex(
+      (token, index) => index >= position && token.kind === '=',
+    )
+    if (assignment < 0) break
+    const nui = tokens.findIndex(
+      (token, index) =>
+        index >= position && index < assignment && token.value === 'Nui',
+    )
+    if (nui < 0) {
+      position = assignment + 1
+      continue
+    }
+    const path = [
+      'Nui',
+      ...tokens
+        .slice(nui + 1, assignment)
+        .filter((token) => token.kind === 'word')
+        .map((token) => token.value),
+    ]
+    position = assignment + 1
+    parseValue(path)
+  }
   return values
 }
 
diff --git a/frontend/src/stores/phone.ts b/frontend/src/stores/phone.ts
index cfd7334..b11094f 100644
--- a/frontend/src/stores/phone.ts
+++ b/frontend/src/stores/phone.ts
@@ -807,7 +807,404 @@ const citywarnFallbackLocales = {
   },
 }
 
+const adminPanelFallbackLocales = {
+  name: 'Phone Admin',
+  subtitle: 'Administration',
+  navigation: 'Admin navigation',
+  refresh: 'Refresh admin data',
+  loading: 'Loading protected data...',
+  tabs: {
+    overview: 'Overview',
+    players: 'Players',
+    devices: 'Devices',
+    apps: 'Apps',
+    accounts: 'Accounts',
+    messages: 'Messages',
+    calls: 'Calls',
+    moderation: 'Moderation',
+    audit: 'Audit',
+    configurator: 'Phone configurator',
+  },
+  overview: {
+    eyebrow: 'Server',
+    title: 'Dashboard',
+    body: 'Players, devices, apps, and phone data.',
+    stats: 'Server phone statistics',
+    online: 'Online',
+    devices: 'Devices',
+    accounts: 'Accounts',
+    audit: 'Audit entries',
+    control: 'Navigation',
+    features: 'Modules',
+    featuresBody: 'Open an administration module.',
+    recent: 'Recent activity',
+    playerFeature: 'Identity, finances, job, and duty',
+    deviceFeature: 'IMEI, SIM, number, and activity',
+    appFeature: 'Install or remove phone apps',
+    accountFeature: 'Account access and protected credentials',
+    messageFeature: 'Review recent SMS activity',
+    callFeature: 'Review recent call activity',
+    moderationFeature: 'Reset access, number, or device data',
+    auditFeature: 'Review sensitive admin actions',
+    configuratorFeature: 'Manage config.lua and media.lua through SQL',
+  },
+  appearance: {
+    eyebrow: 'Appearance',
+    title: 'Interface',
+    body: 'Personalize colors and typography across the admin workspace.',
+    colors: {
+      emerald: 'Emerald',
+      blue: 'Blue',
+      violet: 'Violet',
+      orange: 'Orange',
+      red: 'Red',
+    },
+    controls: {
+      customColor: 'Custom color',
+      customColorBody: 'Choose any RGB accent or enter its channel values.',
+      red: 'R',
+      green: 'G',
+      blue: 'B',
+      hex: 'HEX color',
+      value: 'value',
+      fontFamily: 'Font family',
+      fontFamilyBody: 'Choose the typeface used by the complete admin panel.',
+      fontSize: 'Font size',
+      fontSizeBody: 'Scale text and controls for comfortable readability.',
+      fonts: {
+        inter: 'Inter',
+        system: 'System',
+        classic: 'Classic',
+        verdana: 'Verdana',
+        tahoma: 'Tahoma',
+        trebuchet: 'Trebuchet',
+        georgia: 'Georgia',
+        mono: 'Monospace',
+      },
+    },
+  },
+  configurator: {
+    context: 'Runtime configuration',
+    eyebrow: 'System tool',
+    sections: 'Configuration',
+    search: 'Search settings or paths',
+    configScope: 'config.lua',
+    mediaScope: 'media.lua',
+    noResults: 'No matching settings',
+    loading: 'Loading SQL configuration...',
+    title: 'Phone configurator',
+    body: 'Manage phone and media settings from the protected admin workspace.',
+    disabledTitle: 'SQL configuration is not active',
+    disabledBody:
+      'Enable the configurator at the beginning of config.lua and restart sky_phone. Until then, file values remain active and editing is locked.',
+    manualSave: 'Manual save',
+    refreshNotice:
+      'Nothing is written automatically. The green check verifies config.lua and media.lua in SQL and refreshes the active server, client, media and UI configuration immediately.',
+    fieldCount: '{count} fields',
+    secretConfigured: 'Secret configured · enter a replacement',
+    invalidValue: 'Check the highlighted table or number value.',
+    saved: 'SQL configuration saved and applied.',
+    descriptions: {
+      featureToggle: 'Turns {name} on or off.',
+      boolean: 'Controls whether {name} is allowed.',
+      number: 'Sets the numeric value for {name}.',
+      text: 'Sets the text value used for {name}.',
+      optionalText:
+        'Sets the optional value for {name}; switch it off to disable it.',
+      list: 'Manages all entries used for {name}.',
+      table: 'Groups the related settings for {name}.',
+      credential: 'Stores the protected credential used by {name}.',
+      url: 'Sets the URL or endpoint used by {name}.',
+      hosts: 'Defines which domains are allowed for {name}.',
+      milliseconds: 'Sets the timing for {name} in milliseconds.',
+      seconds: 'Sets the timing for {name} in seconds.',
+      rateLimit: 'Limits how many {name} actions are allowed per minute.',
+      byteLimit: 'Sets the maximum data size allowed for {name}.',
+      textLimit: 'Sets the maximum text length allowed for {name}.',
+      distance: 'Sets the world distance used for {name}.',
+      coordinates: 'Sets the world coordinates or orientation for {name}.',
+      gameAsset: 'Sets the GTA model or prop used for {name}.',
+      animation: 'Sets the animation asset used for {name}.',
+      access: 'Defines the jobs, groups or permission level for {name}.',
+      integration: 'Selects the connected framework or provider for {name}.',
+      path: 'Sets the storage or resource path used for {name}.',
+      color: 'Sets the interface color used for {name}.',
+      displayText: 'Sets the text shown to players for {name}.',
+      phoneNumber: 'Sets the phone or service number used for {name}.',
+      routing: 'Controls how incoming requests are routed for {name}.',
+      command: 'Sets the chat command used to open or run {name}.',
+      locale: 'Selects the language used for {name}.',
+      debug: 'Controls detailed diagnostic output for {name}.',
+      mediaQuality: 'Sets the media quality or volume used for {name}.',
+      amount: 'Sets the maximum or displayed amount for {name}.',
+    },
+    table: {
+      list: 'List',
+      table: 'Key table',
+      vector: 'Vector',
+      entry: 'Entry',
+      general: 'General',
+      subtabs: {
+        AdminGroups: 'Admin Groups',
+        Dictionaries: 'Dictionaries',
+        Clips: 'Clips',
+        Transforms: 'Transforms',
+        RateLimits: 'Rate Limits',
+        Publishers: 'Publishers',
+        ExternalPingResources: 'External Ping Resources',
+        Markets: 'Markets',
+        TrustedAdapters: 'Trusted Adapters',
+        AllowedDisappearTimers: 'Allowed Disappear Timers',
+        MusicTracks: 'Music Tracks',
+        VehicleImages: 'Vehicle Images',
+        Custom: 'Custom',
+        Valet: 'Valet',
+        AutoPriority: 'Automatic Priority',
+        Camera: 'Camera',
+        Categories: 'Categories',
+        Districts: 'Districts',
+        PhotoGradients: 'Photo Gradients',
+        LbPhone: 'LB Phone',
+        Tracks: 'Tracks',
+        Props: 'Props',
+        CustomLocations: 'Custom Locations',
+        Animation: 'Animation',
+        ReportReasons: 'Report Reasons',
+        DisplayName: 'Display Name',
+        Hud: 'HUD',
+        Badge: 'Badge',
+        LockedChannels: 'Locked Channels',
+        NumberGroups: 'Number Groups',
+        CustomFare: 'Custom Fare',
+        DriverJobs: 'Driver Jobs',
+        Services: 'Services',
+        QuickLocations: 'Quick Locations',
+        AllowedJobs: 'Allowed Jobs',
+        Websites: 'Websites',
+      },
+      addRow: 'Add row',
+      addField: 'Add field',
+      remove: 'Remove',
+      emptyList: 'No rows yet. Add the first row with plus.',
+      emptyTable: 'No fields yet. Add the first key below.',
+      keyPlaceholder: 'New key',
+      convertToList: 'Use list',
+      convertToMap: 'Use typed key table',
+      convertToTable: 'Use key table',
+      types: {
+        string: 'Text',
+        number: 'Number',
+        boolean: 'Switch',
+        list: 'List',
+        table: 'Table',
+      },
+    },
+  },
+  players: {
+    eyebrow: 'Active sessions',
+    title: 'Online players',
+    online: 'Online now',
+    empty: 'No players found',
+    emptyBody: 'Adjust the search or refresh the live player list.',
+  },
+  search: {
+    players: 'Search name, ID, job, or number',
+    apps: 'Search apps',
+    clear: 'Clear search',
+  },
+  detail: {
+    character: 'Character profile',
+    data: 'Player data overview',
+    cash: 'Cash',
+    bank: 'Bank',
+    job: 'Job',
+    duty: 'Duty',
+    onDuty: 'On duty',
+    offDuty: 'Off duty',
+    identity: 'Identity',
+    playerData: 'Player data',
+    identifier: 'Character identifier',
+    birthdate: 'Birthdate',
+    grade: 'Job grade',
+    unknown: 'Unknown',
+  },
+  devices: {
+    eyebrow: 'Device control',
+    title: 'Phones',
+    body: 'Inspect every phone assigned to the selected player.',
+    choose: 'Choose phone',
+    empty: 'No phone found',
+    emptyBody: 'This player currently has no phone device that can be managed.',
+    noNumber: 'No phone number',
+    noSim: 'No SIM',
+    imei: 'IMEI',
+    updated: 'Last activity',
+    apps: 'Claimed apps',
+    account: 'Linked account',
+  },
+  credentials: {
+    eyebrow: 'Protected data',
+    title: 'Credentials',
+    email: 'iFruit email',
+    password: 'iFruit password',
+    reveal: 'Reveal',
+    copy: 'Copy password',
+    copied: 'Password copied.',
+    noAccount: 'No iFruit account is linked to this phone.',
+    passcode: 'Device passcode',
+    passcodeHashed: '{length}-digit PIN · securely hashed and not recoverable',
+    passcodeDisabled: 'No passcode configured',
+    revealTitle: 'Reveal protected password?',
+    revealBody:
+      'This action is server-authorized, rate-limited, and written to the admin audit log.',
+    cancel: 'Cancel',
+    confirmReveal: 'Reveal password',
+  },
+  apps: {
+    eyebrow: 'Remote management',
+    title: 'App access',
+    description:
+      'Stage app access for this device. Nothing changes until you save.',
+    installed: 'Installed',
+    available: 'Available',
+    protected: 'System app',
+    changes: '{count} pending changes',
+  },
+  activity: {
+    protected: 'Protected activity',
+    messagesTitle: 'Messages',
+    messagesBody: 'Recent SMS activity for the selected SIM.',
+    callsTitle: 'Calls',
+    callsBody: 'Recent call activity for the selected SIM.',
+    loading: 'Loading activity...',
+    incoming: 'Incoming',
+    outgoing: 'Outgoing',
+    mediaMessage: '{type} message',
+    noMessages: 'No message activity found.',
+    noCalls: 'No call activity found.',
+    status: {
+      completed: 'Completed',
+      missed: 'Missed',
+      rejected: 'Rejected',
+      busy: 'Busy',
+      unanswered: 'Unanswered',
+      cancelled: 'Cancelled',
+      failed: 'Failed',
+      ringing: 'Ringing',
+    },
+  },
+  moderation: {
+    eyebrow: 'Device administration',
+    title: 'Moderation actions',
+    body: 'Every action is server-authorized, rate-limited, and audited.',
+    resetPasscode: 'Reset passcode',
+    resetPasscodeBody: 'Remove the device PIN and clear failed attempts.',
+    changeNumber: 'Change number',
+    changeNumberBody: 'Assign a new unique number to the current SIM.',
+    factoryReset: 'Factory reset',
+    factoryResetBody: 'Clear local device data and disconnect the account.',
+    saveFirst: 'Save or discard pending app changes first.',
+    phoneNumber: 'New phone number',
+    phoneNumberPlaceholder: 'Enter the full configured number',
+    typeToConfirm: 'Type {word} to confirm the factory reset.',
+    confirmWord: 'RESET',
+    cancel: 'Cancel',
+    'reset-passcodeSuccess': 'Passcode reset.',
+    'change-numberSuccess': 'Phone number changed.',
+    'factory-resetSuccess': 'Phone factory reset completed.',
+    dialogs: {
+      'reset-passcodeTitle': 'Reset device passcode?',
+      'reset-passcodeBody':
+        'The player can unlock this phone without the previous PIN afterward.',
+      'change-numberTitle': 'Change phone number?',
+      'change-numberBody':
+        'The new number must match the configured server number format and be unique.',
+      'factory-resetTitle': 'Factory reset this phone?',
+      'factory-resetBody':
+        'This clears local device data, app settings, security, and the linked account. This cannot be undone.',
+    },
+    confirm: {
+      'reset-passcode': 'Reset passcode',
+      'change-number': 'Change number',
+      'factory-reset': 'Factory reset',
+    },
+  },
+  editor: {
+    brand: 'SKY PHONE',
+    workspace: 'ADMIN',
+    players: 'Player directory',
+    audit: 'Audit log',
+    selectPlayer:
+      'Select a player to inspect identity, devices, credentials, and app access.',
+    save: 'Save changes',
+    saveHint: 'Apply pending changes',
+    saved: 'Changes saved.',
+    unsaved: 'Unsaved changes',
+    close: 'Close admin panel',
+    refresh: 'Refresh live data',
+    online: 'LIVE',
+    profile: 'PROFILE',
+    financial: 'FINANCIAL',
+    device: 'DEVICE',
+    security: 'SECURITY',
+    noAutoSave: 'Manual save',
+    noAutoSaveBody: 'Changes stay local until the green check is pressed.',
+    discardTitle: 'Discard unsaved changes?',
+    discardBody:
+      'Your staged app or configuration changes have not been saved.',
+    keepEditing: 'Keep editing',
+    discard: 'Discard changes',
+    saveFailed: 'Some changes could not be saved.',
+    noSelection: 'No player selected',
+  },
+  audit: {
+    eyebrow: 'Accountability',
+    title: 'Audit trail',
+    body: 'Sensitive reveals and remote app changes are recorded here.',
+    empty: 'No admin actions yet',
+    emptyBody: 'Protected actions will appear here after they are performed.',
+    by: '{actor} · target ID {target}',
+    actions: {
+      grant_app: 'App installed',
+      revoke_app: 'App removed',
+      reveal_account_password: 'Password revealed',
+      view_messages: 'Messages viewed',
+      view_calls: 'Calls viewed',
+      reset_passcode: 'Passcode reset',
+      change_number: 'Phone number changed',
+      factory_reset: 'Phone factory reset',
+      save_configuration: 'Configuration saved',
+    },
+  },
+  errors: {
+    not_authorized: 'You do not have access to the admin panel.',
+    rate_limited: 'Too many admin requests. Please wait.',
+    player_unavailable: 'That player is no longer online.',
+    device_not_owned: 'That phone no longer belongs to the selected player.',
+    invalid_app: 'That app is not registered on the server.',
+    app_protected: 'This system app cannot be removed.',
+    revision_conflict:
+      'The data changed in the meantime. Reopen the section and try again.',
+    configurator_disabled: 'Enable the phone configurator in config.lua first.',
+    invalid_field: 'That configuration field is no longer available.',
+    invalid_value: 'A configuration value is invalid.',
+    account_not_found: 'No iFruit account is linked to this phone.',
+    invalid_phone_number:
+      'Enter a phone number in the configured server format.',
+    phone_number_unchanged: 'This SIM already uses that phone number.',
+    phone_number_taken: 'That phone number is already assigned.',
+    no_sim: 'This phone has no SIM that can be changed.',
+    passcode_not_set: 'This phone has no passcode configured.',
+    device_not_found: 'This phone no longer exists.',
+    metadata_unsupported: 'The phone inventory metadata could not be updated.',
+    invalid_request: 'The admin request was invalid.',
+    request_failed: 'The admin request failed.',
+    default: 'The admin panel is temporarily unavailable.',
+  },
+}
+
 const defaultLocales: LocaleTree = {
+  AdminPanel: adminPanelFallbackLocales,
   Apps: {
     citywarn: citywarnFallbackLocales,
     crypto: cryptoFallbackLocales,
@@ -2434,46 +2831,190 @@ const defaultLocales: LocaleTree = {
         'neon-drop': 'Neon block-dropping puzzle',
       },
       previews: {
-        citywarn: { first: 'Live alerts', second: 'Safety zones', third: 'Incident updates' },
-        crypto: { first: 'Synthetic markets', second: 'Portfolio', third: 'Wallet transfers' },
-        health: { first: 'Activity rings', second: 'Medical ID', third: 'Health records' },
-        'weazel-news': { first: 'Top stories', second: 'Local reports', third: 'Breaking news' },
-        companies: { first: 'Business directory', second: 'Job requests', third: 'Services' },
-        music: { first: 'Now playing', second: 'Playlists', third: 'Music library' },
-        picstagram: { first: 'Photo feed', second: 'Stories', third: 'Profiles' },
-        feather: { first: 'Short posts', second: 'Following feed', third: 'Conversations' },
-        fliptok: { first: 'Video feed', second: 'Creator tools', third: 'Trends' },
-        flare: { first: 'Discover people', second: 'Matches', third: 'Live moments' },
-        calendar: { first: 'Upcoming events', second: 'Day planner', third: 'Reminders' },
-        radio: { first: 'Live channels', second: 'Team radio', third: 'Favorites' },
-        'local-pages': { first: 'Local pages', second: 'Reviews', third: 'City discovery' },
-        crewlink: { first: 'Crew roster', second: 'Shared locations', third: 'Coordination' },
-        phone: { first: 'Recent calls', second: 'Contacts', third: 'Voicemail' },
-        messages: { first: 'Conversations', second: 'Media sharing', third: 'Quick replies' },
-        darkchat: { first: 'Private chats', second: 'Secure groups', third: 'Invitations' },
-        garage: { first: 'Vehicle list', second: 'Parking locations', third: 'Valet' },
-        house: { first: 'Property access', second: 'Residents', third: 'Management' },
-        map: { first: 'Live navigation', second: 'Nearby places', third: 'Route guidance' },
-        skyride: { first: 'Ride booking', second: 'Driver tracking', third: 'Trip history' },
-        banking: { first: 'Account balance', second: 'Transfers', third: 'Transactions' },
-        billing: { first: 'Open invoices', second: 'Payment requests', third: 'Payment history' },
+        citywarn: {
+          first: 'Live alerts',
+          second: 'Safety zones',
+          third: 'Incident updates',
+        },
+        crypto: {
+          first: 'Synthetic markets',
+          second: 'Portfolio',
+          third: 'Wallet transfers',
+        },
+        health: {
+          first: 'Activity rings',
+          second: 'Medical ID',
+          third: 'Health records',
+        },
+        'weazel-news': {
+          first: 'Top stories',
+          second: 'Local reports',
+          third: 'Breaking news',
+        },
+        companies: {
+          first: 'Business directory',
+          second: 'Job requests',
+          third: 'Services',
+        },
+        music: {
+          first: 'Now playing',
+          second: 'Playlists',
+          third: 'Music library',
+        },
+        picstagram: {
+          first: 'Photo feed',
+          second: 'Stories',
+          third: 'Profiles',
+        },
+        feather: {
+          first: 'Short posts',
+          second: 'Following feed',
+          third: 'Conversations',
+        },
+        fliptok: {
+          first: 'Video feed',
+          second: 'Creator tools',
+          third: 'Trends',
+        },
+        flare: {
+          first: 'Discover people',
+          second: 'Matches',
+          third: 'Live moments',
+        },
+        calendar: {
+          first: 'Upcoming events',
+          second: 'Day planner',
+          third: 'Reminders',
+        },
+        radio: {
+          first: 'Live channels',
+          second: 'Team radio',
+          third: 'Favorites',
+        },
+        'local-pages': {
+          first: 'Local pages',
+          second: 'Reviews',
+          third: 'City discovery',
+        },
+        crewlink: {
+          first: 'Crew roster',
+          second: 'Shared locations',
+          third: 'Coordination',
+        },
+        phone: {
+          first: 'Recent calls',
+          second: 'Contacts',
+          third: 'Voicemail',
+        },
+        messages: {
+          first: 'Conversations',
+          second: 'Media sharing',
+          third: 'Quick replies',
+        },
+        darkchat: {
+          first: 'Private chats',
+          second: 'Secure groups',
+          third: 'Invitations',
+        },
+        garage: {
+          first: 'Vehicle list',
+          second: 'Parking locations',
+          third: 'Valet',
+        },
+        house: {
+          first: 'Property access',
+          second: 'Residents',
+          third: 'Management',
+        },
+        map: {
+          first: 'Live navigation',
+          second: 'Nearby places',
+          third: 'Route guidance',
+        },
+        skyride: {
+          first: 'Ride booking',
+          second: 'Driver tracking',
+          third: 'Trip history',
+        },
+        banking: {
+          first: 'Account balance',
+          second: 'Transfers',
+          third: 'Transactions',
+        },
+        billing: {
+          first: 'Open invoices',
+          second: 'Payment requests',
+          third: 'Payment history',
+        },
         mail: { first: 'Inbox', second: 'Attachments', third: 'Mailboxes' },
         notes: { first: 'Notes', second: 'Checklists', third: 'Pinned ideas' },
-        memos: { first: 'Voice recordings', second: 'Playback', third: 'Favorites' },
-        calculator: { first: 'Basic calculation', second: 'Scientific tools', third: 'History' },
-        camera: { first: 'Photo mode', second: 'Video capture', third: 'Zoom controls' },
+        memos: {
+          first: 'Voice recordings',
+          second: 'Playback',
+          third: 'Favorites',
+        },
+        calculator: {
+          first: 'Basic calculation',
+          second: 'Scientific tools',
+          third: 'History',
+        },
+        camera: {
+          first: 'Photo mode',
+          second: 'Video capture',
+          third: 'Zoom controls',
+        },
         clock: { first: 'World clock', second: 'Alarms', third: 'Timers' },
-        weather: { first: 'Current weather', second: 'Hourly forecast', third: 'Seven-day outlook' },
-        photos: { first: 'Media library', second: 'Albums', third: 'Shared media' },
-        settings: { first: 'Device controls', second: 'Privacy', third: 'Personalization' },
+        weather: {
+          first: 'Current weather',
+          second: 'Hourly forecast',
+          third: 'Seven-day outlook',
+        },
+        photos: {
+          first: 'Media library',
+          second: 'Albums',
+          third: 'Shared media',
+        },
+        settings: {
+          first: 'Device controls',
+          second: 'Privacy',
+          third: 'Personalization',
+        },
         snake: { first: 'High score', second: 'Speed', third: 'Classic grid' },
-        memory: { first: 'Matched pairs', second: 'Best time', third: 'Card themes' },
-        'number-merge': { first: 'Highest tile', second: 'Score', third: 'Strategy grid' },
-        minesweeper: { first: 'Mine counter', second: 'Best time', third: 'Difficulty' },
-        'tower-stack': { first: 'Tower height', second: 'Perfect drops', third: 'High score' },
-        'sky-flappy': { first: 'Flight score', second: 'Best run', third: 'Obstacles' },
-        citymarkt: { first: 'Listings', second: 'Categories', third: 'Saved offers' },
-        'neon-drop': { first: 'Lines cleared', second: 'Level', third: 'Neon pieces' },
+        memory: {
+          first: 'Matched pairs',
+          second: 'Best time',
+          third: 'Card themes',
+        },
+        'number-merge': {
+          first: 'Highest tile',
+          second: 'Score',
+          third: 'Strategy grid',
+        },
+        minesweeper: {
+          first: 'Mine counter',
+          second: 'Best time',
+          third: 'Difficulty',
+        },
+        'tower-stack': {
+          first: 'Tower height',
+          second: 'Perfect drops',
+          third: 'High score',
+        },
+        'sky-flappy': {
+          first: 'Flight score',
+          second: 'Best run',
+          third: 'Obstacles',
+        },
+        citymarkt: {
+          first: 'Listings',
+          second: 'Categories',
+          third: 'Saved offers',
+        },
+        'neon-drop': {
+          first: 'Lines cleared',
+          second: 'Level',
+          third: 'Neon pieces',
+        },
       },
       search: {
         recommended: 'Recommended',
@@ -5193,6 +5734,15 @@ export const usePhoneStore = defineStore('phone', {
       this.cameraLandscape = false
       this.isOpen = false
     },
+    setLocale(
+      lang: string,
+      locales: LocaleTree,
+      fallbackLocales: LocaleTree,
+    ): void {
+      this.lang = lang
+      this.locales = locales
+      this.fallbackLocales = fallbackLocales
+    },
     open(payload: PhoneOpenPayload = {}): void {
       const nextImei = payload.device?.imei ?? this.device?.imei ?? null
       const nextToken = payload.token ?? this.deviceSessionToken
diff --git a/frontend/src/testdata.contract.test.ts b/frontend/src/testdata.contract.test.ts
index 35272f6..5a71d4d 100644
--- a/frontend/src/testdata.contract.test.ts
+++ b/frontend/src/testdata.contract.test.ts
@@ -16,10 +16,15 @@ describe('test data seeding contracts', () => {
     )
   })
 
-  it('returns before registering the test-data command when disabled', () => {
-    expect(
-      testData.indexOf('if not Config.TestData.Enabled then'),
-    ).toBeLessThan(testData.indexOf('RegisterCommand(Config.TestData.Command'))
+  it('refreshes the test-data command when its runtime configuration changes', () => {
+    expect(testData).toContain('local function refresh_test_data_command()')
+    expect(testData).toContain(
+      'active_test_data_command = Config.TestData.Enabled and Config.TestData.Command or nil',
+    )
+    expect(testData).toContain(
+      'AddEventHandler("sky_phone:configurator:serverUpdated", refresh_test_data_command)',
+    )
+    expect(testData).not.toContain('RegisterCommand(Config.TestData.Command')
   })
 
   it('moves an existing player SIM before attaching it to the selected phone', () => {
diff --git a/frontend/src/types/admin.ts b/frontend/src/types/admin.ts
new file mode 100644
index 0000000..6c65d34
--- /dev/null
+++ b/frontend/src/types/admin.ts
@@ -0,0 +1,179 @@
+export type AdminStats = {
+  accounts: number
+  devices: number
+  online: number
+}
+
+export type AdminPlayerSummary = {
+  deviceCount: number
+  grade: number
+  identifier: string
+  job: string
+  name: string
+  onDuty: boolean
+  phoneNumber: string | null
+  serverName: string
+  source: number
+}
+
+export type AdminDevice = {
+  account: {
+    email: string
+    id: number
+    passwordAvailable: boolean
+  } | null
+  apps: {
+    claimed: string[]
+    revision: number
+    uninstalled: string[]
+  }
+  createdAt: string
+  imei: string
+  name: string
+  number: string | null
+  security: {
+    enabled: boolean
+    failedAttempts: number
+    length: number | null
+    lockedUntil: number
+  }
+  simRegistered: boolean
+  simType: string | null
+  updatedAt: string
+}
+
+export type AdminPlayerDetail = {
+  birthdate: string
+  devices: AdminDevice[]
+  firstName: string
+  identifier: string
+  job: {
+    grade: number
+    gradeLabel: string
+    label: string
+    name: string
+    onDuty: boolean
+  }
+  lastName: string
+  money: {
+    bank: number
+    cash: number
+    currency: string
+  }
+  name: string
+  serverName: string
+  source: number
+}
+
+export type AdminAuditEntry = {
+  action: string
+  actorName: string
+  createdAt: string
+  details: Record<string, unknown>
+  deviceImei: string | null
+  id: number
+  targetIdentifier: string
+  targetSource: number | null
+}
+
+export type AdminBootstrap = {
+  audit: AdminAuditEntry[]
+  players: AdminPlayerSummary[]
+  stats: AdminStats
+}
+
+export type AdminCredential = {
+  email: string
+  password: string
+}
+
+export type AdminMessageActivity = {
+  body: string
+  createdAt: string
+  direction: 'incoming' | 'outgoing'
+  id: string
+  messageType: string
+  otherNumber: string
+  readAt: string | null
+}
+
+export type AdminCallActivity = {
+  answeredAt: string | null
+  direction: 'incoming' | 'outgoing'
+  durationSeconds: number
+  endedAt: string | null
+  id: string
+  otherNumber: string
+  startedAt: string
+  status: string
+}
+
+export type AdminActivityResponse =
+  | { entries: AdminMessageActivity[]; kind: 'messages' }
+  | { entries: AdminCallActivity[]; kind: 'calls' }
+
+export type AdminConfiguratorField = {
+  configured?: boolean
+  label: string
+  path: string
+  structure?: AdminConfiguratorStructure
+  scope: 'config' | 'media'
+  sensitive: boolean
+  type: 'boolean' | 'json' | 'number' | 'string' | 'stringOrFalse'
+  value: unknown
+}
+
+export type AdminConfiguratorStructure =
+  | {
+      kind: 'list'
+      items: AdminConfiguratorStructure[]
+      template?: AdminConfiguratorStructure
+    }
+  | {
+      fields: Record<string, AdminConfiguratorStructure>
+      kind: 'table'
+      mutableKeys?: boolean
+      template?: AdminConfiguratorStructure
+    }
+  | {
+      entries: Array<{
+        key: number | string
+        keyType: 'number' | 'string'
+        structure: AdminConfiguratorStructure
+      }>
+      keyType?: 'number' | 'string'
+      kind: 'map'
+      template?: AdminConfiguratorStructure
+    }
+  | {
+      kind: 'value'
+      valueType: 'boolean' | 'number' | 'string'
+    }
+  | {
+      kind: 'optionalString'
+    }
+  | {
+      kind: 'vector'
+      vectorType: 'vector2' | 'vector3' | 'vector4'
+    }
+
+export type AdminConfiguratorSection = {
+  fields: AdminConfiguratorField[]
+  id: string
+  label: string
+  scope: 'config' | 'media'
+}
+
+export type AdminConfigurator = {
+  enabled: boolean
+  revision: number
+  sections: AdminConfiguratorSection[]
+  updatedAt: string | null
+  updatedBy: string | null
+}
+
+export type AdminConfiguratorChange = {
+  path: string
+  scope: 'config' | 'media'
+  value: unknown
+}
diff --git a/frontend/src/types/apps.ts b/frontend/src/types/apps.ts
index 51aa3af..66a2e25 100644
--- a/frontend/src/types/apps.ts
+++ b/frontend/src/types/apps.ts
@@ -68,6 +68,7 @@ export type AppLaunchOrigin = {
 }
 
 type PhoneAppDefinitionBase = {
+  adminOnly?: boolean
   category: PhoneAppCategory
   dockOrder: number | null
   gridOrder: number
diff --git a/frontend/src/utils/adminConfiguratorDescription.test.ts b/frontend/src/utils/adminConfiguratorDescription.test.ts
new file mode 100644
index 0000000..b2ee17c
--- /dev/null
+++ b/frontend/src/utils/adminConfiguratorDescription.test.ts
@@ -0,0 +1,62 @@
+import { describe, expect, it } from 'vitest'
+
+import type { AdminConfiguratorStructure } from '@/types/admin'
+
+import {
+  configuratorDescriptionKey,
+  configuratorPathName,
+  describeConfiguratorValue,
+} from './adminConfiguratorDescription'
+
+describe('admin configurator descriptions', () => {
+  it('selects specific descriptions before generic value descriptions', () => {
+    expect(configuratorDescriptionKey('Bridge.CallbackTimeout', 15000)).toBe(
+      'milliseconds',
+    )
+    expect(configuratorDescriptionKey('Media.RequestTimeoutMs', 10000)).toBe(
+      'milliseconds',
+    )
+    expect(configuratorDescriptionKey('AdminPanel.AdminGroups', [])).toBe(
+      'access',
+    )
+    expect(configuratorDescriptionKey('FiveManage.ApiKey', '')).toBe(
+      'credential',
+    )
+  })
+
+  it('describes structured values from their schema', () => {
+    const vector: AdminConfiguratorStructure = {
+      kind: 'vector',
+      vectorType: 'vector3',
+    }
+    const table: AdminConfiguratorStructure = {
+      fields: {},
+      kind: 'table',
+    }
+    expect(configuratorDescriptionKey('Location', {}, vector)).toBe(
+      'coordinates',
+    )
+    expect(configuratorDescriptionKey('Settings', {}, table)).toBe('table')
+  })
+
+  it('passes a readable field name to the localized template', () => {
+    const translate = (key: string, params?: Record<string, string>) =>
+      `${key}:${params?.name}`
+    expect(
+      describeConfiguratorValue(
+        translate,
+        'CustomApps.MaximumStorageBytesPerApp',
+        262144,
+      ),
+    ).toBe('configurator.descriptions.byteLimit:Maximum Storage Bytes Per App')
+    expect(
+      describeConfiguratorValue(translate, 'Radio.AllowedJobs[2]', 'police'),
+    ).toBe('configurator.descriptions.access:Allowed Jobs #2')
+  })
+
+  it('humanizes subtab keys', () => {
+    expect(configuratorPathName('ExternalPingResources')).toBe(
+      'External Ping Resources',
+    )
+  })
+})
diff --git a/frontend/src/utils/adminConfiguratorDescription.ts b/frontend/src/utils/adminConfiguratorDescription.ts
new file mode 100644
index 0000000..91d6c62
--- /dev/null
+++ b/frontend/src/utils/adminConfiguratorDescription.ts
@@ -0,0 +1,103 @@
+import type { AdminConfiguratorStructure } from '@/types/admin'
+
+type ConfiguratorDescriptionTranslator = (
+  key: string,
+  params?: Record<string, string>,
+) => string
+
+export type AdminConfiguratorDescribe = (
+  path: string,
+  value: unknown,
+  structure?: AdminConfiguratorStructure,
+  label?: string,
+) => string
+
+const DESCRIPTION_RULES: Array<[RegExp, string]> = [
+  [/(?:^|\.)(?:apikey|token|password|secret)$/i, 'credential'],
+  [/(?:base|manifest|image|icon)?url$/i, 'url'],
+  [/(?:allowed)?(?:gif|media)?hosts?$/i, 'hosts'],
+  [
+    /(?:timeout|timeoutms|milliseconds|durationms|intervalms|pollms)$/i,
+    'milliseconds',
+  ],
+  [/(?:timeoutseconds|seconds)$/i, 'seconds'],
+  [/perminute$/i, 'rateLimit'],
+  [/(?:maximum|max).*bytes/i, 'byteLimit'],
+  [/(?:maximum|max).*length$|length$/i, 'textLimit'],
+  [/(?:distance)$/i, 'distance'],
+  [/(?:location|position|rotation|coords|coordinates)$/i, 'coordinates'],
+  [/(?:model|prop|propmodel|customprop|replacementprop)$/i, 'gameAsset'],
+  [/(?:dictionary|dictionaries|clip|clips|pedclip|propclip)$/i, 'animation'],
+  [
+    /(?:permissions?|admingroups?|allowedjobs?|jobs?|minimumgrade|requiredace)$/i,
+    'access',
+  ],
+  [/(?:framework|inventory|provider|voiceprovider|adapter)$/i, 'integration'],
+  [/(?:path)$/i, 'path'],
+  [/(?:color|colour|accent)$/i, 'color'],
+  [
+    /(?:label|name|title|description|address|district|locationlabel|devicename)$/i,
+    'displayText',
+  ],
+  [/(?:number|callernumber|numberprefix)$/i, 'phoneNumber'],
+  [/(?:routing)$/i, 'routing'],
+  [/(?:command)$/i, 'command'],
+  [/(?:locale)$/i, 'locale'],
+  [/(?:debug)$/i, 'debug'],
+  [/(?:enabled|active|public|verified)$/i, 'featureToggle'],
+  [/(?:quality|bitratekbps|volume)$/i, 'mediaQuality'],
+  [
+    /(?:pagesize|batchsize|limit|count|maxselection|maximumplayers|samples|decimals)$/i,
+    'amount',
+  ],
+]
+
+export function configuratorPathName(path: string): string {
+  const listEntry = path.match(/^(.*)\[(\d+)\]$/)
+  const source = listEntry?.[1] ?? path
+  const segment = source.split('.').at(-1) ?? source
+  const name = segment
+    .replace(/([A-Z]+)([A-Z][a-z])/g, '$1 $2')
+    .replace(/([a-z\d])([A-Z])/g, '$1 $2')
+    .replace(/[_-]+/g, ' ')
+    .trim()
+  return listEntry ? `${name} #${listEntry[2]}` : name
+}
+
+export function configuratorDescriptionKey(
+  path: string,
+  value: unknown,
+  structure?: AdminConfiguratorStructure,
+): string {
+  const segment =
+    path
+      .replace(/\[\d+\]$/, '')
+      .split('.')
+      .at(-1) ?? path
+  const semanticRule = DESCRIPTION_RULES.find(([pattern]) =>
+    pattern.test(segment),
+  )
+  if (semanticRule) return semanticRule[1]
+
+  if (structure?.kind === 'vector') return 'coordinates'
+  if (structure?.kind === 'list' || Array.isArray(value)) return 'list'
+  if (structure?.kind === 'map' || structure?.kind === 'table') return 'table'
+  if (structure?.kind === 'optionalString') return 'optionalText'
+  if (value !== null && typeof value === 'object') return 'table'
+  if (typeof value === 'boolean') return 'boolean'
+  if (typeof value === 'number') return 'number'
+  return 'text'
+}
+
+export function describeConfiguratorValue(
+  translate: ConfiguratorDescriptionTranslator,
+  path: string,
+  value: unknown,
+  structure?: AdminConfiguratorStructure,
+  label?: string,
+): string {
+  return translate(
+    `configurator.descriptions.${configuratorDescriptionKey(path, value, structure)}`,
+    { name: label?.trim() || configuratorPathName(path) },
+  )
+}
diff --git a/frontend/src/utils/appStorePreviewImages.ts b/frontend/src/utils/appStorePreviewImages.ts
index 4a6f599..9cb8c0f 100644
--- a/frontend/src/utils/appStorePreviewImages.ts
+++ b/frontend/src/utils/appStorePreviewImages.ts
@@ -13,7 +13,10 @@ const previewModules = import.meta.glob<string>(
 
 const APP_STORE_PREVIEW_IMAGES = Object.fromEntries(
   Object.entries(previewModules).map(([path, imageUrl]) => {
-    const appId = path.split('/').at(-1)?.replace(/\.jpg$/, '')
+    const appId = path
+      .split('/')
+      .at(-1)
+      ?.replace(/\.jpg$/, '')
     if (!appId) throw new Error(`Invalid App Store preview path: ${path}`)
     return [appId, imageUrl]
   }),
diff --git a/frontend/src/utils/appStorePreviews.test.ts b/frontend/src/utils/appStorePreviews.test.ts
index 968af0e..12974eb 100644
--- a/frontend/src/utils/appStorePreviews.test.ts
+++ b/frontend/src/utils/appStorePreviews.test.ts
@@ -17,7 +17,8 @@ function escapeRegExp(value: string): string {
 describe('App Store preview catalog', () => {
   it('contains a real captured screenshot for every built-in store app', () => {
     const storeAppIds = PHONE_APPS.filter(
-      (app) => app.kind !== 'external' && app.id !== 'app-store',
+      (app) =>
+        app.kind !== 'external' && app.id !== 'app-store' && !app.adminOnly,
     ).map((app) => app.id)
 
     expect([...APP_STORE_PREVIEW_IMAGE_IDS].sort()).toEqual(storeAppIds.sort())
@@ -25,7 +26,8 @@ describe('App Store preview catalog', () => {
 
   it('provides specialized preview data for every built-in store app', () => {
     const storeAppIds = PHONE_APPS.filter(
-      (app) => app.kind !== 'external' && app.id !== 'app-store',
+      (app) =>
+        app.kind !== 'external' && app.id !== 'app-store' && !app.adminOnly,
     ).map((app) => app.id)
 
     expect([...PREVIEWABLE_BUILTIN_APP_IDS].sort()).toEqual(
diff --git a/frontend/src/views/PhoneAppWindow.vue b/frontend/src/views/PhoneAppWindow.vue
index 91b69ec..0dcc86e 100644
--- a/frontend/src/views/PhoneAppWindow.vue
+++ b/frontend/src/views/PhoneAppWindow.vue
@@ -28,7 +28,7 @@ const launchStyle = computed(() => {
 
 <template>
   <div
-    v-if="app"
+    v-if="app && !app.adminOnly"
     class="app-window"
     :class="{ 'app-window--citywarn': app.id === 'citywarn' }"
     :style="launchStyle"
diff --git a/frontend/src/views/apps/AppStoreApp.vue b/frontend/src/views/apps/AppStoreApp.vue
index 44c0715..eb9f4f6 100644
--- a/frontend/src/views/apps/AppStoreApp.vue
+++ b/frontend/src/views/apps/AppStoreApp.vue
@@ -119,7 +119,7 @@ const downloadDateDescription = computed(() =>
 )
 const catalog = computed(() =>
   PHONE_APPS.filter((app): app is LaunchablePhoneAppDefinition => {
-    if (!isLaunchablePhoneApp(app) || app.id === 'app-store') {
+    if (!isLaunchablePhoneApp(app) || app.id === 'app-store' || app.adminOnly) {
       return false
     }
 
@@ -140,6 +140,7 @@ const dailyCandidates = computed(() =>
     PHONE_APPS.filter(
       (app): app is LaunchablePhoneAppDefinition =>
         isLaunchablePhoneApp(app) &&
+        !app.adminOnly &&
         !isExternalPhoneApp(app) &&
         app.id !== 'app-store' &&
         !DEFAULT_INSTALLED_PHONE_APP_IDS.has(app.id) &&
diff --git a/frontend/testserver/configurator-fixture.cjs b/frontend/testserver/configurator-fixture.cjs
new file mode 100644
index 0000000..a9e6012
--- /dev/null
+++ b/frontend/testserver/configurator-fixture.cjs
@@ -0,0 +1,668 @@
+const { readFileSync } = require('node:fs')
+const { resolve } = require('node:path')
+
+class LuaTable {
+  constructor() {
+    this.entries = []
+    this.nextArrayIndex = 1
+  }
+
+  get(key) {
+    return this.entries.find((entry) => entry.key === key)?.value
+  }
+
+  set(key, value) {
+    const entry = this.entries.find((candidate) => candidate.key === key)
+    if (entry) entry.value = value
+    else this.entries.push({ key, value })
+  }
+}
+
+function tokenize(source) {
+  const tokens = []
+  let index = 0
+
+  while (index < source.length) {
+    const character = source[index]
+    if (/\s/.test(character)) {
+      index += 1
+      continue
+    }
+    if (source.startsWith('--[[', index)) {
+      const end = source.indexOf(']]', index + 4)
+      index = end < 0 ? source.length : end + 2
+      continue
+    }
+    if (source.startsWith('--', index)) {
+      const end = source.indexOf('\n', index + 2)
+      index = end < 0 ? source.length : end + 1
+      continue
+    }
+    if (character === '"' || character === "'") {
+      const quote = character
+      let value = ''
+      index += 1
+      while (index < source.length && source[index] !== quote) {
+        if (source[index] !== '\\') {
+          value += source[index]
+          index += 1
+          continue
+        }
+
+        index += 1
+        const escaped = source[index]
+        const escapeValues = {
+          a: '\u0007',
+          b: '\b',
+          f: '\f',
+          n: '\n',
+          r: '\r',
+          t: '\t',
+          v: '\u000b',
+        }
+        value += escapeValues[escaped] ?? escaped
+        index += 1
+      }
+      if (source[index] !== quote)
+        throw new Error('Unterminated Lua string in configurator fixture.')
+      index += 1
+      tokens.push({ type: 'string', value })
+      continue
+    }
+    if (/[A-Za-z_]/.test(character)) {
+      const match = source.slice(index).match(/^[A-Za-z_][A-Za-z0-9_]*/)
+      tokens.push({ type: 'name', value: match[0] })
+      index += match[0].length
+      continue
+    }
+    if (
+      /\d/.test(character) ||
+      (character === '.' && /\d/.test(source[index + 1]))
+    ) {
+      const match = source
+        .slice(index)
+        .match(/^(?:\d+\.?\d*|\.\d+)(?:[eE][+-]?\d+)?/)
+      tokens.push({ type: 'number', value: Number(match[0]) })
+      index += match[0].length
+      continue
+    }
+
+    tokens.push({ type: 'symbol', value: character })
+    index += 1
+  }
+
+  return tokens
+}
+
+class LuaConfigParser {
+  constructor(source) {
+    this.tokens = tokenize(source)
+    this.index = 0
+    this.config = new LuaTable()
+  }
+
+  current(offset = 0) {
+    return this.tokens[this.index + offset]
+  }
+
+  matches(value, offset = 0) {
+    return this.current(offset)?.value === value
+  }
+
+  take(value) {
+    const token = this.current()
+    if (!token || (value !== undefined && token.value !== value)) {
+      throw new Error(
+        `Expected '${value}', received '${token?.value ?? 'end of file'}' in configurator fixture.`,
+      )
+    }
+    this.index += 1
+    return token
+  }
+
+  parse() {
+    while (this.current()) {
+      if (this.matches('Config')) {
+        const start = this.index
+        const path = this.parsePath()
+        if (path.length && this.matches('=')) {
+          this.take('=')
+          this.setPath(path, this.parseExpression())
+          continue
+        }
+        this.index = start + 1
+        continue
+      }
+      this.index += 1
+    }
+    return this.config
+  }
+
+  parsePath() {
+    this.take('Config')
+    const path = []
+    while (this.matches('.') && this.current(1)?.type === 'name') {
+      this.take('.')
+      path.push(this.take().value)
+    }
+    return path
+  }
+
+  getPath(path) {
+    let value = this.config
+    for (const key of path) {
+      if (!(value instanceof LuaTable)) return undefined
+      value = value.get(key)
+    }
+    return value
+  }
+
+  setPath(path, value) {
+    let parent = this.config
+    for (let index = 0; index < path.length - 1; index += 1) {
+      const key = path[index]
+      let child = parent.get(key)
+      if (!(child instanceof LuaTable)) {
+        child = new LuaTable()
+        parent.set(key, child)
+      }
+      parent = child
+    }
+    parent.set(path.at(-1), value)
+  }
+
+  parseExpression() {
+    return this.parseOr()
+  }
+
+  parseOr() {
+    let value = this.parseAdditive()
+    while (this.matches('or')) {
+      this.take('or')
+      const fallback = this.parseAdditive()
+      value =
+        value !== false && value !== null && value !== undefined
+          ? value
+          : fallback
+    }
+    return value
+  }
+
+  parseAdditive() {
+    let value = this.parseMultiplicative()
+    while (this.matches('+') || this.matches('-')) {
+      const operator = this.take().value
+      const right = this.parseMultiplicative()
+      value =
+        operator === '+'
+          ? Number(value) + Number(right)
+          : Number(value) - Number(right)
+    }
+    return value
+  }
+
+  parseMultiplicative() {
+    let value = this.parseUnary()
+    while (this.matches('*') || this.matches('/')) {
+      const operator = this.take().value
+      const right = this.parseUnary()
+      value =
+        operator === '*'
+          ? Number(value) * Number(right)
+          : Number(value) / Number(right)
+    }
+    return value
+  }
+
+  parseUnary() {
+    if (this.matches('-')) {
+      this.take('-')
+      return -Number(this.parseUnary())
+    }
+    return this.parsePrimary()
+  }
+
+  parsePrimary() {
+    const token = this.current()
+    if (!token)
+      throw new Error(
+        'Unexpected end of Lua configuration in configurator fixture.',
+      )
+    if (token.type === 'number' || token.type === 'string') {
+      this.index += 1
+      return token.value
+    }
+    if (this.matches('true') || this.matches('false') || this.matches('nil')) {
+      this.index += 1
+      return token.value === 'true'
+        ? true
+        : token.value === 'false'
+          ? false
+          : null
+    }
+    if (this.matches('{')) return this.parseTable()
+    if (this.matches('(')) {
+      this.take('(')
+      const value = this.parseExpression()
+      this.take(')')
+      return value
+    }
+    if (this.matches('Config')) return this.getPath(this.parsePath())
+    if (token.type === 'name' && this.current(1)?.value === '(') {
+      const name = this.take().value
+      this.take('(')
+      const argumentsList = []
+      while (!this.matches(')')) {
+        argumentsList.push(this.parseExpression())
+        if (!this.matches(',')) break
+        this.take(',')
+      }
+      this.take(')')
+      if (/^vector[234]$/.test(name)) {
+        const axes = ['x', 'y', 'z', 'w']
+        return Object.fromEntries([
+          ['__skyType', name],
+          ...argumentsList.map((value, index) => [axes[index], value]),
+        ])
+      }
+      throw new Error(`Unsupported Lua call '${name}' in configurator fixture.`)
+    }
+
+    throw new Error(
+      `Unsupported Lua token '${token.value}' in configurator fixture.`,
+    )
+  }
+
+  parseTable() {
+    const table = new LuaTable()
+    this.take('{')
+    while (!this.matches('}')) {
+      if (this.matches('[')) {
+        this.take('[')
+        const key = this.parseExpression()
+        this.take(']')
+        this.take('=')
+        table.set(key, this.parseExpression())
+      } else if (
+        this.current()?.type === 'name' &&
+        this.current(1)?.value === '='
+      ) {
+        const key = this.take().value
+        this.take('=')
+        table.set(key, this.parseExpression())
+      } else {
+        table.set(table.nextArrayIndex, this.parseExpression())
+        table.nextArrayIndex += 1
+      }
+
+      if (this.matches(',') || this.matches(';')) this.index += 1
+      else if (!this.matches('}')) {
+        throw new Error(
+          `Expected a Lua table separator, received '${this.current()?.value ?? 'end of file'}'.`,
+        )
+      }
+    }
+    this.take('}')
+    return table
+  }
+}
+
+function serializeLuaValue(value) {
+  if (!(value instanceof LuaTable)) {
+    if (Array.isArray(value)) return value.map(serializeLuaValue)
+    if (value && typeof value === 'object') {
+      return Object.fromEntries(
+        Object.entries(value).map(([key, child]) => [
+          key,
+          serializeLuaValue(child),
+        ]),
+      )
+    }
+    return value
+  }
+
+  const numericKeys = value.entries
+    .filter((entry) => typeof entry.key === 'number')
+    .map((entry) => entry.key)
+    .sort((left, right) => left - right)
+  const isSequence =
+    numericKeys.length === value.entries.length &&
+    numericKeys.every((key, index) => key === index + 1)
+  if (isSequence) {
+    return [...value.entries]
+      .sort((left, right) => left.key - right.key)
+      .map((entry) => serializeLuaValue(entry.value))
+  }
+  if (value.entries.every((entry) => typeof entry.key === 'string')) {
+    return Object.fromEntries(
+      value.entries.map((entry) => [entry.key, serializeLuaValue(entry.value)]),
+    )
+  }
+
+  return {
+    __skyType: 'map',
+    entries: value.entries.map((entry) => ({
+      key: entry.key,
+      keyType: typeof entry.key,
+      value: serializeLuaValue(entry.value),
+    })),
+  }
+}
+
+function humanize(value) {
+  return String(value ?? '')
+    .replace(/[_-]+/g, ' ')
+    .replace(/([a-z])([A-Z])/g, '$1 $2')
+    .replace(/([A-Za-z])(\d)/g, '$1 $2')
+    .replace(/^./, (character) => character.toUpperCase())
+}
+
+function sensitivePath(path) {
+  const leaf = path.split('.').at(-1) ?? path
+  const normalized = leaf.toLowerCase().replace(/[^a-z0-9]/g, '')
+  return (
+    normalized.includes('apikey') ||
+    normalized.includes('secret') ||
+    normalized.includes('pepper') ||
+    [
+      'password',
+      'token',
+      'authorization',
+      'credential',
+      'connectionstring',
+    ].includes(normalized)
+  )
+}
+
+function maskValue(value, path) {
+  if (Array.isArray(value))
+    return value.map((child, index) => maskValue(child, `${path}.${index + 1}`))
+  if (value?.__skyType === 'map' && Array.isArray(value.entries)) {
+    return {
+      __skyType: 'map',
+      entries: value.entries.map((entry) => ({
+        key: entry.key,
+        keyType: entry.keyType,
+        value: maskValue(entry.value, `${path}.${entry.key}`),
+      })),
+    }
+  }
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, child]) => [
+        key,
+        maskValue(child, `${path}.${key}`),
+      ]),
+    )
+  }
+  return typeof value === 'string' && sensitivePath(path)
+    ? '***REDACTED***'
+    : value
+}
+
+function emptyStructure(scope, path) {
+  if (scope !== 'config') return undefined
+  if (path === 'Garage.VehicleImages.ModelNames') {
+    return {
+      entries: [],
+      keyType: 'number',
+      kind: 'map',
+      template: { kind: 'value', valueType: 'string' },
+    }
+  }
+  if (
+    path === 'CrewLink.ExternalPingResources' ||
+    path === 'CustomApps.TrustedAdapters'
+  ) {
+    return {
+      fields: {},
+      kind: 'table',
+      mutableKeys: true,
+      template: { kind: 'value', valueType: 'boolean' },
+    }
+  }
+  if (path === 'FlipTok.MusicTracks') {
+    return {
+      items: [],
+      kind: 'list',
+      template: {
+        fields: {
+          Artist: { kind: 'value', valueType: 'string' },
+          Id: { kind: 'value', valueType: 'string' },
+          Title: { kind: 'value', valueType: 'string' },
+          Url: { kind: 'value', valueType: 'string' },
+        },
+        kind: 'table',
+      },
+    }
+  }
+  if (path === 'Music.Tracks') {
+    return {
+      items: [],
+      kind: 'list',
+      template: {
+        fields: {
+          Artist: { kind: 'value', valueType: 'string' },
+          Id: { kind: 'value', valueType: 'string' },
+          Title: { kind: 'value', valueType: 'string' },
+        },
+        kind: 'table',
+      },
+    }
+  }
+  if (path === 'Payphones.CustomLocations') {
+    return {
+      items: [],
+      kind: 'list',
+      template: { kind: 'vector', vectorType: 'vector4' },
+    }
+  }
+  if (/^Companies\.Definitions\.[^.]+\.Services$/.test(path)) {
+    return {
+      items: [],
+      kind: 'list',
+      template: {
+        fields: {
+          Description: { kind: 'value', valueType: 'string' },
+          Id: { kind: 'value', valueType: 'string' },
+          Price: { kind: 'value', valueType: 'string' },
+          RequestsEnabled: { kind: 'value', valueType: 'boolean' },
+          Title: { kind: 'value', valueType: 'string' },
+        },
+        kind: 'table',
+      },
+    }
+  }
+  return undefined
+}
+
+function buildStructure(value, scope, path) {
+  if (scope === 'config' && path === 'Phone.Keybind') {
+    return { kind: 'optionalString' }
+  }
+  if (
+    scope === 'config' &&
+    path === 'Companies.Definitions' &&
+    value !== null &&
+    typeof value === 'object' &&
+    !Array.isArray(value)
+  ) {
+    const keys = Object.keys(value).sort()
+    const fields = Object.fromEntries(
+      keys.map((key) => [
+        key,
+        buildStructure(value[key], scope, `${path}.${key}`),
+      ]),
+    )
+    return {
+      fields,
+      kind: 'table',
+      mutableKeys: true,
+      template: keys[0] ? fields[keys[0]] : undefined,
+    }
+  }
+  const configuredEmptyStructure =
+    Array.isArray(value) && value.length === 0
+      ? emptyStructure(scope, path)
+      : undefined
+  if (configuredEmptyStructure) {
+    return configuredEmptyStructure
+  }
+  if (Array.isArray(value)) {
+    const items = value.map((child, index) =>
+      buildStructure(child, scope, `${path}.${index + 1}`),
+    )
+    return {
+      kind: 'list',
+      items,
+      template: items[0],
+    }
+  }
+  if (value?.__skyType === 'map' && Array.isArray(value.entries)) {
+    const entries = value.entries.map((entry) => ({
+      key: entry.key,
+      keyType: entry.keyType,
+      structure: buildStructure(entry.value, scope, `${path}.${entry.key}`),
+    }))
+    const keyTypes = new Set(entries.map((entry) => entry.keyType))
+    return {
+      kind: 'map',
+      entries,
+      keyType: keyTypes.size === 1 ? entries[0]?.keyType : undefined,
+      template: entries[0]?.structure,
+    }
+  }
+  if (/^vector[234]$/.test(value?.__skyType ?? '')) {
+    return { kind: 'vector', vectorType: value.__skyType }
+  }
+  if (value !== null && typeof value === 'object') {
+    return {
+      kind: 'table',
+      fields: Object.fromEntries(
+        Object.entries(value).map(([key, child]) => [
+          key,
+          buildStructure(child, scope, `${path}.${key}`),
+        ]),
+      ),
+    }
+  }
+  return { kind: 'value', valueType: typeof value }
+}
+
+function addField(fields, scope, path, value) {
+  const valueType = Array.isArray(value) ? 'json' : typeof value
+  const sensitive = typeof value === 'string' && sensitivePath(path)
+  fields.push({
+    configured: sensitive ? value !== '' : undefined,
+    label:
+      scope === 'config' && path === 'Companies.Definitions'
+        ? 'Jobs'
+        : humanize(path.split('.').at(-1)),
+    path,
+    scope,
+    sensitive,
+    structure:
+      value !== null && typeof value === 'object'
+        ? buildStructure(value, scope, path)
+        : undefined,
+    type:
+      scope === 'config' && path === 'Phone.Keybind'
+        ? 'stringOrFalse'
+        : value !== null && typeof value === 'object'
+          ? 'json'
+          : valueType,
+    value: sensitive ? '' : maskValue(value, path),
+  })
+}
+
+function flattenCompanyFields(fields, path, value) {
+  if (
+    path === 'Companies.Definitions' ||
+    value === null ||
+    typeof value !== 'object' ||
+    Array.isArray(value) ||
+    value.__skyType ||
+    Object.keys(value).length === 0
+  ) {
+    addField(fields, 'config', path, value)
+    return
+  }
+
+  for (const key of Object.keys(value).sort()) {
+    flattenCompanyFields(fields, `${path}.${key}`, value[key])
+  }
+}
+
+function buildSections(scope, payload) {
+  const sections = []
+  const generalFields = []
+  for (const key of Object.keys(payload).sort()) {
+    const value = payload[key]
+    if (scope === 'config' && key === 'Companies') {
+      const fields = []
+      flattenCompanyFields(fields, 'Companies', value)
+      fields.sort((left, right) => {
+        if (left.path === 'Companies.Definitions') return 1
+        if (right.path === 'Companies.Definitions') return -1
+        return left.path.localeCompare(right.path)
+      })
+      sections.push({
+        fields,
+        id: 'config:Companies',
+        label: humanize(key),
+        scope,
+      })
+    } else if (
+      value !== null &&
+      typeof value === 'object' &&
+      !Array.isArray(value) &&
+      !value.__skyType &&
+      Object.keys(value).length > 0
+    ) {
+      const fields = []
+      addField(fields, scope, key, value)
+      sections.push({
+        fields,
+        id: `${scope}:${key}`,
+        label: humanize(key),
+        scope,
+      })
+    } else {
+      addField(generalFields, scope, key, value)
+    }
+  }
+  if (generalFields.length) {
+    const general = {
+      fields: generalFields,
+      id: `${scope}:general`,
+      label: 'General',
+      scope,
+    }
+    if (scope === 'config') sections.unshift(general)
+    else sections.push(general)
+  }
+  return sections
+}
+
+function loadConfiguratorSections() {
+  const resourceRoot = resolve(__dirname, '../..')
+  const config = serializeLuaValue(
+    new LuaConfigParser(
+      readFileSync(
+        resolve(resourceRoot, 'sky_phone/config/config.lua'),
+        'utf8',
+      ),
+    ).parse(),
+  )
+  const mediaRoot = serializeLuaValue(
+    new LuaConfigParser(
+      readFileSync(resolve(resourceRoot, 'sky_phone/config/media.lua'), 'utf8'),
+    ).parse(),
+  )
+  const media = mediaRoot.Media
+  delete config.PhoneConfigurator
+  delete config.Media
+  return [...buildSections('config', config), ...buildSections('media', media)]
+}
+
+module.exports = { loadConfiguratorSections }
diff --git a/frontend/testserver/configurator-fixture.test.ts b/frontend/testserver/configurator-fixture.test.ts
new file mode 100644
index 0000000..8e84c8a
--- /dev/null
+++ b/frontend/testserver/configurator-fixture.test.ts
@@ -0,0 +1,194 @@
+import { readFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+
+import { describe, expect, it } from 'vitest'
+
+type ConfiguratorField = {
+  label: string
+  path: string
+  structure?: ConfiguratorStructure
+  type: string
+  value: unknown
+}
+
+type ConfiguratorStructure = {
+  entries?: Array<{ structure: ConfiguratorStructure }>
+  fields?: Record<string, ConfiguratorStructure>
+  items?: ConfiguratorStructure[]
+  keyType?: 'number' | 'string'
+  kind: string
+  mutableKeys?: boolean
+  template?: ConfiguratorStructure
+}
+
+type ConfiguratorSection = {
+  fields: ConfiguratorField[]
+  id: string
+  scope: 'config' | 'media'
+}
+
+const require = createRequire(import.meta.url)
+const { loadConfiguratorSections } = require('./configurator-fixture.cjs') as {
+  loadConfiguratorSections: () => ConfiguratorSection[]
+}
+
+const configSource = readFileSync(
+  new URL('../../sky_phone/config/config.lua', import.meta.url),
+  'utf8',
+)
+
+function countStructure(structure: ConfiguratorStructure | undefined): number {
+  if (!structure) return 1
+  if (structure.fields) {
+    return Object.values(structure.fields).reduce(
+      (total, field) => total + countStructure(field),
+      0,
+    )
+  }
+  if (structure.items) {
+    return structure.items.reduce(
+      (total, item) => total + countStructure(item),
+      0,
+    )
+  }
+  if (structure.entries) {
+    return structure.entries.reduce(
+      (total, entry) => total + countStructure(entry.structure),
+      0,
+    )
+  }
+  return 1
+}
+
+describe('admin configurator fixture', () => {
+  it('exposes every config.lua root through the full live preview', () => {
+    const sections = loadConfiguratorSections()
+    const fields = sections.flatMap((section) => section.fields)
+    const roots = [
+      ...configSource.matchAll(/^\s{0,4}Config\.([A-Za-z0-9_]+)\s*=/gm),
+    ]
+      .map((match) => match[1])
+      .filter((root) => root !== 'Media' && root !== 'PhoneConfigurator')
+
+    expect(sections).toHaveLength(45)
+    expect(
+      fields.reduce(
+        (total, field) => total + countStructure(field.structure),
+        0,
+      ),
+    ).toBeGreaterThan(700)
+    for (const root of new Set(roots)) {
+      expect(
+        sections.some(
+          (section) =>
+            section.id === `config:${root}` ||
+            section.fields.some(
+              (field) =>
+                field.path === root || field.path.startsWith(`${root}.`),
+            ),
+        ),
+        `Missing Config.${root}`,
+      ).toBe(true)
+    }
+  })
+
+  it('preserves numeric Lua map keys and the false keybind option', () => {
+    const fields = loadConfiguratorSections().flatMap(
+      (section) => section.fields,
+    )
+    const darkChat = fields.find((field) => field.path === 'DarkChat')
+    const phone = fields.find((field) => field.path === 'Phone')
+    const companyJobs = fields.find(
+      (field) => field.path === 'Companies.Definitions',
+    )
+    const garage = fields.find((field) => field.path === 'Garage')
+    const timers = (darkChat?.value as Record<string, unknown> | undefined)
+      ?.AllowedDisappearTimers
+
+    expect(timers).toMatchObject({
+      __skyType: 'map',
+      entries: expect.arrayContaining([
+        { key: -1, keyType: 'number', value: true },
+        { key: 0, keyType: 'number', value: true },
+        { key: 604800, keyType: 'number', value: true },
+      ]),
+    })
+    expect(darkChat?.structure?.fields?.AllowedDisappearTimers.kind).toBe('map')
+    expect(phone?.structure?.fields?.Keybind.kind).toBe('optionalString')
+    expect(companyJobs?.label).toBe('Jobs')
+    expect(companyJobs?.structure).toMatchObject({
+      fields: {
+        ambulance: { kind: 'table' },
+        police: { kind: 'table' },
+      },
+      kind: 'table',
+      mutableKeys: true,
+      template: { kind: 'table' },
+    })
+    expect(
+      garage?.structure?.fields?.VehicleImages.fields?.ModelNames.kind,
+    ).toBe('map')
+  })
+
+  it('publishes fixed schemas for every empty configurable collection', () => {
+    const fields = loadConfiguratorSections().flatMap(
+      (section) => section.fields,
+    )
+    const root = (path: string) =>
+      fields.find((field) => field.path === path)?.structure
+
+    expect(root('Music')?.fields?.Tracks).toMatchObject({
+      items: [],
+      kind: 'list',
+      template: {
+        fields: {
+          Artist: { kind: 'value', valueType: 'string' },
+          Id: { kind: 'value', valueType: 'string' },
+          Title: { kind: 'value', valueType: 'string' },
+        },
+        kind: 'table',
+      },
+    })
+    expect(root('FlipTok')?.fields?.MusicTracks.template).toMatchObject({
+      fields: { Url: { kind: 'value', valueType: 'string' } },
+      kind: 'table',
+    })
+    expect(root('Payphones')?.fields?.CustomLocations.template).toEqual({
+      kind: 'vector',
+      vectorType: 'vector4',
+    })
+    expect(root('CrewLink')?.fields?.ExternalPingResources).toMatchObject({
+      fields: {},
+      kind: 'table',
+      mutableKeys: true,
+      template: { kind: 'value', valueType: 'boolean' },
+    })
+    expect(root('CustomApps')?.fields?.TrustedAdapters).toMatchObject({
+      fields: {},
+      kind: 'table',
+      mutableKeys: true,
+      template: { kind: 'value', valueType: 'boolean' },
+    })
+    expect(
+      root('Garage')?.fields?.VehicleImages.fields?.ModelNames,
+    ).toMatchObject({
+      entries: [],
+      keyType: 'number',
+      kind: 'map',
+      template: { kind: 'value', valueType: 'string' },
+    })
+    expect(
+      root('Companies.Definitions')?.fields?.police.fields?.Services,
+    ).toMatchObject({
+      items: [],
+      kind: 'list',
+      template: {
+        fields: {
+          Id: { kind: 'value', valueType: 'string' },
+          RequestsEnabled: { kind: 'value', valueType: 'boolean' },
+        },
+        kind: 'table',
+      },
+    })
+  })
+})
diff --git a/frontend/testserver/index.cjs b/frontend/testserver/index.cjs
index f89ceb9..dec89f8 100644
--- a/frontend/testserver/index.cjs
+++ b/frontend/testserver/index.cjs
@@ -3,6 +3,8 @@ const { randomUUID } = require('node:crypto')
 const cors = require('cors')
 const express = require('express')
 
+const { loadConfiguratorSections } = require('./configurator-fixture.cjs')
+
 const app = express()
 const port = Number(process.argv[2]) || 3001
 
@@ -3098,9 +3100,7 @@ const deviceData = {
         ringtoneVolume: 80,
         streamerMode: false,
         wallpaper: 'custom',
-        wallpaperHistory: [
-          { imageUrl: demoWallpaperUrl, wallpaper: 'custom' },
-        ],
+        wallpaperHistory: [{ imageUrl: demoWallpaperUrl, wallpaper: 'custom' }],
         wallpaperImageUrl: demoWallpaperUrl,
       },
       version: 1,
@@ -4650,11 +4650,303 @@ function companyWorkContext(testScenario = '') {
   }
 }
 
+const adminMockApps = {
+  claimed: ['citymarkt', 'darkchat', 'feather', 'local-pages'],
+  revision: 3,
+  uninstalled: ['crypto', 'skyride'],
+}
+
+const adminMockDevices = {
+  1: { account: true, number: '555-0101', security: true },
+  2: { account: true, number: '555-0102', security: true },
+}
+
+function adminMockPlayerDetail(source = 1) {
+  const primary = source === 1
+  const deviceState = adminMockDevices[source] ?? adminMockDevices[1]
+  return {
+    birthdate: primary ? '1994-04-16' : '1998-11-03',
+    devices: [
+      {
+        account: deviceState.account
+          ? {
+              email: primary ? 'demo@ifruit.com' : 'jordan@ifruit.com',
+              id: primary ? 1 : 2,
+              passwordAvailable: true,
+            }
+          : null,
+        apps: { ...adminMockApps },
+        createdAt: '2026-08-15 18:42:00',
+        imei: primary ? '356938035643809' : '356938035643810',
+        name: primary ? 'Personal iFruit Phone' : 'Service iFruit Phone',
+        number: deviceState.number,
+        security: {
+          enabled: deviceState.security,
+          failedAttempts: 0,
+          length: deviceState.security ? 6 : null,
+          lockedUntil: 0,
+        },
+        simRegistered: true,
+        simType: 'standard',
+        updatedAt: '2026-08-20 19:04:00',
+      },
+    ],
+    firstName: primary ? 'Alex' : 'Jordan',
+    identifier: primary ? 'char1:demo' : 'char1:jordan',
+    job: {
+      grade: primary ? 4 : 1,
+      gradeLabel: primary ? 'Chief' : 'Officer',
+      label: 'Los Santos Police Department',
+      name: 'police',
+      onDuty: true,
+    },
+    lastName: primary ? 'Morgan' : 'Blake',
+    money: {
+      bank: primary ? 182450 : 28450,
+      cash: primary ? 2740 : 950,
+      currency: '$',
+    },
+    name: primary ? 'Alex Morgan' : 'Jordan Blake',
+    serverName: primary ? 'Skyline' : 'JordanB',
+    source,
+  }
+}
+
+function adminMockBootstrap() {
+  return {
+    audit: [
+      {
+        action: 'grant_app',
+        actorName: 'Skyline',
+        createdAt: '2026-08-20 19:04:00',
+        details: { appId: 'darkchat' },
+        deviceImei: '356938035643810',
+        id: 1,
+        targetIdentifier: 'char1:jordan',
+        targetSource: 2,
+      },
+    ],
+    players: [1, 2].map((source) => {
+      const player = adminMockPlayerDetail(source)
+      return {
+        deviceCount: player.devices.length,
+        grade: player.job.grade,
+        identifier: player.identifier,
+        job: player.job.name,
+        name: player.name,
+        onDuty: player.job.onDuty,
+        phoneNumber: player.devices[0]?.number ?? null,
+        serverName: player.serverName,
+        source,
+      }
+    }),
+    stats: { accounts: 24, devices: 31, online: 2 },
+  }
+}
+
+const adminMockConfiguratorBase = {
+  enabled: true,
+  revision: 4,
+  sections: [
+    {
+      id: 'config:Bridge',
+      label: 'Bridge',
+      scope: 'config',
+      fields: [
+        {
+          label: 'Framework',
+          path: 'Bridge.Framework',
+          scope: 'config',
+          sensitive: false,
+          type: 'string',
+          value: 'auto',
+        },
+        {
+          label: 'Inventory',
+          path: 'Bridge.Inventory',
+          scope: 'config',
+          sensitive: false,
+          type: 'string',
+          value: 'auto',
+        },
+        {
+          label: 'Locale',
+          path: 'Bridge.Locale',
+          scope: 'config',
+          sensitive: false,
+          type: 'string',
+          value: 'de',
+        },
+        {
+          label: 'Callback Timeout',
+          path: 'Bridge.CallbackTimeout',
+          scope: 'config',
+          sensitive: false,
+          type: 'number',
+          value: 15000,
+        },
+        {
+          label: 'Debug',
+          path: 'Bridge.Debug',
+          scope: 'config',
+          sensitive: false,
+          type: 'boolean',
+          value: false,
+        },
+      ],
+    },
+    {
+      id: 'config:Phone',
+      label: 'Phone',
+      scope: 'config',
+      fields: [
+        {
+          label: 'Item',
+          path: 'Phone.Item',
+          scope: 'config',
+          sensitive: false,
+          type: 'string',
+          value: 'phone',
+        },
+        {
+          label: 'Unique',
+          path: 'Phone.Unique',
+          scope: 'config',
+          sensitive: false,
+          type: 'boolean',
+          value: true,
+        },
+        {
+          label: 'Keybind',
+          path: 'Phone.Keybind',
+          scope: 'config',
+          sensitive: false,
+          type: 'string',
+          value: 'F1',
+        },
+        {
+          label: 'Device Name',
+          path: 'Phone.DeviceName',
+          scope: 'config',
+          sensitive: false,
+          type: 'string',
+          value: 'iFruit Phone',
+        },
+      ],
+    },
+    {
+      id: 'config:Companies',
+      label: 'Companies',
+      scope: 'config',
+      fields: [
+        {
+          label: 'Enabled',
+          path: 'Companies.Enabled',
+          scope: 'config',
+          sensitive: false,
+          type: 'boolean',
+          value: true,
+        },
+        {
+          label: 'Categories',
+          path: 'Companies.Categories',
+          scope: 'config',
+          sensitive: false,
+          type: 'json',
+          value: ['public_services', 'vehicles', 'transport'],
+        },
+      ],
+    },
+    {
+      id: 'media:FiveManage',
+      label: 'Five Manage',
+      scope: 'media',
+      fields: [
+        {
+          configured: true,
+          label: 'Api Key',
+          path: 'FiveManage.ApiKey',
+          scope: 'media',
+          sensitive: true,
+          type: 'string',
+          value: '',
+        },
+        {
+          label: 'Base Url',
+          path: 'FiveManage.BaseUrl',
+          scope: 'media',
+          sensitive: false,
+          type: 'string',
+          value: 'https://api.fivemanage.com/api/v3/file',
+        },
+        {
+          label: 'Upload Timeout Ms',
+          path: 'FiveManage.UploadTimeoutMs',
+          scope: 'media',
+          sensitive: false,
+          type: 'number',
+          value: 25000,
+        },
+      ],
+    },
+    {
+      id: 'media:Import',
+      label: 'Import',
+      scope: 'media',
+      fields: [
+        {
+          label: 'Enabled',
+          path: 'Import.Enabled',
+          scope: 'media',
+          sensitive: false,
+          type: 'boolean',
+          value: true,
+        },
+        {
+          label: 'Websites',
+          path: 'Import.Websites',
+          scope: 'media',
+          sensitive: false,
+          type: 'json',
+          value: [
+            {
+              Adapter: 'fivemanage',
+              Enabled: true,
+              Id: 'fivemanage',
+              Label: 'FiveManage',
+            },
+          ],
+        },
+      ],
+    },
+  ],
+  updatedAt: '2026-08-20 20:15:00',
+  updatedBy: 'Alex Morgan',
+}
+
+const adminMockConfigurator = {
+  ...adminMockConfiguratorBase,
+  sections: loadConfiguratorSections(),
+}
+
 app.post('/api/:endpoint', async (request, response, next) => {
   const endpoint = request.params.endpoint
   const loggedBody = { ...request.body }
   if (typeof loggedBody.password === 'string')
     loggedBody.password = '<redacted>'
+  if (
+    endpoint === 'admin:save-configurator' &&
+    Array.isArray(loggedBody.changes)
+  ) {
+    loggedBody.changes = loggedBody.changes.map((change) => ({
+      ...change,
+      value: /api.?key|pepper|secret|token|password/i.test(
+        String(change.path ?? ''),
+      )
+        ? '<redacted>'
+        : change.value,
+    }))
+  }
   if (endpoint === 'memos:devCapture') {
     loggedBody.audioDataUrl = `<${String(request.body.audioDataUrl ?? '').length} characters>`
   }
@@ -4663,6 +4955,153 @@ app.post('/api/:endpoint', async (request, response, next) => {
     response.json({ success: true, data: musicBootstrap() })
     return
   }
+  if (endpoint === 'admin:bootstrap') {
+    response.json({ success: true, data: adminMockBootstrap() })
+    return
+  }
+  if (endpoint === 'admin:configurator') {
+    response.json({ success: true, data: adminMockConfigurator })
+    return
+  }
+  if (endpoint === 'admin:save-configurator') {
+    const changes = Array.isArray(request.body.changes)
+      ? request.body.changes
+      : []
+    for (const change of changes) {
+      for (const section of adminMockConfigurator.sections) {
+        const field = section.fields.find(
+          (candidate) =>
+            candidate.scope === change.scope && candidate.path === change.path,
+        )
+        if (!field) continue
+        if (field.sensitive)
+          field.configured = String(change.value ?? '') !== ''
+        else field.value = change.value
+      }
+    }
+    adminMockConfigurator.revision += 1
+    adminMockConfigurator.updatedAt = new Date().toISOString()
+    response.json({ success: true, data: adminMockConfigurator })
+    return
+  }
+  if (endpoint === 'admin:player') {
+    response.json({
+      success: true,
+      data: adminMockPlayerDetail(Number(request.body.source) || 1),
+    })
+    return
+  }
+  if (endpoint === 'admin:save-apps') {
+    const changes = Array.isArray(request.body.changes)
+      ? request.body.changes
+      : []
+    for (const change of changes) {
+      const appId = String(change.appId ?? '')
+      const installed = change.installed === true
+      adminMockApps.claimed = adminMockApps.claimed.filter((id) => id !== appId)
+      adminMockApps.uninstalled = adminMockApps.uninstalled.filter(
+        (id) => id !== appId,
+      )
+      if (installed) adminMockApps.claimed.push(appId)
+      else adminMockApps.uninstalled.push(appId)
+    }
+    adminMockApps.revision += 1
+    response.json({
+      success: true,
+      data: adminMockPlayerDetail(Number(request.body.source) || 1),
+    })
+    return
+  }
+  if (endpoint === 'admin:close') {
+    response.json({ success: true })
+    return
+  }
+  if (endpoint === 'admin:reveal-password') {
+    response.json({
+      success: true,
+      data: { email: 'demo@ifruit.com', password: 'mock-only-password' },
+    })
+    return
+  }
+  if (endpoint === 'admin:activity') {
+    if (request.body.kind === 'messages') {
+      response.json({
+        success: true,
+        data: {
+          kind: 'messages',
+          entries: [
+            {
+              body: 'Meet at Mission Row in ten minutes.',
+              createdAt: '2026-08-20 19:03:00',
+              direction: 'outgoing',
+              id: 'admin-message-1',
+              messageType: 'text',
+              otherNumber: '555-0144',
+              readAt: '2026-08-20 19:03:30',
+            },
+            {
+              body: 'Copy, I am on my way.',
+              createdAt: '2026-08-20 18:58:00',
+              direction: 'incoming',
+              id: 'admin-message-2',
+              messageType: 'text',
+              otherNumber: '555-0199',
+              readAt: null,
+            },
+          ],
+        },
+      })
+      return
+    }
+    response.json({
+      success: true,
+      data: {
+        kind: 'calls',
+        entries: [
+          {
+            answeredAt: '2026-08-20 18:49:05',
+            direction: 'incoming',
+            durationSeconds: 184,
+            endedAt: '2026-08-20 18:52:09',
+            id: 'admin-call-1',
+            otherNumber: '555-0177',
+            startedAt: '2026-08-20 18:49:00',
+            status: 'completed',
+          },
+          {
+            answeredAt: null,
+            direction: 'outgoing',
+            durationSeconds: 0,
+            endedAt: '2026-08-20 17:13:18',
+            id: 'admin-call-2',
+            otherNumber: '555-0112',
+            startedAt: '2026-08-20 17:13:00',
+            status: 'missed',
+          },
+        ],
+      },
+    })
+    return
+  }
+  if (endpoint === 'admin:reset-passcode') {
+    const source = Number(request.body.source) || 1
+    adminMockDevices[source].security = false
+    response.json({ success: true, data: adminMockPlayerDetail(source) })
+    return
+  }
+  if (endpoint === 'admin:change-number') {
+    const source = Number(request.body.source) || 1
+    adminMockDevices[source].number = String(request.body.phoneNumber ?? '')
+    response.json({ success: true, data: adminMockPlayerDetail(source) })
+    return
+  }
+  if (endpoint === 'admin:factory-reset') {
+    const source = Number(request.body.source) || 1
+    adminMockDevices[source].account = false
+    adminMockDevices[source].security = false
+    response.json({ success: true, data: adminMockPlayerDetail(source) })
+    return
+  }
   if (endpoint === 'music:add-youtube') {
     const value = String(request.body.url ?? '')
     const customTitle = String(request.body.title ?? '').trim()
diff --git a/sky_phone/config/config.lua b/sky_phone/config/config.lua
index eb35208..26ee31a 100644
--- a/sky_phone/config/config.lua
+++ b/sky_phone/config/config.lua
@@ -10,6 +10,12 @@
     Keep option names unchanged. Restart sky_phone after editing this file.
 ]]
 
+-- When enabled, config.lua and media.lua only provide first-run defaults.
+-- The active configuration is loaded from SQL and managed through /phonepanel.
+Config.PhoneConfigurator = {
+    Enabled = true,
+}
+
 -- =============================================================================
 -- Core, framework and device
 -- =============================================================================
@@ -48,7 +54,7 @@ Config.CustomApps = {
     Enabled = true,
     BundledApps = true,
     ExternalApps = true,
-    Debug = true, -- detailed client traces for exports, registration, catalog sync and lifecycle events
+    Debug = false, -- detailed client traces for exports, registration, catalog sync and lifecycle events
     ReadyTimeoutMs = 8000,
     MaximumMessageBytes = 65536,
     MaximumStorageBytesPerApp = 262144,
@@ -65,6 +71,18 @@ Config.Security = {
     AttemptsPerMinute = 12,
 }
 
+Config.AdminPanel = {
+    Enabled = true,
+    Command = "phonepanel",
+    AdminGroups = { "admin", "superadmin" },
+    MaximumPlayers = 128,
+    ReadRequestsPerMinute = 60,
+    ActionRequestsPerMinute = 30,
+    CredentialRevealsPerMinute = 6,
+    AuditLimit = 40,
+    ActivityLimit = 40,
+}
+
 Config.Sim = {
     Enabled = true, -- false: devices receive a persistent random number automatically; hex/esx require false
     RegisteredItem = "sky_phone_sim_registered",
diff --git a/sky_phone/config/locales/de.lua b/sky_phone/config/locales/de.lua
index 98c2873..565ab7b 100644
--- a/sky_phone/config/locales/de.lua
+++ b/sky_phone/config/locales/de.lua
@@ -1,5 +1,13 @@
 Locales["de"] = {
     CommandDescription = "Öffne dein Handy.",
+    AdminCommand = {
+        CommandDescription = "Öffne Handy-Administration und -Konfiguration.",
+        Errors = {
+            disabled = "Das Handy-Admin-Panel ist deaktiviert.",
+            not_authorized = "Du hast keinen Zugriff auf das Handy-Admin-Panel.",
+            default = "Das Handy-Admin-Panel konnte nicht geöffnet werden.",
+        },
+    },
     Controls = {
         OpenPhone = "Handy öffnen",
     },
@@ -193,6 +201,28 @@ Locales["de"] = {
                 contacts = { name = "Favoriten", description = "Rufe deine Lieblingskontakte an oder schreibe ihnen.", choose = "Lieblingskontakte" },
             },
         },
+        AdminPanel = {
+            name = "Phone Admin", subtitle = "Administration", navigation = "Admin-Navigation", refresh = "Admin-Daten aktualisieren", loading = "Geschützte Daten werden geladen...",
+            tabs = { overview = "Übersicht", players = "Spieler", devices = "Geräte", apps = "Apps", accounts = "Accounts", messages = "Nachrichten", calls = "Anrufe", moderation = "Moderation", audit = "Audit", configurator = "Phone Configurator" },
+            overview = { eyebrow = "Server", title = "Dashboard", body = "Spieler, Geräte, Apps und Handydaten.", stats = "Server-Handystatistik", online = "Online", devices = "Geräte", accounts = "Accounts", audit = "Audit-Einträge", control = "Navigation", features = "Module", featuresBody = "Öffne ein Verwaltungsmodul.", recent = "Letzte Aktivitäten", playerFeature = "Identität, Finanzen, Job und Dienst", deviceFeature = "IMEI, SIM, Nummer und Aktivität", appFeature = "Handy-Apps installieren oder entfernen", accountFeature = "Accountzugriff und geschützte Zugangsdaten", messageFeature = "Letzte SMS-Aktivitäten prüfen", callFeature = "Letzte Anrufaktivitäten prüfen", moderationFeature = "Zugriff, Nummer oder Gerätedaten zurücksetzen", auditFeature = "Sensible Admin-Aktionen prüfen", configuratorFeature = "config.lua und media.lua über SQL verwalten" },
+            appearance = { eyebrow = "Darstellung", title = "Akzentfarbe", body = "Ändere den Akzent im gesamten Admin-Arbeitsbereich.", colors = { emerald = "Smaragd", blue = "Blau", violet = "Violett", orange = "Orange", red = "Rot" } },
+            configurator = { context = "Runtime-Konfiguration", eyebrow = "Systemwerkzeug", sections = "Konfiguration", search = "Einstellungen oder Pfade suchen", configScope = "config.lua", mediaScope = "media.lua", noResults = "Keine passenden Einstellungen", loading = "SQL-Konfiguration wird geladen...", title = "Phone Configurator", body = "Verwalte Handy- und Media-Einstellungen im geschützten Admin-Bereich.", disabledTitle = "SQL-Konfiguration ist nicht aktiv", disabledBody = "Aktiviere den Configurator am Anfang der config.lua und starte sky_phone neu. Bis dahin bleiben die Dateiwerte aktiv und die Bearbeitung gesperrt.", manualSave = "Manuelles Speichern", refreshNotice = "Nichts wird automatisch gespeichert. Der grüne Haken prüft config.lua und media.lua in SQL und aktualisiert die aktive Server-, Client-, Media- und UI-Konfiguration sofort intern.", fieldCount = "{count} Felder", secretConfigured = "Secret gesetzt · Ersatzwert eingeben", invalidValue = "Prüfe den markierten Tabellen- oder Zahlenwert.", saved = "SQL-Konfiguration gespeichert und übernommen.", descriptions = { featureToggle = "Schaltet {name} ein oder aus.", boolean = "Legt fest, ob {name} erlaubt ist.", number = "Legt den Zahlenwert für {name} fest.", text = "Legt den Textwert für {name} fest.", optionalText = "Legt den optionalen Wert für {name} fest; der Schalter deaktiviert ihn.", list = "Verwaltet alle Einträge für {name}.", table = "Bündelt die zusammengehörigen Einstellungen für {name}.", credential = "Speichert den geschützten Zugangsschlüssel für {name}.", url = "Legt die URL oder den Endpunkt für {name} fest.", hosts = "Legt die erlaubten Domains für {name} fest.", milliseconds = "Legt die Zeit für {name} in Millisekunden fest.", seconds = "Legt die Zeit für {name} in Sekunden fest.", rateLimit = "Begrenzt die Aktionen für {name} pro Minute.", byteLimit = "Legt die maximal erlaubte Datengröße für {name} fest.", textLimit = "Legt die maximal erlaubte Textlänge für {name} fest.", distance = "Legt die Distanz in der Spielwelt für {name} fest.", coordinates = "Legt Weltkoordinaten oder Ausrichtung für {name} fest.", gameAsset = "Legt das GTA-Modell oder Prop für {name} fest.", animation = "Legt die Animationsdatei für {name} fest.", access = "Legt Jobs, Gruppen oder Berechtigungsstufen für {name} fest.", integration = "Wählt Framework oder Anbieter für {name} aus.", path = "Legt den Speicher- oder Ressourcenpfad für {name} fest.", color = "Legt die Oberflächenfarbe für {name} fest.", displayText = "Legt den Spielern angezeigten Text für {name} fest.", phoneNumber = "Legt die Telefon- oder Servicenummer für {name} fest.", routing = "Steuert die Verteilung eingehender Anfragen für {name}.", command = "Legt den Chat-Befehl zum Öffnen oder Ausführen von {name} fest.", locale = "Wählt die Sprache für {name} aus.", debug = "Steuert ausführliche Diagnoseausgaben für {name}.", mediaQuality = "Legt Medienqualität oder Lautstärke für {name} fest.", amount = "Legt die maximale oder angezeigte Menge für {name} fest." }, table = { list = "Liste", table = "Schlüsseltabelle", vector = "Vektor", entry = "Eintrag", general = "Allgemein", addRow = "Zeile hinzufügen", addField = "Feld hinzufügen", remove = "Entfernen", emptyList = "Noch keine Zeilen. Füge die erste Zeile mit Plus hinzu.", emptyTable = "Noch keine Felder. Füge unten den ersten Schlüssel hinzu.", keyPlaceholder = "Neuer Schlüssel", convertToList = "Als Liste nutzen", convertToMap = "Als typisierte Schlüsseltabelle nutzen", convertToTable = "Als Schlüsseltabelle nutzen", types = { string = "Text", number = "Zahl", boolean = "Schalter", list = "Liste", table = "Tabelle" } } },
+            players = { eyebrow = "Aktive Sitzungen", title = "Online-Spieler", online = "Jetzt online", empty = "Keine Spieler gefunden", emptyBody = "Passe die Suche an oder aktualisiere die Spielerliste." },
+            search = { players = "Name, ID, Job oder Nummer suchen", apps = "Apps suchen", clear = "Suche leeren" },
+            detail = { character = "Charakterprofil", data = "Spielerdatenübersicht", cash = "Bargeld", bank = "Bank", job = "Job", duty = "Dienst", onDuty = "Im Dienst", offDuty = "Außer Dienst", identity = "Identität", playerData = "Spielerdaten", identifier = "Charakter-Identifier", birthdate = "Geburtsdatum", grade = "Job-Rang", unknown = "Unbekannt" },
+            devices = { eyebrow = "Gerätesteuerung", title = "Handys", body = "Prüfe alle Handys des ausgewählten Spielers.", choose = "Handy auswählen", empty = "Kein Handy gefunden", emptyBody = "Dieser Spieler besitzt aktuell kein verwaltbares Handy.", noNumber = "Keine Telefonnummer", noSim = "Keine SIM", imei = "IMEI", updated = "Letzte Aktivität", apps = "Zugewiesene Apps", account = "Verknüpfter Account" },
+            credentials = { eyebrow = "Geschützte Daten", title = "Zugangsdaten", email = "iFruit-E-Mail", password = "iFruit-Passwort", reveal = "Anzeigen", copy = "Passwort kopieren", copied = "Passwort kopiert.", noAccount = "Mit diesem Handy ist kein iFruit-Account verknüpft.", passcode = "Gerätecode", passcodeHashed = "{length}-stellige PIN · sicher gehasht und nicht wiederherstellbar", passcodeDisabled = "Kein Gerätecode eingerichtet", revealTitle = "Geschütztes Passwort anzeigen?", revealBody = "Diese Aktion wird serverseitig autorisiert, rate-limitiert und im Admin-Audit protokolliert.", cancel = "Abbrechen", confirmReveal = "Passwort anzeigen" },
+            apps = { eyebrow = "Fernverwaltung", title = "App-Zugriff", description = "Lege App-Zugriffe für dieses Gerät als Entwurf fest. Erst Speichern übernimmt die Änderungen.", installed = "Installiert", available = "Verfügbar", protected = "System-App", changes = "{count} offene Änderungen" },
+            activity = { protected = "Geschützte Aktivität", messagesTitle = "Nachrichten", messagesBody = "Letzte SMS-Aktivitäten der ausgewählten SIM.", callsTitle = "Anrufe", callsBody = "Letzte Anrufaktivitäten der ausgewählten SIM.", loading = "Aktivitäten werden geladen...", incoming = "Eingehend", outgoing = "Ausgehend", mediaMessage = "{type}-Nachricht", noMessages = "Keine Nachrichtenaktivität gefunden.", noCalls = "Keine Anrufaktivität gefunden.", status = { completed = "Abgeschlossen", missed = "Verpasst", rejected = "Abgelehnt", busy = "Besetzt", unanswered = "Unbeantwortet", cancelled = "Abgebrochen", failed = "Fehlgeschlagen", ringing = "Klingelt" } },
+            moderation = {
+                eyebrow = "Geräteverwaltung", title = "Moderationsaktionen", body = "Jede Aktion wird serverseitig autorisiert, rate-limitiert und protokolliert.", resetPasscode = "Gerätecode zurücksetzen", resetPasscodeBody = "Entfernt die Geräte-PIN und fehlgeschlagene Versuche.", changeNumber = "Nummer ändern", changeNumberBody = "Weist der aktuellen SIM eine neue eindeutige Nummer zu.", factoryReset = "Werksreset", factoryResetBody = "Löscht lokale Gerätedaten und trennt den Account.", saveFirst = "Speichere oder verwirf zuerst offene App-Änderungen.", phoneNumber = "Neue Telefonnummer", phoneNumberPlaceholder = "Vollständige konfigurierte Nummer eingeben", typeToConfirm = "Tippe {word}, um den Werksreset zu bestätigen.", confirmWord = "RESET", cancel = "Abbrechen", ["reset-passcodeSuccess"] = "Gerätecode zurückgesetzt.", ["change-numberSuccess"] = "Telefonnummer geändert.", ["factory-resetSuccess"] = "Werksreset abgeschlossen.",
+                dialogs = { ["reset-passcodeTitle"] = "Gerätecode zurücksetzen?", ["reset-passcodeBody"] = "Der Spieler kann dieses Handy danach ohne die bisherige PIN entsperren.", ["change-numberTitle"] = "Telefonnummer ändern?", ["change-numberBody"] = "Die neue Nummer muss dem Serverformat entsprechen und eindeutig sein.", ["factory-resetTitle"] = "Werksreset für dieses Handy?", ["factory-resetBody"] = "Lokale Gerätedaten, App-Einstellungen, Sicherheit und der verknüpfte Account werden gelöscht. Das kann nicht rückgängig gemacht werden." },
+                confirm = { ["reset-passcode"] = "Gerätecode zurücksetzen", ["change-number"] = "Nummer ändern", ["factory-reset"] = "Werksreset" },
+            },
+            audit = { eyebrow = "Nachvollziehbarkeit", title = "Audit-Verlauf", body = "Sensible Anzeigen und App-Änderungen werden hier protokolliert.", empty = "Noch keine Admin-Aktionen", emptyBody = "Geschützte Aktionen erscheinen hier, nachdem sie ausgeführt wurden.", by = "{actor} · Ziel-ID {target}", actions = { grant_app = "App installiert", revoke_app = "App entfernt", reveal_account_password = "Passwort angezeigt", view_messages = "Nachrichten angesehen", view_calls = "Anrufe angesehen", reset_passcode = "Gerätecode zurückgesetzt", change_number = "Telefonnummer geändert", factory_reset = "Werksreset ausgeführt", save_configuration = "Konfiguration gespeichert" } },
+            editor = { brand = "SKY PHONE", workspace = "ADMIN", players = "Spielerverzeichnis", audit = "Audit-Protokoll", selectPlayer = "Wähle einen Spieler, um Identität, Geräte, Zugangsdaten und App-Zugriffe zu prüfen.", save = "Änderungen speichern", saveHint = "Offene Änderungen übernehmen", saved = "Änderungen gespeichert.", unsaved = "Ungespeicherte Änderungen", close = "Admin-Panel schließen", refresh = "Live-Daten aktualisieren", online = "LIVE", profile = "PROFIL", financial = "FINANZEN", device = "GERÄT", security = "SICHERHEIT", noAutoSave = "Manuelles Speichern", noAutoSaveBody = "Änderungen bleiben lokal, bis der grüne Haken gedrückt wird.", discardTitle = "Ungespeicherte Änderungen verwerfen?", discardBody = "Deine vorgemerkten App- oder Konfigurationsänderungen wurden noch nicht gespeichert.", keepEditing = "Weiter bearbeiten", discard = "Änderungen verwerfen", saveFailed = "Einige Änderungen konnten nicht gespeichert werden.", noSelection = "Kein Spieler ausgewählt" },
+            errors = { not_authorized = "Du hast keinen Zugriff auf das Admin-Panel.", rate_limited = "Zu viele Admin-Anfragen. Bitte warte.", player_unavailable = "Dieser Spieler ist nicht mehr online.", device_not_owned = "Dieses Handy gehört nicht mehr zum ausgewählten Spieler.", invalid_app = "Diese App ist nicht auf dem Server registriert.", app_protected = "Diese System-App kann nicht entfernt werden.", revision_conflict = "Die Daten wurden zwischenzeitlich geändert. Öffne den Bereich neu und versuche es erneut.", configurator_disabled = "Aktiviere zuerst den Phone Configurator in der config.lua.", invalid_field = "Dieses Konfigurationsfeld ist nicht mehr verfügbar.", invalid_value = "Ein Konfigurationswert ist ungültig.", account_not_found = "Mit diesem Handy ist kein iFruit-Account verknüpft.", invalid_phone_number = "Gib eine Telefonnummer im konfigurierten Serverformat ein.", phone_number_unchanged = "Diese SIM verwendet diese Telefonnummer bereits.", phone_number_taken = "Diese Telefonnummer ist bereits vergeben.", no_sim = "Dieses Handy besitzt keine änderbare SIM.", passcode_not_set = "Für dieses Handy ist kein Gerätecode eingerichtet.", device_not_found = "Dieses Handy existiert nicht mehr.", metadata_unsupported = "Die Inventar-Metadaten des Handys konnten nicht aktualisiert werden.", invalid_request = "Die Admin-Anfrage war ungültig.", request_failed = "Die Admin-Anfrage ist fehlgeschlagen.", default = "Das Admin-Panel ist vorübergehend nicht verfügbar." },
+        },
         Apps = {
             health = {
                 name = "Gesundheit",
@@ -2107,3 +2137,68 @@ Locales["de"] = {
         },
     },
 }
+
+Locales["de"].Nui.AdminPanel.configurator.table.subtabs = {
+    AdminGroups = "Admin-Gruppen",
+    Dictionaries = "Animationsdateien",
+    Clips = "Clips",
+    Transforms = "Transformationen",
+    RateLimits = "Ratenlimits",
+    Publishers = "Herausgeber",
+    ExternalPingResources = "Externe Ping-Ressourcen",
+    Markets = "Märkte",
+    TrustedAdapters = "Vertrauenswürdige Adapter",
+    AllowedDisappearTimers = "Erlaubte Löschzeiten",
+    MusicTracks = "Musiktitel",
+    VehicleImages = "Fahrzeugbilder",
+    Custom = "Benutzerdefiniert",
+    Valet = "Parkservice",
+    AutoPriority = "Automatische Priorität",
+    Camera = "Kamera",
+    Categories = "Kategorien",
+    Districts = "Bezirke",
+    PhotoGradients = "Fotoverläufe",
+    LbPhone = "LB Phone",
+    Tracks = "Titel",
+    Props = "Props",
+    CustomLocations = "Benutzerdefinierte Standorte",
+    Animation = "Animation",
+    ReportReasons = "Meldegründe",
+    DisplayName = "Anzeigename",
+    Hud = "HUD",
+    Badge = "Abzeichen",
+    LockedChannels = "Gesperrte Kanäle",
+    NumberGroups = "Nummerngruppen",
+    CustomFare = "Benutzerdefinierter Tarif",
+    DriverJobs = "Fahrerjobs",
+    Services = "Dienstleistungen",
+    QuickLocations = "Schnellziele",
+    AllowedJobs = "Erlaubte Jobs",
+    Websites = "Webseiten",
+}
+
+Locales["de"].Nui.AdminPanel.appearance.title = "Oberfläche"
+Locales["de"].Nui.AdminPanel.appearance.body = "Passe Farben und Typografie im gesamten Admin-Bereich an."
+Locales["de"].Nui.AdminPanel.appearance.controls = {
+    customColor = "Eigene Farbe",
+    customColorBody = "Wähle einen beliebigen RGB-Akzent oder trage die Farbwerte ein.",
+    red = "R",
+    green = "G",
+    blue = "B",
+    hex = "HEX-Farbe",
+    value = "Wert",
+    fontFamily = "Schriftart",
+    fontFamilyBody = "Wähle die Schrift für das gesamte Admin-Panel.",
+    fontSize = "Schriftgröße",
+    fontSizeBody = "Skaliere Text und Bedienelemente für eine angenehme Lesbarkeit.",
+    fonts = {
+        inter = "Inter",
+        system = "System",
+        classic = "Klassisch",
+        verdana = "Verdana",
+        tahoma = "Tahoma",
+        trebuchet = "Trebuchet",
+        georgia = "Georgia",
+        mono = "Monospace",
+    },
+}
diff --git a/sky_phone/config/locales/en.lua b/sky_phone/config/locales/en.lua
index 6111be6..26b74fe 100644
--- a/sky_phone/config/locales/en.lua
+++ b/sky_phone/config/locales/en.lua
@@ -1,5 +1,13 @@
 Locales["en"] = {
     CommandDescription = "Open your phone.",
+    AdminCommand = {
+        CommandDescription = "Open phone administration and configuration.",
+        Errors = {
+            disabled = "The phone admin panel is disabled.",
+            not_authorized = "You do not have access to the phone admin panel.",
+            default = "The phone admin panel could not be opened.",
+        },
+    },
     Controls = {
         OpenPhone = "Open phone",
     },
@@ -193,6 +201,28 @@ Locales["en"] = {
                 contacts = { name = "Favorites", description = "Call or message your favorite contacts.", choose = "Favorite Contacts" },
             },
         },
+        AdminPanel = {
+            name = "Phone Admin", subtitle = "Administration", navigation = "Admin navigation", refresh = "Refresh admin data", loading = "Loading protected data...",
+            tabs = { overview = "Overview", players = "Players", devices = "Devices", apps = "Apps", accounts = "Accounts", messages = "Messages", calls = "Calls", moderation = "Moderation", audit = "Audit", configurator = "Phone configurator" },
+            overview = { eyebrow = "Server", title = "Dashboard", body = "Players, devices, apps, and phone data.", stats = "Server phone statistics", online = "Online", devices = "Devices", accounts = "Accounts", audit = "Audit entries", control = "Navigation", features = "Modules", featuresBody = "Open an administration module.", recent = "Recent activity", playerFeature = "Identity, finances, job, and duty", deviceFeature = "IMEI, SIM, number, and activity", appFeature = "Install or remove phone apps", accountFeature = "Account access and protected credentials", messageFeature = "Review recent SMS activity", callFeature = "Review recent call activity", moderationFeature = "Reset access, number, or device data", auditFeature = "Review sensitive admin actions", configuratorFeature = "Manage config.lua and media.lua through SQL" },
+            appearance = { eyebrow = "Appearance", title = "Accent color", body = "Change the accent across the complete admin workspace.", colors = { emerald = "Emerald", blue = "Blue", violet = "Violet", orange = "Orange", red = "Red" } },
+            configurator = { context = "Runtime configuration", eyebrow = "System tool", sections = "Configuration", search = "Search settings or paths", configScope = "config.lua", mediaScope = "media.lua", noResults = "No matching settings", loading = "Loading SQL configuration...", title = "Phone configurator", body = "Manage phone and media settings from the protected admin workspace.", disabledTitle = "SQL configuration is not active", disabledBody = "Enable the configurator at the beginning of config.lua and restart sky_phone. Until then, file values remain active and editing is locked.", manualSave = "Manual save", refreshNotice = "Nothing is written automatically. The green check verifies config.lua and media.lua in SQL and refreshes the active server, client, media and UI configuration immediately.", fieldCount = "{count} fields", secretConfigured = "Secret configured · enter a replacement", invalidValue = "Check the highlighted table or number value.", saved = "SQL configuration saved and applied.", descriptions = { featureToggle = "Turns {name} on or off.", boolean = "Controls whether {name} is allowed.", number = "Sets the numeric value for {name}.", text = "Sets the text value used for {name}.", optionalText = "Sets the optional value for {name}; switch it off to disable it.", list = "Manages all entries used for {name}.", table = "Groups the related settings for {name}.", credential = "Stores the protected credential used by {name}.", url = "Sets the URL or endpoint used by {name}.", hosts = "Defines which domains are allowed for {name}.", milliseconds = "Sets the timing for {name} in milliseconds.", seconds = "Sets the timing for {name} in seconds.", rateLimit = "Limits how many {name} actions are allowed per minute.", byteLimit = "Sets the maximum data size allowed for {name}.", textLimit = "Sets the maximum text length allowed for {name}.", distance = "Sets the world distance used for {name}.", coordinates = "Sets the world coordinates or orientation for {name}.", gameAsset = "Sets the GTA model or prop used for {name}.", animation = "Sets the animation asset used for {name}.", access = "Defines the jobs, groups or permission level for {name}.", integration = "Selects the connected framework or provider for {name}.", path = "Sets the storage or resource path used for {name}.", color = "Sets the interface color used for {name}.", displayText = "Sets the text shown to players for {name}.", phoneNumber = "Sets the phone or service number used for {name}.", routing = "Controls how incoming requests are routed for {name}.", command = "Sets the chat command used to open or run {name}.", locale = "Selects the language used for {name}.", debug = "Controls detailed diagnostic output for {name}.", mediaQuality = "Sets the media quality or volume used for {name}.", amount = "Sets the maximum or displayed amount for {name}." }, table = { list = "List", table = "Key table", vector = "Vector", entry = "Entry", general = "General", addRow = "Add row", addField = "Add field", remove = "Remove", emptyList = "No rows yet. Add the first row with plus.", emptyTable = "No fields yet. Add the first key below.", keyPlaceholder = "New key", convertToList = "Use list", convertToMap = "Use typed key table", convertToTable = "Use key table", types = { string = "Text", number = "Number", boolean = "Switch", list = "List", table = "Table" } } },
+            players = { eyebrow = "Active sessions", title = "Online players", online = "Online now", empty = "No players found", emptyBody = "Adjust the search or refresh the live player list." },
+            search = { players = "Search name, ID, job, or number", apps = "Search apps", clear = "Clear search" },
+            detail = { character = "Character profile", data = "Player data overview", cash = "Cash", bank = "Bank", job = "Job", duty = "Duty", onDuty = "On duty", offDuty = "Off duty", identity = "Identity", playerData = "Player data", identifier = "Character identifier", birthdate = "Birthdate", grade = "Job grade", unknown = "Unknown" },
+            devices = { eyebrow = "Device control", title = "Phones", body = "Inspect every phone assigned to the selected player.", choose = "Choose phone", empty = "No phone found", emptyBody = "This player currently has no phone device that can be managed.", noNumber = "No phone number", noSim = "No SIM", imei = "IMEI", updated = "Last activity", apps = "Claimed apps", account = "Linked account" },
+            credentials = { eyebrow = "Protected data", title = "Credentials", email = "iFruit email", password = "iFruit password", reveal = "Reveal", copy = "Copy password", copied = "Password copied.", noAccount = "No iFruit account is linked to this phone.", passcode = "Device passcode", passcodeHashed = "{length}-digit PIN · securely hashed and not recoverable", passcodeDisabled = "No passcode configured", revealTitle = "Reveal protected password?", revealBody = "This action is server-authorized, rate-limited, and written to the admin audit log.", cancel = "Cancel", confirmReveal = "Reveal password" },
+            apps = { eyebrow = "Remote management", title = "App access", description = "Stage app access for this device. Nothing changes until you save.", installed = "Installed", available = "Available", protected = "System app", changes = "{count} pending changes" },
+            activity = { protected = "Protected activity", messagesTitle = "Messages", messagesBody = "Recent SMS activity for the selected SIM.", callsTitle = "Calls", callsBody = "Recent call activity for the selected SIM.", loading = "Loading activity...", incoming = "Incoming", outgoing = "Outgoing", mediaMessage = "{type} message", noMessages = "No message activity found.", noCalls = "No call activity found.", status = { completed = "Completed", missed = "Missed", rejected = "Rejected", busy = "Busy", unanswered = "Unanswered", cancelled = "Cancelled", failed = "Failed", ringing = "Ringing" } },
+            moderation = {
+                eyebrow = "Device administration", title = "Moderation actions", body = "Every action is server-authorized, rate-limited, and audited.", resetPasscode = "Reset passcode", resetPasscodeBody = "Remove the device PIN and clear failed attempts.", changeNumber = "Change number", changeNumberBody = "Assign a new unique number to the current SIM.", factoryReset = "Factory reset", factoryResetBody = "Clear local device data and disconnect the account.", saveFirst = "Save or discard pending app changes first.", phoneNumber = "New phone number", phoneNumberPlaceholder = "Enter the full configured number", typeToConfirm = "Type {word} to confirm the factory reset.", confirmWord = "RESET", cancel = "Cancel", ["reset-passcodeSuccess"] = "Passcode reset.", ["change-numberSuccess"] = "Phone number changed.", ["factory-resetSuccess"] = "Phone factory reset completed.",
+                dialogs = { ["reset-passcodeTitle"] = "Reset device passcode?", ["reset-passcodeBody"] = "The player can unlock this phone without the previous PIN afterward.", ["change-numberTitle"] = "Change phone number?", ["change-numberBody"] = "The new number must match the configured server number format and be unique.", ["factory-resetTitle"] = "Factory reset this phone?", ["factory-resetBody"] = "This clears local device data, app settings, security, and the linked account. This cannot be undone." },
+                confirm = { ["reset-passcode"] = "Reset passcode", ["change-number"] = "Change number", ["factory-reset"] = "Factory reset" },
+            },
+            audit = { eyebrow = "Accountability", title = "Audit trail", body = "Sensitive reveals and remote app changes are recorded here.", empty = "No admin actions yet", emptyBody = "Protected actions will appear here after they are performed.", by = "{actor} · target ID {target}", actions = { grant_app = "App installed", revoke_app = "App removed", reveal_account_password = "Password revealed", view_messages = "Messages viewed", view_calls = "Calls viewed", reset_passcode = "Passcode reset", change_number = "Phone number changed", factory_reset = "Phone factory reset", save_configuration = "Configuration saved" } },
+            editor = { brand = "SKY PHONE", workspace = "ADMIN", players = "Player directory", audit = "Audit log", selectPlayer = "Select a player to inspect identity, devices, credentials, and app access.", save = "Save changes", saveHint = "Apply pending changes", saved = "Changes saved.", unsaved = "Unsaved changes", close = "Close admin panel", refresh = "Refresh live data", online = "LIVE", profile = "PROFILE", financial = "FINANCIAL", device = "DEVICE", security = "SECURITY", noAutoSave = "Manual save", noAutoSaveBody = "Changes stay local until the green check is pressed.", discardTitle = "Discard unsaved changes?", discardBody = "Your staged app or configuration changes have not been saved.", keepEditing = "Keep editing", discard = "Discard changes", saveFailed = "Some changes could not be saved.", noSelection = "No player selected" },
+            errors = { not_authorized = "You do not have access to the admin panel.", rate_limited = "Too many admin requests. Please wait.", player_unavailable = "That player is no longer online.", device_not_owned = "That phone no longer belongs to the selected player.", invalid_app = "That app is not registered on the server.", app_protected = "This system app cannot be removed.", revision_conflict = "The data changed in the meantime. Reopen the section and try again.", configurator_disabled = "Enable the phone configurator in config.lua first.", invalid_field = "That configuration field is no longer available.", invalid_value = "A configuration value is invalid.", account_not_found = "No iFruit account is linked to this phone.", invalid_phone_number = "Enter a phone number in the configured server format.", phone_number_unchanged = "This SIM already uses that phone number.", phone_number_taken = "That phone number is already assigned.", no_sim = "This phone has no SIM that can be changed.", passcode_not_set = "This phone has no passcode configured.", device_not_found = "This phone no longer exists.", metadata_unsupported = "The phone inventory metadata could not be updated.", invalid_request = "The admin request was invalid.", request_failed = "The admin request failed.", default = "The admin panel is temporarily unavailable." },
+        },
         Apps = {
             health = {
                 name = "Health",
@@ -2107,3 +2137,68 @@ Locales["en"] = {
         },
     },
 }
+
+Locales["en"].Nui.AdminPanel.configurator.table.subtabs = {
+    AdminGroups = "Admin Groups",
+    Dictionaries = "Dictionaries",
+    Clips = "Clips",
+    Transforms = "Transforms",
+    RateLimits = "Rate Limits",
+    Publishers = "Publishers",
+    ExternalPingResources = "External Ping Resources",
+    Markets = "Markets",
+    TrustedAdapters = "Trusted Adapters",
+    AllowedDisappearTimers = "Allowed Disappear Timers",
+    MusicTracks = "Music Tracks",
+    VehicleImages = "Vehicle Images",
+    Custom = "Custom",
+    Valet = "Valet",
+    AutoPriority = "Automatic Priority",
+    Camera = "Camera",
+    Categories = "Categories",
+    Districts = "Districts",
+    PhotoGradients = "Photo Gradients",
+    LbPhone = "LB Phone",
+    Tracks = "Tracks",
+    Props = "Props",
+    CustomLocations = "Custom Locations",
+    Animation = "Animation",
+    ReportReasons = "Report Reasons",
+    DisplayName = "Display Name",
+    Hud = "HUD",
+    Badge = "Badge",
+    LockedChannels = "Locked Channels",
+    NumberGroups = "Number Groups",
+    CustomFare = "Custom Fare",
+    DriverJobs = "Driver Jobs",
+    Services = "Services",
+    QuickLocations = "Quick Locations",
+    AllowedJobs = "Allowed Jobs",
+    Websites = "Websites",
+}
+
+Locales["en"].Nui.AdminPanel.appearance.title = "Interface"
+Locales["en"].Nui.AdminPanel.appearance.body = "Personalize colors and typography across the admin workspace."
+Locales["en"].Nui.AdminPanel.appearance.controls = {
+    customColor = "Custom color",
+    customColorBody = "Choose any RGB accent or enter its channel values.",
+    red = "R",
+    green = "G",
+    blue = "B",
+    hex = "HEX color",
+    value = "value",
+    fontFamily = "Font family",
+    fontFamilyBody = "Choose the typeface used by the complete admin panel.",
+    fontSize = "Font size",
+    fontSizeBody = "Scale text and controls for comfortable readability.",
+    fonts = {
+        inter = "Inter",
+        system = "System",
+        classic = "Classic",
+        verdana = "Verdana",
+        tahoma = "Tahoma",
+        trebuchet = "Trebuchet",
+        georgia = "Georgia",
+        mono = "Monospace",
+    },
+}
diff --git a/sky_phone/config/media.lua b/sky_phone/config/media.lua
index b5eacaa..9763b21 100644
--- a/sky_phone/config/media.lua
+++ b/sky_phone/config/media.lua
@@ -1,8 +1,9 @@
 --[[
     Sky Phone media configuration
 
-    This file is loaded on the server only. Keep API keys private and restart
-    sky_phone after changing providers, upload limits, or import sources.
+    This file is loaded on the server only. Keep API keys private. When the
+    phone configurator is enabled in config.lua, these values are first-run
+    defaults and the active media configuration is loaded from SQL.
 ]]
 
 Config.Media = {
diff --git a/sky_phone/fxmanifest.lua b/sky_phone/fxmanifest.lua
index 5ec709f..350c1c7 100644
--- a/sky_phone/fxmanifest.lua
+++ b/sky_phone/fxmanifest.lua
@@ -32,8 +32,9 @@ client_scripts {
     'config/config.lua',
     'config/locales/en.lua',
     'config/locales/de.lua',
-    'source/bridge/client/framework.lua',
     'source/bridge/client/callbacks.lua',
+    'source/client/phone_configurator.lua',
+    'source/bridge/client/framework.lua',
     'source/bridge/client/housing.lua',
     'source/bridge/client/housing/*.lua',
     'source/bridge/client/calls.lua',
@@ -80,7 +81,9 @@ server_scripts {
     'source/server/update_check.lua',
     'source/bridge/server/database.lua',
     'source/bridge/server/migrations.lua',
+    'source/server/phone_configurator_schema.lua',
     'source/bridge/server/callbacks.lua',
+    'source/server/phone_configurator.lua',
     'source/bridge/server/framework.lua',
     'source/bridge/server/frameworks/*.lua',
     'source/bridge/server/housing.lua',
@@ -101,6 +104,7 @@ server_scripts {
     'source/server/phone.lua',
     'source/server/device_directory.lua',
     'source/server/db_migrate.lua',
+    'source/server/admin.lua',
     'source/server/lb_phone_migration.lua',
     'source/server/custom_app_storage.lua',
     'source/server/payphones.lua',
diff --git a/sky_phone/source/bridge/client/framework.lua b/sky_phone/source/bridge/client/framework.lua
index 1bb8de6..4a157ee 100644
--- a/sky_phone/source/bridge/client/framework.lua
+++ b/sky_phone/source/bridge/client/framework.lua
@@ -21,11 +21,24 @@ local function resolve_framework()
     return nil
 end
 
-framework_name = resolve_framework()
-if not framework_name then
-    error("[sky_phone] No supported framework is running. Configure Config.Bridge.Framework.")
+local function refresh_framework()
+    local resolved = resolve_framework()
+    if resolved ~= "esx" and resolved ~= "qbox" and resolved ~= "qb" then
+        error("[sky_phone] No supported framework is running. Configure Config.Bridge.Framework.")
+    end
+    if resolved == framework_name then
+        return
+    end
+
+    framework_name = resolved
+    esx = nil
+    qb = nil
 end
 
+refresh_framework()
+
+AddEventHandler("sky_phone:configurator:updated", refresh_framework)
+
 function Bridge.Framework.GetName()
     return framework_name
 end
diff --git a/sky_phone/source/bridge/client/radio.lua b/sky_phone/source/bridge/client/radio.lua
index e6ac91f..442f025 100644
--- a/sky_phone/source/bridge/client/radio.lua
+++ b/sky_phone/source/bridge/client/radio.lua
@@ -1,4 +1,5 @@
 local provider
+local configured_voice_provider = Config.Radio.VoiceProvider
 local provider_resources = {
     yaca = "yaca-voice",
     pma = "pma-voice",
@@ -138,8 +139,7 @@ function Bridge.Radio.Join(primary, secondary)
     return false
 end
 
-function Bridge.Radio.Leave()
-    local selected = resolve_provider()
+local function leave_provider(selected)
     if selected == "yaca" then
         exports["yaca-voice"]:enableRadio(false)
     elseif selected == "pma" then
@@ -151,6 +151,10 @@ function Bridge.Radio.Leave()
     end
 end
 
+function Bridge.Radio.Leave()
+    leave_provider(resolve_provider())
+end
+
 function Bridge.Radio.SetVolume(volume)
     local selected = resolve_provider()
     if selected == "yaca" then
@@ -165,6 +169,17 @@ function Bridge.Radio.SetVolume(volume)
     end
 end
 
+AddEventHandler("sky_phone:configurator:updated", function()
+    if configured_voice_provider == Config.Radio.VoiceProvider then
+        return
+    end
+
+    leave_provider(provider)
+    provider = nil
+    configured_voice_provider = Config.Radio.VoiceProvider
+    TriggerEvent("sky_phone:client:radioProviderUpdated")
+end)
+
 AddEventHandler("onResourceStop", function(resource_name)
     if resource_name == GetCurrentResourceName() then
         Bridge.Radio.Leave()
diff --git a/sky_phone/source/bridge/server/housing.lua b/sky_phone/source/bridge/server/housing.lua
index a0238da..ffc6494 100644
--- a/sky_phone/source/bridge/server/housing.lua
+++ b/sky_phone/source/bridge/server/housing.lua
@@ -111,3 +111,8 @@ end
 
 AddEventHandler("onResourceStart", reset_provider)
 AddEventHandler("onResourceStop", reset_provider)
+
+AddEventHandler("sky_phone:configurator:serverUpdated", function()
+    selected_provider_name = nil
+    last_provider_state = nil
+end)
diff --git a/sky_phone/source/client/animations.lua b/sky_phone/source/client/animations.lua
index 911b29c..b37f6b6 100644
--- a/sky_phone/source/client/animations.lua
+++ b/sky_phone/source/client/animations.lua
@@ -384,6 +384,12 @@ reevaluate = function(force)
     end)
 end
 
+AddEventHandler("sky_phone:configurator:updated", function()
+    animation_state.revision = animation_state.revision + 1
+    cleanup_phone()
+    reevaluate(true)
+end)
+
 local function reset_animation_state()
     animation_state.phone_open = false
     animation_state.call_state = nil
diff --git a/sky_phone/source/client/custom_apps.lua b/sky_phone/source/client/custom_apps.lua
index 7714062..d569d78 100644
--- a/sky_phone/source/client/custom_apps.lua
+++ b/sky_phone/source/client/custom_apps.lua
@@ -1567,19 +1567,49 @@ SkyPhoneApps.SendCatalog = send_catalog
 SkyPhoneApps.SetPhoneOpen = set_phone_open
 SkyPhoneApps.RegisterClientHooks = register_bundled_client_hooks
 
-if Config.CustomApps.Enabled and Config.CustomApps.BundledApps then
-    local bundled = SkyPhoneApps.GetBundledManifests()
-    for index = 1, #bundled do
-        local registered, register_error = register_app(normalize_bundled_manifest(bundled[index]))
-        if not registered then
-            error(("[sky_phone] Could not register bundled custom app '%s': %s"):format(
-                bundled[index].id,
-                register_error
-            ))
+local function refresh_bundled_apps()
+    local manifests = Config.CustomApps.Enabled and Config.CustomApps.BundledApps
+        and SkyPhoneApps.GetBundledManifests()
+        or {}
+    local desired_ids = {}
+    for index = 1, #manifests do
+        desired_ids[manifests[index].id] = true
+    end
+
+    local removals = {}
+    for app_id, app in pairs(apps_by_id) do
+        if app.catalog.bundled and not desired_ids[app_id] then
+            removals[#removals + 1] = app_id
         end
     end
+    for index = 1, #removals do
+        remove_registered_app(removals[index], true, false)
+    end
+
+    for index = 1, #manifests do
+        local manifest = manifests[index]
+        local existing = apps_by_id[manifest.id]
+        local normalized = normalize_bundled_manifest(manifest)
+        if existing and existing.catalog.bundled then
+            normalized.hooks = existing.hooks
+            apps_by_id[manifest.id] = normalized
+        elseif not existing then
+            local registered, register_error = register_app(normalized)
+            if not registered then
+                error(("[sky_phone] Could not register bundled custom app '%s': %s"):format(
+                    manifest.id,
+                    register_error
+                ))
+            end
+        end
+    end
+    sync_catalog()
 end
 
+refresh_bundled_apps()
+
+AddEventHandler("sky_phone:configurator:updated", refresh_bundled_apps)
+
 SkyPhoneApps.CompatibilityCore = {
     Add = add_compatibility_app,
     AddServerAuthorized = add_server_authorized_compatibility_app,
diff --git a/sky_phone/source/client/focus.lua b/sky_phone/source/client/focus.lua
index c1b598d..9ba5879 100644
--- a/sky_phone/source/client/focus.lua
+++ b/sky_phone/source/client/focus.lua
@@ -3,19 +3,12 @@ SkyPhoneFocus = {}
 local blocked_phone_controls = { 24, 140, 141, 142, 257, 263, 264 }
 local blocked_phone_look_controls = { 1, 2, 3, 4, 5, 6 }
 local focused_control_groups = { 0, 1, 2 }
-local hold_to_look_config = Config.Phone.HoldToLook
-local hold_to_look_enabled = type(hold_to_look_config) == "table" and hold_to_look_config.Enabled == true
-local hold_to_look_control = hold_to_look_enabled and tonumber(hold_to_look_config.Control) or nil
-if hold_to_look_enabled and (
-    not hold_to_look_control
-    or hold_to_look_control ~= math.floor(hold_to_look_control)
-    or hold_to_look_control < 0
-) then
-    error("[sky_phone] Config.Phone.HoldToLook.Control must be a non-negative whole control index.")
-end
+local hold_to_look_enabled = false
+local hold_to_look_control
 local state = {
+    admin_panel_open = false,
     activity_suspended = false,
-    allow_movement = Config.Phone.AllowMovement,
+    allow_movement = false,
     call_focus = false,
     camera_active = false,
     camera_nui_focused = true,
@@ -33,6 +26,23 @@ local block_game = false
 local block_look = false
 local game_input = false
 
+local function refresh_focus_configuration()
+    local hold_to_look_config = Config.Phone.HoldToLook
+    local enabled = type(hold_to_look_config) == "table" and hold_to_look_config.Enabled == true
+    local control = enabled and tonumber(hold_to_look_config.Control) or nil
+    if enabled and (
+        not control
+        or control ~= math.floor(control)
+        or control < 0
+    ) then
+        error("[sky_phone] Config.Phone.HoldToLook.Control must be a non-negative whole control index.")
+    end
+
+    hold_to_look_enabled = enabled
+    hold_to_look_control = control
+    state.allow_movement = Config.Phone.AllowMovement == true
+end
+
 local function allows_game_input(value)
     local allowed = value.external_game_input
     if allowed == nil then
@@ -41,6 +51,13 @@ local function allows_game_input(value)
     return allowed == true
 end
 
+refresh_focus_configuration()
+
+AddEventHandler("sky_phone:configurator:updated", function()
+    refresh_focus_configuration()
+    SkyPhoneFocus.Reapply()
+end)
+
 function SkyPhoneFocus.ApplyFocusedControls()
     for _, group in ipairs(focused_control_groups) do
         DisableAllControlActions(group)
@@ -61,6 +78,15 @@ function SkyPhoneFocus.ApplyGameInputControls(block_look)
 end
 
 function SkyPhoneFocus.Resolve(state)
+    if state.admin_panel_open then
+        return {
+            block_game = true,
+            cursor = true,
+            focused = true,
+            game_input = false,
+            keep_input = false,
+        }
+    end
     if state.activity_suspended then
         return { block_game = false, cursor = false, focused = false, game_input = false, keep_input = false }
     end
@@ -142,6 +168,15 @@ function SkyPhoneFocus.SetPhone(open, cursor_disabled)
     SkyPhoneFocus.Reapply()
 end
 
+function SkyPhoneFocus.SetAdminPanel(open)
+    state.admin_panel_open = open == true
+    if state.admin_panel_open then
+        state.notification_focus = false
+        state.text_input_focused = false
+    end
+    SkyPhoneFocus.Reapply()
+end
+
 function SkyPhoneFocus.SetCall(active)
     state.call_focus = active == true
     SkyPhoneFocus.Reapply()
@@ -175,6 +210,7 @@ function SkyPhoneFocus.SetExternalGameInput(owner_resource, allow_game_input)
 end
 
 function SkyPhoneFocus.Reset()
+    state.admin_panel_open = false
     state.activity_suspended = false
     state.call_focus = false
     state.camera_active = false
diff --git a/sky_phone/source/client/garage.lua b/sky_phone/source/client/garage.lua
index 38fee65..c3f5ef7 100644
--- a/sky_phone/source/client/garage.lua
+++ b/sky_phone/source/client/garage.lua
@@ -48,6 +48,11 @@ local vehicle_mods = {
 local phone_locale = SkyPhoneLocales.Resolve(Config.Bridge.Locale)
 local garage_locale = phone_locale.Nui.Apps.garage
 
+AddEventHandler("sky_phone:configurator:updated", function()
+    phone_locale = SkyPhoneLocales.Resolve(Config.Bridge.Locale)
+    garage_locale = phone_locale.Nui.Apps.garage
+end)
+
 local function vehicle_kind(model_hash, fallback)
     if IsThisModelABoat(model_hash) then
         return "boat"
diff --git a/sky_phone/source/client/main.lua b/sky_phone/source/client/main.lua
index 42bf0e2..b175ad1 100644
--- a/sky_phone/source/client/main.lua
+++ b/sky_phone/source/client/main.lua
@@ -8,6 +8,17 @@ local equipped_phone_number = nil
 local nui_generation = 0
 local live_activity_active = false
 local open_home_requested = false
+local admin_panel_open = false
+local suggested_admin_command = nil
+local suggested_test_data_command = nil
+local active_development_command = nil
+local registered_development_commands = {}
+local active_key_mapping_command = nil
+local active_key_mapping_key = nil
+local key_mapping_revision = 0
+local refresh_development_command
+local refresh_phone_key_mapping
+local refresh_test_data_command_suggestion
 
 local function get_equipped_phone_number()
     if not device_payload or not device_payload.device.sim then
@@ -64,6 +75,26 @@ Bridge.Debug("debug", "[sky_phone] Client script initialized.", { always = true
 
 local locale, locale_name = SkyPhoneLocales.Resolve(Config.Bridge.Locale)
 
+local function send_admin_panel_open()
+    SendNUIMessage({
+        type = "admin:open",
+        data = {
+            lang = locale_name,
+            locales = locale.Nui,
+            fallbackLocales = Locales.en.Nui,
+        },
+    })
+end
+
+local function close_admin_panel()
+    if not admin_panel_open then
+        return
+    end
+    admin_panel_open = false
+    SkyPhoneFocus.SetAdminPanel(false)
+    SendNUIMessage({ type = "admin:close" })
+end
+
 local function send_open_message()
     if not device_payload then
         return
@@ -82,6 +113,39 @@ local function send_open_message()
     open_home_requested = false
 end
 
+local function refresh_admin_command_suggestion()
+    if suggested_admin_command then
+        TriggerEvent("chat:removeSuggestion", "/" .. suggested_admin_command)
+        suggested_admin_command = nil
+    end
+    if Config.AdminPanel.Enabled then
+        suggested_admin_command = Config.AdminPanel.Command
+        TriggerEvent(
+            "chat:addSuggestion",
+            "/" .. suggested_admin_command,
+            locale.AdminCommand.CommandDescription
+        )
+    end
+end
+
+AddEventHandler("sky_phone:configurator:updated", function()
+    locale, locale_name = SkyPhoneLocales.Resolve(Config.Bridge.Locale)
+    refresh_development_command()
+    refresh_phone_key_mapping()
+    refresh_test_data_command_suggestion()
+    refresh_admin_command_suggestion()
+    SkyPhoneApps.SendCatalog()
+    if is_open and device_payload then
+        device_payload.lang = locale_name
+        device_payload.locales = locale.Nui
+        device_payload.fallbackLocales = Locales.en.Nui
+        SendNUIMessage({ type = "device:updated", data = device_payload })
+    end
+    if admin_panel_open then
+        send_admin_panel_open()
+    end
+end)
+
 local function open_phone()
     if is_open or not device_payload then
         return
@@ -152,18 +216,46 @@ AddEventHandler("sky_phone:client:forceClose", function()
     close_phone()
 end)
 
-if Config.Phone.DevelopmentCommand then
-    RegisterCommand(Config.Command, function()
-        if is_open or open_requested then
-            close_phone()
-            return
-        end
-        open_without_focus = false
-        Bridge.Callbacks.Trigger("sky_phone:device:development-open", {})
-    end, false)
+local function run_development_command()
+    if is_open or open_requested then
+        close_phone()
+        return
+    end
+
+    open_without_focus = false
+    Bridge.Callbacks.Trigger("sky_phone:device:development-open", {})
 end
 
-RegisterCommand("sky_phone_toggle", function()
+refresh_development_command = function()
+    local command_name = Config.Phone.DevelopmentCommand and Config.Command or nil
+    if command_name ~= nil and (type(command_name) ~= "string" or command_name == "") then
+        error("[sky_phone] Config.Command must be a non-empty command name.")
+    end
+
+    if active_development_command then
+        TriggerEvent("chat:removeSuggestion", "/" .. active_development_command)
+    end
+
+    active_development_command = command_name
+    if not command_name then
+        return
+    end
+
+    if not registered_development_commands[command_name] then
+        registered_development_commands[command_name] = true
+        RegisterCommand(command_name, function()
+            if active_development_command == command_name and Config.Phone.DevelopmentCommand then
+                run_development_command()
+            end
+        end, false)
+    end
+
+    TriggerEvent("chat:addSuggestion", "/" .. command_name, locale.CommandDescription)
+end
+
+refresh_development_command()
+
+local function run_phone_toggle()
     if is_open or open_requested then
         close_phone()
         return
@@ -171,7 +263,7 @@ RegisterCommand("sky_phone_toggle", function()
 
     open_without_focus = false
     Bridge.Callbacks.Trigger("sky_phone:device:open-request", {})
-end, false)
+end
 
 RegisterCommand("sky_phone_live_activity_open", function()
     if not live_activity_active or is_open or open_requested then
@@ -185,6 +277,36 @@ RegisterCommand("sky_phone_live_activity_open", function()
     end
 end, false)
 
+RegisterCommand("sky_phone_toggle", run_phone_toggle, false)
+
+refresh_phone_key_mapping = function()
+    local key_name = Config.Phone.Keybind
+    if key_name ~= false and key_name ~= nil and (type(key_name) ~= "string" or key_name == "") then
+        error("[sky_phone] Config.Phone.Keybind must be a non-empty keyboard key name or false.")
+    end
+    if key_name == active_key_mapping_key then
+        return
+    end
+
+    active_key_mapping_key = key_name
+    active_key_mapping_command = nil
+    if not key_name then
+        return
+    end
+
+    key_mapping_revision = key_mapping_revision + 1
+    local command_name = "sky_phone_toggle_config_" .. key_mapping_revision
+    active_key_mapping_command = command_name
+    RegisterCommand(command_name, function()
+        if active_key_mapping_command == command_name then
+            run_phone_toggle()
+        end
+    end, false)
+    RegisterKeyMapping(command_name, locale.Controls.OpenPhone, "keyboard", key_name)
+end
+
+refresh_phone_key_mapping()
+
 RegisterKeyMapping(
     "sky_phone_live_activity_open",
     locale.Controls.OpenPhone,
@@ -192,14 +314,19 @@ RegisterKeyMapping(
     "SPACE"
 )
 
-if Config.Phone.Keybind then
-    if type(Config.Phone.Keybind) ~= "string" or Config.Phone.Keybind == "" then
-        error("[sky_phone] Config.Phone.Keybind must be a non-empty keyboard key name or false.")
+refresh_test_data_command_suggestion = function()
+    if suggested_test_data_command then
+        TriggerEvent("chat:removeSuggestion", "/" .. suggested_test_data_command)
+        suggested_test_data_command = nil
+    end
+    if Config.TestData.Enabled then
+        suggested_test_data_command = Config.TestData.Command
+        TriggerEvent("chat:addSuggestion", "/" .. suggested_test_data_command, locale.TestData.CommandDescription)
     end
-
-    RegisterKeyMapping("sky_phone_toggle", locale.Controls.OpenPhone, "keyboard", Config.Phone.Keybind)
 end
 
+refresh_test_data_command_suggestion()
+
 RegisterNetEvent("sky_phone:testdata:feedback", function(success, detail)
     local test_data_locale = locale.TestData
     local message = success and test_data_locale.Success or test_data_locale.Failed
@@ -224,6 +351,9 @@ RegisterNUICallback("ui:ready", function(data, cb)
     if open_requested and device_payload then
         send_open_message()
     end
+    if admin_panel_open then
+        send_admin_panel_open()
+    end
     SkyPhoneCalls.ReplayNui()
     SkyPhoneSimPicker.ReplayNui()
     SkyPhoneFocus.Reapply()
@@ -269,12 +399,42 @@ RegisterNUICallback("ui:opened", function(data, cb)
     cb({ success = true })
 end)
 
+RegisterNetEvent("sky_phone:admin:launch", function()
+    if is_open or open_requested then
+        close_phone()
+    end
+    admin_panel_open = true
+    SkyPhoneFocus.SetAdminPanel(true)
+    send_admin_panel_open()
+end)
+
+RegisterNetEvent("sky_phone:admin:command-error", function(error_code)
+    local messages = locale.AdminCommand.Errors
+    Bridge.Framework.Notify(
+        "iFruit",
+        messages[error_code] or messages.default,
+        "error",
+        5000
+    )
+end)
+
+RegisterNUICallback("admin:close", function(data, cb)
+    if type(data) ~= "table" then
+        cb({ success = false, error = "invalid_request" })
+        return
+    end
+    close_admin_panel()
+    cb({ success = true })
+end)
+
 RegisterNUICallback("ui:input-focus", function(data, cb)
     if type(data) ~= "table" or type(data.active) ~= "boolean" then
         cb({ success = false, error = "invalid_request" })
         return
     end
-    SkyPhoneFocus.SetTextInputFocused(data.active and (is_open or open_requested))
+    SkyPhoneFocus.SetTextInputFocused(
+        data.active and (is_open or open_requested or admin_panel_open)
+    )
     cb({ success = true })
 end)
 
@@ -353,12 +513,7 @@ RegisterNetEvent("sky_phone:device:error", function(error_code)
 end)
 
 CreateThread(function()
-    if Config.Phone.DevelopmentCommand then
-        TriggerEvent("chat:addSuggestion", "/" .. Config.Command, locale.CommandDescription)
-    end
-    if Config.TestData.Enabled then
-        TriggerEvent("chat:addSuggestion", "/" .. Config.TestData.Command, locale.TestData.CommandDescription)
-    end
+    refresh_admin_command_suggestion()
 end)
 
 AddEventHandler("onResourceStop", function(resource_name)
@@ -369,16 +524,20 @@ AddEventHandler("onResourceStop", function(resource_name)
     is_open = false
     open_requested = false
     open_without_focus = false
+    admin_panel_open = false
 
     TriggerEvent("sky_phone:animation:reset")
     SkyPhoneCalls.Reset()
     SkyPhoneSimPicker.Reset()
     SkyPhoneFocus.Reset()
 
-    if Config.Phone.DevelopmentCommand then
-        TriggerEvent("chat:removeSuggestion", "/" .. Config.Command)
+    if active_development_command then
+        TriggerEvent("chat:removeSuggestion", "/" .. active_development_command)
     end
-    if Config.TestData.Enabled then
-        TriggerEvent("chat:removeSuggestion", "/" .. Config.TestData.Command)
+    if suggested_test_data_command then
+        TriggerEvent("chat:removeSuggestion", "/" .. suggested_test_data_command)
+    end
+    if suggested_admin_command then
+        TriggerEvent("chat:removeSuggestion", "/" .. suggested_admin_command)
     end
 end)
diff --git a/sky_phone/source/client/notifications.lua b/sky_phone/source/client/notifications.lua
index 995cfc1..d4743b2 100644
--- a/sky_phone/source/client/notifications.lua
+++ b/sky_phone/source/client/notifications.lua
@@ -159,6 +159,11 @@ end)
 local phone_locale = SkyPhoneLocales.Resolve(Config.Bridge.Locale)
 local app_locales = phone_locale.Nui.Apps
 
+AddEventHandler("sky_phone:configurator:updated", function()
+    phone_locale = SkyPhoneLocales.Resolve(Config.Bridge.Locale)
+    app_locales = phone_locale.Nui.Apps
+end)
+
 RegisterNetEvent("sky_phone:mail:new", function(data)
     local locale = app_locales.mail
     data.title = locale.name
diff --git a/sky_phone/source/client/nui_server_bridge.lua b/sky_phone/source/client/nui_server_bridge.lua
index 12911a6..1e2e4db 100644
--- a/sky_phone/source/client/nui_server_bridge.lua
+++ b/sky_phone/source/client/nui_server_bridge.lua
@@ -1,5 +1,9 @@
 local callback_groups = {
     account = [[login register logout devices remove-device]],
+    admin = [[
+        bootstrap player save-apps reveal-password activity
+        reset-passcode change-number factory-reset configurator save-configurator
+    ]],
     banking = [[overview transfer]],
     billing = [[overview list detail markRead pay dispute]],
     calendar = [[list create update delete]],
diff --git a/sky_phone/source/client/payphones.lua b/sky_phone/source/client/payphones.lua
index 93ed5ec..5563f52 100644
--- a/sky_phone/source/client/payphones.lua
+++ b/sky_phone/source/client/payphones.lua
@@ -21,10 +21,16 @@ local remote_visuals = {}
 local custom_payphone_props = {}
 
 local configured_models = {}
-for _, model_name in ipairs(Config.Payphones.Props or {}) do
-    configured_models[joaat(model_name)] = model_name
+
+local function refresh_configured_models()
+    configured_models = {}
+    for _, model_name in ipairs(Config.Payphones.Props or {}) do
+        configured_models[joaat(model_name)] = model_name
+    end
 end
 
+refresh_configured_models()
+
 local function valid_visual_number(value, maximum)
     local number = tonumber(value)
     if not number or number ~= number or math.abs(number) > maximum then
@@ -156,6 +162,23 @@ end
 
 CreateThread(spawn_custom_payphones)
 
+local function clear_custom_payphones()
+    for _, entity in ipairs(custom_payphone_props) do
+        if DoesEntityExist(entity) then
+            SetEntityAsMissionEntity(entity, true, true)
+            DeleteEntity(entity)
+        end
+    end
+    custom_payphone_props = {}
+end
+
+AddEventHandler("sky_phone:configurator:updated", function()
+    locale = SkyPhoneLocales.Resolve(Config.Bridge.Locale)
+    refresh_configured_models()
+    clear_custom_payphones()
+    CreateThread(spawn_custom_payphones)
+end)
+
 local function load_animation(dictionary)
     if HasAnimDictLoaded(dictionary) then
         return true
@@ -726,10 +749,5 @@ AddEventHandler("onResourceStop", function(resource_name)
     for _, id in ipairs(visual_ids) do
         restore_remote_visual(id)
     end
-    for _, entity in ipairs(custom_payphone_props) do
-        if DoesEntityExist(entity) then
-            SetEntityAsMissionEntity(entity, true, true)
-            DeleteEntity(entity)
-        end
-    end
+    clear_custom_payphones()
 end)
diff --git a/sky_phone/source/client/phone_configurator.lua b/sky_phone/source/client/phone_configurator.lua
new file mode 100644
index 0000000..5329bcd
--- /dev/null
+++ b/sky_phone/source/client/phone_configurator.lua
@@ -0,0 +1,83 @@
+local function deserialize_value(value)
+    if type(value) ~= "table" then
+        return value
+    end
+
+    if value.__skyType == "vector2" then
+        return vector2(tonumber(value.x) or 0.0, tonumber(value.y) or 0.0)
+    end
+    if value.__skyType == "vector3" then
+        return vector3(tonumber(value.x) or 0.0, tonumber(value.y) or 0.0, tonumber(value.z) or 0.0)
+    end
+    if value.__skyType == "vector4" then
+        return vector4(
+            tonumber(value.x) or 0.0,
+            tonumber(value.y) or 0.0,
+            tonumber(value.z) or 0.0,
+            tonumber(value.w) or 0.0
+        )
+    end
+    if value.__skyType == "map" then
+        local decoded = {}
+        for _, entry in ipairs(value.entries or {}) do
+            local key = entry.keyType == "number" and tonumber(entry.key) or entry.key
+            decoded[key] = deserialize_value(entry.value)
+        end
+        return decoded
+    end
+
+    local decoded = {}
+    for key, child in pairs(value) do
+        decoded[key] = deserialize_value(child)
+    end
+    return decoded
+end
+
+local function apply_runtime_table(current, replacement)
+    for key in pairs(current) do
+        if replacement[key] == nil then
+            current[key] = nil
+        end
+    end
+
+    for key, value in pairs(replacement) do
+        local current_value = current[key]
+        if type(current_value) == "table" and type(value) == "table" then
+            apply_runtime_table(current_value, value)
+        else
+            current[key] = value
+        end
+    end
+end
+
+local function apply_runtime_config(payload)
+    if type(payload) ~= "table" or payload.enabled ~= true then
+        return
+    end
+    if type(payload.config) ~= "table" then
+        error("[sky_phone] Phone configurator received an invalid client configuration payload.")
+    end
+
+    local runtime_config = deserialize_value(payload.config)
+    for key, value in pairs(runtime_config) do
+        if type(Config[key]) == "table" and type(value) == "table" then
+            apply_runtime_table(Config[key], value)
+        else
+            Config[key] = value
+        end
+    end
+    TriggerEvent("sky_phone:configurator:updated", tonumber(payload.revision) or 0)
+end
+
+RegisterNetEvent("sky_phone:configurator:sync", function(payload)
+    apply_runtime_config(payload)
+end)
+
+local response = Bridge.Callbacks.Trigger("sky_phone:configurator:runtime", {})
+if not response or not response.success or type(response.data) ~= "table" then
+    if Config.PhoneConfigurator.Enabled then
+        error("[sky_phone] Phone configurator failed to load the client runtime configuration.")
+    end
+    return
+end
+apply_runtime_config(response.data)
diff --git a/sky_phone/source/client/public_api.lua b/sky_phone/source/client/public_api.lua
index 0b95e52..389a54f 100644
--- a/sky_phone/source/client/public_api.lua
+++ b/sky_phone/source/client/public_api.lua
@@ -44,6 +44,18 @@ local CLIENT_CAPABILITIES = {
     side = "client",
 }
 
+local function refresh_configured_capabilities()
+    local enabled = Config.CustomApps.Enabled == true
+    local external = enabled and Config.CustomApps.ExternalApps == true
+    CLIENT_CAPABILITIES.features.customApps.enabled = enabled
+    CLIENT_CAPABILITIES.features.customApps.external = external
+    CLIENT_CAPABILITIES.features.notifications.customApps = external
+end
+
+refresh_configured_capabilities()
+
+AddEventHandler("sky_phone:configurator:updated", refresh_configured_capabilities)
+
 local custom_app_api = SkyPhoneApps.ClientPublicApi
 if type(custom_app_api) ~= "table" then
     error("[sky_phone] Client public API initialized before the custom app API.")
diff --git a/sky_phone/source/client/radio.lua b/sky_phone/source/client/radio.lua
index 0d2a338..12caf33 100644
--- a/sky_phone/source/client/radio.lua
+++ b/sky_phone/source/client/radio.lua
@@ -29,6 +29,10 @@ local function send_hud_config()
     SendNUIMessage({ type = "radio:hud-config", data = get_hud_config() })
 end
 
+AddEventHandler("sky_phone:configurator:updated", function()
+    send_hud_config()
+end)
+
 local function send_hud_members()
     local combined = {}
     for channel_id = 1, 2 do
@@ -156,6 +160,21 @@ local function leave_radio()
     return request("disconnect")
 end
 
+AddEventHandler("sky_phone:client:radioProviderUpdated", function()
+    if current_primary <= 0 then
+        return
+    end
+    if not Bridge.Radio.Join(current_primary, current_secondary) then
+        request("disconnect")
+        current_primary = 0
+        current_secondary = 0
+        clear_hud_members()
+        return
+    end
+
+    Bridge.Radio.SetVolume(current_volume)
+end)
+
 RegisterNUICallback("radio:get", function(data, cb)
     if type(data) ~= "table" then
         cb({ success = false, error = "invalid_request" })
diff --git a/sky_phone/source/server/admin.lua b/sky_phone/source/server/admin.lua
new file mode 100644
index 0000000..1923276
--- /dev/null
+++ b/sky_phone/source/server/admin.lua
@@ -0,0 +1,930 @@
+Bridge.Database.AfterMigration("sky_phone", function()
+local BUILTIN_APPS = {
+    banking = true,
+    billing = true,
+    calculator = true,
+    calendar = true,
+    camera = true,
+    citymarkt = true,
+    citywarn = true,
+    clock = true,
+    companies = true,
+    crewlink = true,
+    crypto = true,
+    darkchat = true,
+    feather = true,
+    flare = true,
+    fliptok = true,
+    garage = true,
+    health = true,
+    house = true,
+    ["app-store"] = true,
+    ["local-pages"] = true,
+    mail = true,
+    map = true,
+    memos = true,
+    memory = true,
+    messages = true,
+    minesweeper = true,
+    music = true,
+    ["neon-drop"] = true,
+    notes = true,
+    ["number-merge"] = true,
+    phone = true,
+    photos = true,
+    picstagram = true,
+    radio = true,
+    settings = true,
+    ["sky-flappy"] = true,
+    skyride = true,
+    snake = true,
+    ["tower-stack"] = true,
+    weather = true,
+    ["weazel-news"] = true,
+}
+
+local DEFAULT_INSTALLED_APPS = {
+    ["app-store"] = true,
+    calculator = true,
+    calendar = true,
+    camera = true,
+    citywarn = true,
+    clock = true,
+    health = true,
+    mail = true,
+    map = true,
+    memos = true,
+    messages = true,
+    notes = true,
+    phone = true,
+    photos = true,
+    settings = true,
+    weather = true,
+}
+
+local PROTECTED_APPS = {
+    ["app-store"] = true,
+    camera = true,
+    citywarn = true,
+    health = true,
+    mail = true,
+    messages = true,
+    phone = true,
+    photos = true,
+    settings = true,
+}
+
+local function affected_rows(result)
+    if type(result) == "number" then
+        return result
+    end
+
+    return type(result) == "table" and tonumber(result.affectedRows) or 0
+end
+
+local function trim(value)
+    if type(value) ~= "string" then
+        return ""
+    end
+    return value:match("^%s*(.-)%s*$")
+end
+
+local function player_name(source)
+    local first_name = trim(Bridge.Framework.GetFirstname(source))
+    local last_name = trim(Bridge.Framework.GetLastname(source))
+    local character_name = trim((first_name .. " " .. last_name))
+    return character_name ~= "" and character_name or GetPlayerName(source) or ("Player %s"):format(source)
+end
+
+local function require_admin(source, operation, maximum)
+    if not Config.AdminPanel.Enabled
+        or not Bridge.Framework.HasAdminGroup(source, Config.AdminPanel.AdminGroups)
+    then
+        Bridge.Debug("warn", "[sky_phone] Rejected admin panel access from source %s.", tostring(source))
+        return nil, { success = false, error = "not_authorized" }
+    end
+    if not SkyPhone.AllowOperation(source, "admin_" .. operation, maximum, 60) then
+        return nil, { success = false, error = "rate_limited" }
+    end
+    return true
+end
+
+local active_admin_command
+
+local function run_admin_command(command_source)
+    local player_source = tonumber(command_source)
+    if not player_source or player_source < 1 then
+        Bridge.Debug("warn", "[sky_phone] The admin panel command can only be used by a player.")
+        return
+    end
+    if not Config.AdminPanel.Enabled then
+        TriggerClientEvent("sky_phone:admin:command-error", player_source, "disabled")
+        return
+    end
+    if not Bridge.Framework.HasAdminGroup(player_source, Config.AdminPanel.AdminGroups) then
+        Bridge.Debug(
+            "warn",
+            "[sky_phone] Rejected admin panel command from source %s.",
+            tostring(player_source)
+        )
+        TriggerClientEvent("sky_phone:admin:command-error", player_source, "not_authorized")
+        return
+    end
+
+    TriggerClientEvent("sky_phone:admin:launch", player_source)
+end
+
+local function register_admin_command()
+    local command_name = Config.AdminPanel.Command
+    if type(command_name) ~= "string" or command_name == "" then
+        error("[sky_phone] Config.AdminPanel.Command must be a non-empty command name.")
+    end
+    if command_name == active_admin_command then
+        return
+    end
+    active_admin_command = command_name
+    RegisterCommand(command_name, function(command_source)
+        if active_admin_command == command_name then
+            run_admin_command(command_source)
+        end
+    end, false)
+end
+
+register_admin_command()
+
+AddEventHandler("sky_phone:configurator:serverUpdated", function()
+    register_admin_command()
+end)
+
+local function normalize_source(value)
+    local player_source = tonumber(value)
+    if not player_source or player_source < 1 or player_source ~= math.floor(player_source) then
+        return nil
+    end
+    if not Bridge.Framework.GetIdentifier(player_source) then
+        return nil
+    end
+    return player_source
+end
+
+local function collect_device_imeis(source, identifier)
+    local imeis = {}
+    local seen = {}
+    local function add_imei(imei)
+        if SkyPhoneImei.IsValid(imei) and not seen[imei] then
+            seen[imei] = true
+            imeis[#imeis + 1] = imei
+        end
+    end
+
+    for _, item in ipairs(Bridge.Inventory.GetSlotsWithItem(source, Config.Phone.Item)) do
+        add_imei(item.metadata and item.metadata.imei)
+    end
+
+    local rows = Bridge.Database.Query([[
+        SELECT `device_imei` AS `imei`
+        FROM `sky_phone_character_devices`
+        WHERE `owner_identifier` = ?
+        UNION
+        SELECT device.`imei`
+        FROM `sky_phone_devices` device
+        JOIN `sky_phone_sims` sim ON sim.`id` = device.`sim_id`
+        WHERE sim.`owner_identifier` = ?
+    ]], { identifier, identifier })
+    for _, row in ipairs(rows) do
+        add_imei(row.imei)
+    end
+
+    table.sort(imeis)
+    return imeis
+end
+
+local function normalize_app_ids(value)
+    local normalized = {}
+    local seen = {}
+    if type(value) ~= "table" then
+        return normalized
+    end
+
+    for index = 1, #value do
+        local app_id = value[index]
+        if type(app_id) == "string"
+            and #app_id > 0
+            and #app_id <= 64
+            and not seen[app_id]
+        then
+            seen[app_id] = true
+            normalized[#normalized + 1] = app_id
+        end
+    end
+    return normalized
+end
+
+local function load_app_payload(encoded)
+    if type(encoded) ~= "string" or encoded == "" then
+        return {}, {}, {}
+    end
+    local payload = json.decode(encoded)
+    if type(payload) ~= "table" then
+        error("[sky_phone] Stored admin target app payload is not a JSON object.")
+    end
+    return payload, normalize_app_ids(payload.claimedApps), normalize_app_ids(payload.uninstalledApps)
+end
+
+local function load_player_devices(source, identifier)
+    local imeis = collect_device_imeis(source, identifier)
+    if #imeis == 0 then
+        return {}
+    end
+
+    local placeholders = {}
+    for index = 1, #imeis do
+        placeholders[index] = "?"
+    end
+    local rows = Bridge.Database.Query(([[
+        SELECT device.`imei`, device.`device_name`, device.`created_at`, device.`updated_at`,
+            sim.`phone_number`, sim.`sim_type`, sim.`registered_at`,
+            account.`id` AS `account_id`, account.`email` AS `account_email`,
+            security.`passcode_length`, security.`failed_attempts`, security.`locked_until`,
+            app_data.`payload` AS `apps_payload`, app_data.`revision` AS `apps_revision`
+        FROM `sky_phone_devices` device
+        LEFT JOIN `sky_phone_sims` sim ON sim.`id` = device.`sim_id`
+        LEFT JOIN `sky_phone_accounts` account ON account.`id` = device.`account_id`
+        LEFT JOIN `sky_phone_device_security` security ON security.`device_imei` = device.`imei`
+        LEFT JOIN `sky_phone_device_data` app_data
+            ON app_data.`device_imei` = device.`imei` AND app_data.`namespace` = 'apps'
+        WHERE device.`imei` IN (%s)
+        ORDER BY device.`updated_at` DESC, device.`imei` ASC
+    ]]):format(table.concat(placeholders, ", ")), imeis)
+
+    local devices = {}
+    for _, row in ipairs(rows) do
+        local _, claimed_apps, uninstalled_apps = load_app_payload(row.apps_payload)
+        devices[#devices + 1] = {
+            imei = row.imei,
+            name = row.device_name,
+            createdAt = row.created_at,
+            updatedAt = row.updated_at,
+            number = row.phone_number,
+            simType = row.sim_type,
+            simRegistered = row.registered_at ~= nil,
+            account = row.account_id and {
+                id = tonumber(row.account_id),
+                email = row.account_email,
+                passwordAvailable = true,
+            } or nil,
+            security = {
+                enabled = row.passcode_length ~= nil,
+                length = row.passcode_length and tonumber(row.passcode_length) or nil,
+                failedAttempts = tonumber(row.failed_attempts) or 0,
+                lockedUntil = tonumber(row.locked_until) or 0,
+            },
+            apps = {
+                claimed = claimed_apps,
+                uninstalled = uninstalled_apps,
+                revision = tonumber(row.apps_revision) or 0,
+            },
+        }
+    end
+    return devices
+end
+
+local function build_player_summary(source)
+    local identifier = Bridge.Framework.GetIdentifier(source)
+    local devices = load_player_devices(source, identifier)
+    local job = Bridge.Framework.GetJob(source)
+    return {
+        source = source,
+        identifier = identifier,
+        name = player_name(source),
+        serverName = GetPlayerName(source) or "",
+        job = job.label ~= "" and job.label or job.name,
+        grade = job.grade,
+        onDuty = job.onDuty,
+        deviceCount = #devices,
+        phoneNumber = devices[1] and devices[1].number or nil,
+    }
+end
+
+local function list_players()
+    local sources = Bridge.Framework.GetPlayers()
+    table.sort(sources, function(left, right)
+        return tonumber(left) < tonumber(right)
+    end)
+
+    local players = {}
+    local maximum = math.max(1, math.floor(tonumber(Config.AdminPanel.MaximumPlayers) or 128))
+    for index = 1, math.min(#sources, maximum) do
+        local player_source = tonumber(sources[index])
+        if player_source and Bridge.Framework.GetIdentifier(player_source) then
+            players[#players + 1] = build_player_summary(player_source)
+        end
+    end
+    return players
+end
+
+local function load_player_detail(source)
+    local identifier = Bridge.Framework.GetIdentifier(source)
+    local job = Bridge.Framework.GetJob(source)
+    return {
+        source = source,
+        identifier = identifier,
+        name = player_name(source),
+        serverName = GetPlayerName(source) or "",
+        firstName = trim(Bridge.Framework.GetFirstname(source)),
+        lastName = trim(Bridge.Framework.GetLastname(source)),
+        birthdate = trim(Bridge.Framework.GetBirthdate(source)),
+        job = {
+            name = job.name,
+            label = job.label,
+            grade = job.grade,
+            gradeLabel = job.gradeLabel,
+            onDuty = job.onDuty,
+        },
+        money = {
+            bank = tonumber(Bridge.Framework.GetMoney(source, "bank")) or 0,
+            cash = tonumber(Bridge.Framework.GetMoney(source, "cash")) or 0,
+            currency = Config.Banking.Currency,
+        },
+        devices = load_player_devices(source, identifier),
+    }
+end
+
+local function find_owned_device(source, imei)
+    local identifier = Bridge.Framework.GetIdentifier(source)
+    for _, device in ipairs(load_player_devices(source, identifier)) do
+        if device.imei == imei then
+            return device, identifier
+        end
+    end
+    return nil, identifier
+end
+
+local function load_device_sim(imei)
+    local rows = Bridge.Database.Query([[
+        SELECT sim.`id`, sim.`phone_number`
+        FROM `sky_phone_devices` device
+        JOIN `sky_phone_sims` sim ON sim.`id` = device.`sim_id`
+        WHERE device.`imei` = ?
+        LIMIT 1
+    ]], { imei })
+    return rows[1]
+end
+
+local function app_metadata(app_id)
+    if BUILTIN_APPS[app_id] then
+        return {
+            defaultInstalled = DEFAULT_INSTALLED_APPS[app_id] == true,
+            removable = PROTECTED_APPS[app_id] ~= true,
+        }
+    end
+    if SkyPhoneApps.GetPolicy(app_id) then
+        return { defaultInstalled = false, removable = true }
+    end
+    return nil
+end
+
+local function remove_app_id(values, app_id)
+    local next_values = {}
+    for index = 1, #values do
+        if values[index] ~= app_id then
+            next_values[#next_values + 1] = values[index]
+        end
+    end
+    return next_values
+end
+
+local function add_app_id(values, app_id)
+    for index = 1, #values do
+        if values[index] == app_id then
+            return values
+        end
+    end
+    values[#values + 1] = app_id
+    return values
+end
+
+local function write_audit(actor_source, target_source, target_identifier, imei, action, details)
+    local actor_identifier = Bridge.Framework.GetIdentifier(actor_source)
+    local result = Bridge.Database.Query([[
+        INSERT INTO `sky_phone_admin_audit`
+            (`actor_identifier`, `actor_name`, `target_identifier`, `target_source`, `device_imei`, `action`, `details`)
+        VALUES (?, ?, ?, ?, ?, ?, ?)
+    ]], {
+        actor_identifier,
+        player_name(actor_source),
+        target_identifier,
+        target_source,
+        imei,
+        action,
+        json.encode(details or {}),
+    })
+    if affected_rows(result) ~= 1 then
+        error("[sky_phone] Admin audit insert did not affect exactly one row.")
+    end
+end
+
+local function load_audit()
+    local limit = math.max(1, math.min(100, math.floor(tonumber(Config.AdminPanel.AuditLimit) or 40)))
+    local rows = Bridge.Database.Query(([[
+        SELECT `id`, `actor_name`, `target_identifier`, `target_source`, `device_imei`,
+            `action`, `details`, `created_at`
+        FROM `sky_phone_admin_audit`
+        ORDER BY `id` DESC
+        LIMIT %s
+    ]]):format(limit), {})
+    local audit = {}
+    for _, row in ipairs(rows) do
+        audit[#audit + 1] = {
+            id = tonumber(row.id),
+            actorName = row.actor_name,
+            targetIdentifier = row.target_identifier,
+            targetSource = row.target_source and tonumber(row.target_source) or nil,
+            deviceImei = row.device_imei,
+            action = row.action,
+            details = json.decode(row.details),
+            createdAt = row.created_at,
+        }
+    end
+    return audit
+end
+
+Bridge.Callbacks.Register("sky_phone:admin:bootstrap", function(source)
+    local authorized, error_response = require_admin(
+        source,
+        "bootstrap",
+        Config.AdminPanel.ReadRequestsPerMinute
+    )
+    if not authorized then
+        return error_response
+    end
+
+    local players = list_players()
+    local totals = Bridge.Database.Query([[
+        SELECT
+            (SELECT COUNT(*) FROM `sky_phone_devices`) AS `devices`,
+            (SELECT COUNT(*) FROM `sky_phone_accounts`) AS `accounts`
+    ]], {})
+    return {
+        success = true,
+        data = {
+            players = players,
+            stats = {
+                online = #players,
+                devices = tonumber(totals[1] and totals[1].devices) or 0,
+                accounts = tonumber(totals[1] and totals[1].accounts) or 0,
+            },
+            audit = load_audit(),
+        },
+    }
+end)
+
+Bridge.Callbacks.Register("sky_phone:admin:player", function(source, data)
+    local authorized, error_response = require_admin(
+        source,
+        "player",
+        Config.AdminPanel.ReadRequestsPerMinute
+    )
+    if not authorized then
+        return error_response
+    end
+    local target_source = normalize_source(data and data.source)
+    if not target_source then
+        return { success = false, error = "player_unavailable" }
+    end
+    return { success = true, data = load_player_detail(target_source) }
+end)
+
+Bridge.Callbacks.Register("sky_phone:admin:save-apps", function(source, data)
+    local authorized, error_response = require_admin(
+        source,
+        "save_apps",
+        Config.AdminPanel.ActionRequestsPerMinute
+    )
+    if not authorized then
+        return error_response
+    end
+    if type(data) ~= "table"
+        or not SkyPhoneImei.IsValid(data.imei)
+        or type(data.revision) ~= "number"
+        or data.revision < 0
+        or data.revision ~= math.floor(data.revision)
+        or type(data.changes) ~= "table"
+        or #data.changes < 1
+        or #data.changes > 128
+    then
+        return { success = false, error = "invalid_request" }
+    end
+
+    local target_source = normalize_source(data.source)
+    if not target_source then
+        return { success = false, error = "player_unavailable" }
+    end
+    local target_device, target_identifier = find_owned_device(target_source, data.imei)
+    if not target_device then
+        return { success = false, error = "device_not_owned" }
+    end
+    local normalized_changes = {}
+    local seen_apps = {}
+    for index = 1, #data.changes do
+        local change = data.changes[index]
+        if type(change) ~= "table"
+            or type(change.appId) ~= "string"
+            or #change.appId < 1
+            or #change.appId > 64
+            or type(change.installed) ~= "boolean"
+            or seen_apps[change.appId]
+        then
+            return { success = false, error = "invalid_request" }
+        end
+        local metadata = app_metadata(change.appId)
+        if not metadata then
+            return { success = false, error = "invalid_app" }
+        end
+        if not change.installed and not metadata.removable then
+            return { success = false, error = "app_protected" }
+        end
+        seen_apps[change.appId] = true
+        normalized_changes[#normalized_changes + 1] = {
+            appId = change.appId,
+            installed = change.installed,
+            metadata = metadata,
+        }
+    end
+
+    local rows = Bridge.Database.Query([[
+        SELECT `payload`, `revision`
+        FROM `sky_phone_device_data`
+        WHERE `device_imei` = ? AND `namespace` = 'apps'
+        LIMIT 1
+    ]], { data.imei })
+    local current_revision = tonumber(rows[1] and rows[1].revision) or 0
+    if current_revision ~= data.revision then
+        return { success = false, error = "revision_conflict" }
+    end
+
+    local payload, claimed_apps, uninstalled_apps = load_app_payload(rows[1] and rows[1].payload)
+    for index = 1, #normalized_changes do
+        local change = normalized_changes[index]
+        if change.installed then
+            uninstalled_apps = remove_app_id(uninstalled_apps, change.appId)
+            if not change.metadata.defaultInstalled then
+                claimed_apps = add_app_id(claimed_apps, change.appId)
+            end
+        else
+            claimed_apps = remove_app_id(claimed_apps, change.appId)
+            uninstalled_apps = add_app_id(uninstalled_apps, change.appId)
+        end
+    end
+    payload.claimedApps = claimed_apps
+    payload.uninstalledApps = #uninstalled_apps > 0 and uninstalled_apps or nil
+
+    local encoded = json.encode(payload)
+    if #encoded > 100000 then
+        return { success = false, error = "payload_too_large" }
+    end
+
+    if rows[1] then
+        local result = Bridge.Database.Query([[
+            UPDATE `sky_phone_device_data`
+            SET `payload` = ?, `revision` = `revision` + 1
+            WHERE `device_imei` = ? AND `namespace` = 'apps' AND `revision` = ?
+        ]], { encoded, data.imei, data.revision })
+        if affected_rows(result) ~= 1 then
+            return { success = false, error = "revision_conflict" }
+        end
+    else
+        local result = Bridge.Database.Query([[
+            INSERT IGNORE INTO `sky_phone_device_data` (`device_imei`, `namespace`, `payload`)
+            VALUES (?, 'apps', ?)
+        ]], { data.imei, encoded })
+        if affected_rows(result) ~= 1 then
+            return { success = false, error = "revision_conflict" }
+        end
+    end
+
+    for index = 1, #normalized_changes do
+        local change = normalized_changes[index]
+        write_audit(
+            source,
+            target_source,
+            target_identifier,
+            data.imei,
+            change.installed and "grant_app" or "revoke_app",
+            { appId = change.appId }
+        )
+    end
+    SkyPhone.RefreshDevice(data.imei)
+    return { success = true, data = load_player_detail(target_source) }
+end)
+
+Bridge.Callbacks.Register("sky_phone:admin:reveal-password", function(source, data)
+    local authorized, error_response = require_admin(
+        source,
+        "reveal_password",
+        Config.AdminPanel.CredentialRevealsPerMinute
+    )
+    if not authorized then
+        return error_response
+    end
+    if type(data) ~= "table" or not SkyPhoneImei.IsValid(data.imei) then
+        return { success = false, error = "invalid_request" }
+    end
+
+    local target_source = normalize_source(data.source)
+    if not target_source then
+        return { success = false, error = "player_unavailable" }
+    end
+    local device, target_identifier = find_owned_device(target_source, data.imei)
+    if not device then
+        return { success = false, error = "device_not_owned" }
+    end
+
+    local accounts = Bridge.Database.Query([[
+        SELECT account.`email`, account.`password`
+        FROM `sky_phone_devices` device
+        JOIN `sky_phone_accounts` account ON account.`id` = device.`account_id`
+        WHERE device.`imei` = ?
+        LIMIT 1
+    ]], { data.imei })
+    if not accounts[1] then
+        return { success = false, error = "account_not_found" }
+    end
+
+    write_audit(
+        source,
+        target_source,
+        target_identifier,
+        data.imei,
+        "reveal_account_password",
+        { email = accounts[1].email }
+    )
+    return {
+        success = true,
+        data = {
+            email = accounts[1].email,
+            password = accounts[1].password,
+        },
+    }
+end)
+
+Bridge.Callbacks.Register("sky_phone:admin:activity", function(source, data)
+    local authorized, error_response = require_admin(
+        source,
+        "activity",
+        Config.AdminPanel.ReadRequestsPerMinute
+    )
+    if not authorized then
+        return error_response
+    end
+    if type(data) ~= "table"
+        or not SkyPhoneImei.IsValid(data.imei)
+        or (data.kind ~= "messages" and data.kind ~= "calls")
+    then
+        return { success = false, error = "invalid_request" }
+    end
+
+    local target_source = normalize_source(data.source)
+    if not target_source then
+        return { success = false, error = "player_unavailable" }
+    end
+    local device, target_identifier = find_owned_device(target_source, data.imei)
+    if not device then
+        return { success = false, error = "device_not_owned" }
+    end
+    local audit_action = data.kind == "messages" and "view_messages" or "view_calls"
+    local sim = load_device_sim(data.imei)
+    if not sim then
+        write_audit(
+            source,
+            target_source,
+            target_identifier,
+            data.imei,
+            audit_action,
+            { count = 0 }
+        )
+        return { success = true, data = { kind = data.kind, entries = {} } }
+    end
+
+    local limit = math.max(1, math.min(100, math.floor(tonumber(Config.AdminPanel.ActivityLimit) or 40)))
+    local entries = {}
+    if data.kind == "messages" then
+        local rows = Bridge.Database.Query(([[
+            SELECT `id`, `sender_sim_id`, `sender_number`, `recipient_number`, `message_type`,
+                `body`, `read_at`, `created_at`
+            FROM `sky_phone_sms_messages`
+            WHERE `sender_sim_id` = ? OR `recipient_sim_id` = ?
+            ORDER BY `created_at` DESC
+            LIMIT %s
+        ]]):format(limit), { sim.id, sim.id })
+        for _, row in ipairs(rows) do
+            local outgoing = row.sender_sim_id == sim.id
+            entries[#entries + 1] = {
+                id = row.id,
+                direction = outgoing and "outgoing" or "incoming",
+                otherNumber = outgoing and row.recipient_number or row.sender_number,
+                messageType = row.message_type,
+                body = row.body,
+                readAt = row.read_at,
+                createdAt = row.created_at,
+            }
+        end
+    else
+        local rows = Bridge.Database.Query(([[
+            SELECT `id`, `caller_sim_id`, `caller_number`, `callee_number`, `status`,
+                `started_at`, `answered_at`, `ended_at`, `duration_seconds`
+            FROM `sky_phone_calls`
+            WHERE `caller_sim_id` = ? OR `callee_sim_id` = ?
+            ORDER BY `started_at` DESC
+            LIMIT %s
+        ]]):format(limit), { sim.id, sim.id })
+        for _, row in ipairs(rows) do
+            local outgoing = row.caller_sim_id == sim.id
+            entries[#entries + 1] = {
+                id = row.id,
+                direction = outgoing and "outgoing" or "incoming",
+                otherNumber = outgoing and row.callee_number or row.caller_number,
+                status = row.status,
+                startedAt = row.started_at,
+                answeredAt = row.answered_at,
+                endedAt = row.ended_at,
+                durationSeconds = tonumber(row.duration_seconds) or 0,
+            }
+        end
+    end
+
+    write_audit(
+        source,
+        target_source,
+        target_identifier,
+        data.imei,
+        audit_action,
+        { count = #entries }
+    )
+    return { success = true, data = { kind = data.kind, entries = entries } }
+end)
+
+Bridge.Callbacks.Register("sky_phone:admin:reset-passcode", function(source, data)
+    local authorized, error_response = require_admin(
+        source,
+        "reset_passcode",
+        Config.AdminPanel.ActionRequestsPerMinute
+    )
+    if not authorized then
+        return error_response
+    end
+    if type(data) ~= "table" or not SkyPhoneImei.IsValid(data.imei) then
+        return { success = false, error = "invalid_request" }
+    end
+
+    local target_source = normalize_source(data.source)
+    if not target_source then
+        return { success = false, error = "player_unavailable" }
+    end
+    local device, target_identifier = find_owned_device(target_source, data.imei)
+    if not device then
+        return { success = false, error = "device_not_owned" }
+    end
+    local result = Bridge.Database.Query(
+        "DELETE FROM `sky_phone_device_security` WHERE `device_imei` = ?",
+        { data.imei }
+    )
+    if affected_rows(result) ~= 1 then
+        return { success = false, error = "passcode_not_set" }
+    end
+
+    write_audit(source, target_source, target_identifier, data.imei, "reset_passcode", {})
+    SkyPhone.RefreshDevice(data.imei)
+    return { success = true, data = load_player_detail(target_source) }
+end)
+
+Bridge.Callbacks.Register("sky_phone:admin:change-number", function(source, data)
+    local authorized, error_response = require_admin(
+        source,
+        "change_number",
+        Config.AdminPanel.ActionRequestsPerMinute
+    )
+    if not authorized then
+        return error_response
+    end
+    if type(data) ~= "table"
+        or not SkyPhoneImei.IsValid(data.imei)
+        or (type(data.phoneNumber) ~= "string" and type(data.phoneNumber) ~= "number")
+    then
+        return { success = false, error = "invalid_request" }
+    end
+
+    local target_source = normalize_source(data.source)
+    if not target_source then
+        return { success = false, error = "player_unavailable" }
+    end
+    local device, target_identifier = find_owned_device(target_source, data.imei)
+    if not device then
+        return { success = false, error = "device_not_owned" }
+    end
+    local sim = load_device_sim(data.imei)
+    if not sim then
+        return { success = false, error = "no_sim" }
+    end
+
+    local changed, number_or_error = SkyPhoneSim.ChangeNumber(
+        target_source,
+        data.imei,
+        sim.id,
+        data.phoneNumber
+    )
+    if not changed then
+        return { success = false, error = number_or_error }
+    end
+
+    SkyPhoneCompanies.ClearCallAvailability(target_source)
+    SkyPhoneCalls.EndForSim(sim.id, "number_changed")
+    write_audit(source, target_source, target_identifier, data.imei, "change_number", {
+        previousNumber = sim.phone_number,
+        phoneNumber = number_or_error,
+    })
+    SkyPhone.RefreshDevice(data.imei)
+    return { success = true, data = load_player_detail(target_source) }
+end)
+
+Bridge.Callbacks.Register("sky_phone:admin:factory-reset", function(source, data)
+    local authorized, error_response = require_admin(
+        source,
+        "factory_reset",
+        Config.AdminPanel.ActionRequestsPerMinute
+    )
+    if not authorized then
+        return error_response
+    end
+    if type(data) ~= "table" or not SkyPhoneImei.IsValid(data.imei) then
+        return { success = false, error = "invalid_request" }
+    end
+
+    local target_source = normalize_source(data.source)
+    if not target_source then
+        return { success = false, error = "player_unavailable" }
+    end
+    local device, target_identifier = find_owned_device(target_source, data.imei)
+    if not device then
+        return { success = false, error = "device_not_owned" }
+    end
+
+    local reset, phone_number_or_error = SkyPhonePersistence.FactoryReset(data.imei)
+    if not reset then
+        return { success = false, error = phone_number_or_error }
+    end
+
+    write_audit(source, target_source, target_identifier, data.imei, "factory_reset", {})
+    if phone_number_or_error then
+        TriggerEvent("sky_phone:server:factoryReset", target_source, phone_number_or_error)
+    end
+    SkyPhone.RefreshDevice(data.imei)
+    return { success = true, data = load_player_detail(target_source) }
+end)
+
+Bridge.Callbacks.Register("sky_phone:admin:configurator", function(source)
+    local authorized, error_response = require_admin(
+        source,
+        "configurator_read",
+        Config.AdminPanel.ReadRequestsPerMinute
+    )
+    if not authorized then
+        return error_response
+    end
+
+    return { success = true, data = SkyPhoneConfigurator.GetAdminData() }
+end)
+
+Bridge.Callbacks.Register("sky_phone:admin:save-configurator", function(source, data)
+    local authorized, error_response = require_admin(
+        source,
+        "configurator_save",
+        Config.AdminPanel.ActionRequestsPerMinute
+    )
+    if not authorized then
+        return error_response
+    end
+    if type(data) ~= "table" or type(data.changes) ~= "table" then
+        return { success = false, error = "invalid_request" }
+    end
+
+    local actor_identifier = Bridge.Framework.GetIdentifier(source)
+    if not actor_identifier then
+        return { success = false, error = "player_unavailable" }
+    end
+    local actor_name = player_name(source)
+    local response = SkyPhoneConfigurator.Save(
+        data.revision,
+        data.changes,
+        actor_identifier,
+        actor_name
+    )
+    if response.success then
+        write_audit(source, source, actor_identifier, nil, "save_configuration", {
+            changeCount = #data.changes,
+            revision = response.data.revision,
+        })
+    end
+    return response
+end)
+end)
diff --git a/sky_phone/source/server/calls.lua b/sky_phone/source/server/calls.lua
index 7d1889e..390f93b 100644
--- a/sky_phone/source/server/calls.lua
+++ b/sky_phone/source/server/calls.lua
@@ -1206,12 +1206,18 @@ Bridge.Callbacks.Register("sky_phone:calls:dial", function(source, data)
 end)
 
 local payphone_models = {}
-for _, model_name in ipairs(Config.Payphones.Props or {}) do
-    if type(model_name) == "string" then
-        payphone_models[model_name] = true
+
+local function refresh_payphone_models()
+    payphone_models = {}
+    for _, model_name in ipairs(Config.Payphones.Props or {}) do
+        if type(model_name) == "string" then
+            payphone_models[model_name] = true
+        end
     end
 end
 
+refresh_payphone_models()
+
 if Config.Payphones.Enabled and not next(payphone_models) then
     Bridge.Debug(
         "error",
@@ -1220,6 +1226,10 @@ if Config.Payphones.Enabled and not next(payphone_models) then
     )
 end
 
+AddEventHandler("sky_phone:configurator:serverUpdated", function()
+    refresh_payphone_models()
+end)
+
 local function valid_payphone_position(source, detected_booth)
     local ped = GetPlayerPed(source)
     if not ped or ped == 0 then
diff --git a/sky_phone/source/server/companies.lua b/sky_phone/source/server/companies.lua
index a7943f4..44cb187 100644
--- a/sky_phone/source/server/companies.lua
+++ b/sky_phone/source/server/companies.lua
@@ -905,9 +905,22 @@ local function cleanup_retained_data()
     end
 end
 
-validate_configuration()
-seed_companies()
-tombstone_removed_companies()
+local function refresh_runtime_configuration()
+    definitions = {}
+    definition_ids = {}
+    definitions_by_job = {}
+    service_lines_by_number = {}
+    validate_configuration()
+    seed_companies()
+    tombstone_removed_companies()
+end
+
+refresh_runtime_configuration()
+
+AddEventHandler("sky_phone:configurator:serverUpdated", function()
+    refresh_runtime_configuration()
+end)
+
 cleanup_retained_data()
 
 CreateThread(function()
diff --git a/sky_phone/source/server/crewlink.lua b/sky_phone/source/server/crewlink.lua
index a765e58..1c6665c 100644
--- a/sky_phone/source/server/crewlink.lua
+++ b/sky_phone/source/server/crewlink.lua
@@ -1,5 +1,9 @@
 Bridge.Database.AfterMigration("sky_phone", function()
 local password_pepper = tostring(Config.Server.CrewLinkPasswordPepper or "")
+AddEventHandler("sky_phone:configurator:serverUpdated", function()
+    password_pepper = tostring(Config.Server.CrewLinkPasswordPepper or "")
+end)
+
 local role_levels = {
     guest = 1,
     member = 2,
diff --git a/sky_phone/source/server/crypto.lua b/sky_phone/source/server/crypto.lua
index adfac86..88a53c1 100644
--- a/sky_phone/source/server/crypto.lua
+++ b/sky_phone/source/server/crypto.lua
@@ -316,9 +316,16 @@ local function ceil_div(value, divisor)
 end
 
 local function initialize_markets()
+    local next_markets = {}
+    local next_market_order = {}
+    local next_market_dynamics = {}
     for _, config in ipairs(Config.Crypto.Markets) do
-        markets[config.Id] = config
-        market_order[#market_order + 1] = config.Id
+        if next_markets[config.Id] then
+            error(("[sky_phone] Config.Crypto.Markets contains duplicate id '%s'."):format(config.Id))
+        end
+        next_markets[config.Id] = config
+        next_market_order[#next_market_order + 1] = config.Id
+        next_market_dynamics[config.Id] = market_dynamics[config.Id]
         Bridge.Database.Query([[
             INSERT INTO `sky_phone_crypto_markets`
                 (`id`,`asset_scale`,`price_scale`,`issued_supply`,`price`,`version`,`status`)
@@ -357,6 +364,10 @@ local function initialize_markets()
         INSERT INTO `sky_phone_crypto_balances` (`account_id`,`asset_id`,`available`)
         VALUES ('treasury', 'CASH', ?) ON DUPLICATE KEY UPDATE `account_id` = VALUES(`account_id`)
     ]], { Config.Crypto.TreasuryCash * Config.Crypto.PriceScale })
+    markets = next_markets
+    market_order = next_market_order
+    market_dynamics = next_market_dynamics
+    market_cursor = math.min(market_cursor, math.max(#market_order, 1))
 end
 
 local function require_phone(source)
@@ -1357,6 +1368,8 @@ ensure_schema()
 migrate_crypto_keys()
 initialize_markets()
 
+AddEventHandler("sky_phone:configurator:serverUpdated", initialize_markets)
+
 local function reconcile_settlements(include_recent)
     local age_clause = include_recent and "" or " AND settlement.`updated_at` < DATE_SUB(CURRENT_TIMESTAMP, INTERVAL 5 MINUTE)"
     local rows = Bridge.Database.Query([[
diff --git a/sky_phone/source/server/custom_app_storage.lua b/sky_phone/source/server/custom_app_storage.lua
index c777e39..5346f44 100644
--- a/sky_phone/source/server/custom_app_storage.lua
+++ b/sky_phone/source/server/custom_app_storage.lua
@@ -1,8 +1,6 @@
 Bridge.Database.AfterMigration("sky_phone", function()
 local STORAGE_JSON_MAX_DEPTH = 8
 local STORAGE_JSON_MAX_NODES = 512
-local STORAGE_KEY_MAX_LENGTH = math.min(Config.CustomApps.MaximumStorageKeyLength, 64)
-local STORAGE_VALUE_MAX_BYTES = math.min(Config.CustomApps.MaximumStorageValueBytes, 65536)
 local storage_write_locks = {}
 
 local function affected_rows(result)
@@ -27,7 +25,7 @@ local function validate_storage_json(value, depth, state)
         return value == value and value ~= math.huge and value ~= -math.huge
     end
     if value_type == "string" then
-        return #value <= STORAGE_VALUE_MAX_BYTES
+        return #value <= math.min(Config.CustomApps.MaximumStorageValueBytes, 65536)
     end
     if value_type ~= "table" or state.seen[value] then
         return false
@@ -120,7 +118,7 @@ local function validate_request(source, data, operation)
     end
     if type(data.key) ~= "string"
         or #data.key == 0
-        or #data.key > STORAGE_KEY_MAX_LENGTH
+        or #data.key > math.min(Config.CustomApps.MaximumStorageKeyLength, 64)
         or not data.key:match("^[%w._-]+$")
     then
         return nil, nil, { success = false, error = "invalid_storage_key" }
@@ -205,7 +203,7 @@ Bridge.Callbacks.Register("sky_phone:custom-app:storage:set", function(source, d
     local encoded, payload = pcall(json.encode, request.value)
     if not encoded
         or type(payload) ~= "string"
-        or #payload > STORAGE_VALUE_MAX_BYTES
+        or #payload > math.min(Config.CustomApps.MaximumStorageValueBytes, 65536)
     then
         return { success = false, error = "storage_value_too_large" }
     end
diff --git a/sky_phone/source/server/custom_apps.lua b/sky_phone/source/server/custom_apps.lua
index eac1bca..3319dbb 100644
--- a/sky_phone/source/server/custom_apps.lua
+++ b/sky_phone/source/server/custom_apps.lua
@@ -474,26 +474,44 @@ SkyPhoneApps.ServerPublicApi = {
     UpdateCustomAppPolicyFromAdapter = update_custom_app_policy_from_adapter,
 }
 
-if Config.CustomApps.Enabled and Config.CustomApps.BundledApps then
-    local bundled = SkyPhoneApps.GetBundledManifests()
-    for index = 1, #bundled do
-        local manifest = bundled[index]
-        local registered, register_error = register_policy({
-            adapterResource = nil,
-            bundled = true,
-            id = manifest.id,
-            ownerResource = current_resource,
-            permissions = build_permission_set(manifest.permissions),
-        })
-        if not registered then
-            error(("[sky_phone] Could not register bundled custom app policy '%s': %s"):format(
-                manifest.id,
-                register_error
-            ))
+local function refresh_bundled_policies()
+    local removals = {}
+    for app_id, policy in pairs(policies_by_id) do
+        if policy.bundled then
+            removals[#removals + 1] = app_id
+        end
+    end
+    for _, app_id in ipairs(removals) do
+        remove_policy(app_id)
+    end
+
+    if Config.CustomApps.Enabled and Config.CustomApps.BundledApps then
+        local bundled = SkyPhoneApps.GetBundledManifests()
+        for index = 1, #bundled do
+            local manifest = bundled[index]
+            local registered, register_error = register_policy({
+                adapterResource = nil,
+                bundled = true,
+                id = manifest.id,
+                ownerResource = current_resource,
+                permissions = build_permission_set(manifest.permissions),
+            })
+            if not registered then
+                error(("[sky_phone] Could not register bundled custom app policy '%s': %s"):format(
+                    manifest.id,
+                    register_error
+                ))
+            end
         end
     end
 end
 
+refresh_bundled_policies()
+
+AddEventHandler("sky_phone:configurator:serverUpdated", function()
+    refresh_bundled_policies()
+end)
+
 AddEventHandler("onResourceStop", function(resource_name)
     if resource_name == current_resource then
         return
diff --git a/sky_phone/source/server/db_migrate.lua b/sky_phone/source/server/db_migrate.lua
index 3a930a1..3cb56b0 100644
--- a/sky_phone/source/server/db_migrate.lua
+++ b/sky_phone/source/server/db_migrate.lua
@@ -416,6 +416,46 @@ local schema = {
         },
         tableOptions = "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
     },
+    {
+        name = "sky_phone_admin_audit",
+        columns = {
+            { name = "id", type = "BIGINT UNSIGNED NOT NULL AUTO_INCREMENT" },
+            {
+                name = "actor_identifier",
+                type = "VARCHAR(80) NOT NULL",
+                characterSet = "ascii",
+                collation = "ascii_bin",
+            },
+            { name = "actor_name", type = "VARCHAR(120) NOT NULL" },
+            {
+                name = "target_identifier",
+                type = "VARCHAR(80) NOT NULL",
+                characterSet = "ascii",
+                collation = "ascii_bin",
+            },
+            { name = "target_source", type = "INT UNSIGNED NULL" },
+            {
+                name = "device_imei",
+                type = "CHAR(15) NULL",
+                characterSet = "ascii",
+                collation = "ascii_bin",
+            },
+            {
+                name = "action",
+                type = "VARCHAR(48) NOT NULL",
+                characterSet = "ascii",
+                collation = "ascii_bin",
+            },
+            { name = "details", type = "LONGTEXT NOT NULL" },
+            { name = "created_at", type = "DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP" },
+        },
+        primaryKey = "id",
+        indexes = {
+            { name = "idx_sky_phone_admin_audit_created", columns = "(`created_at`, `id`)" },
+            { name = "idx_sky_phone_admin_audit_target", columns = "(`target_identifier`, `created_at`)" },
+        },
+        tableOptions = "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
+    },
     {
         name = "sky_phone_notes",
         columns = {
@@ -2909,6 +2949,8 @@ local schema = {
     },
 }
 
+schema[#schema + 1] = SkyPhoneConfiguratorSchema
+
 Bridge.Database.Migrate("sky_phone", schema)
 Bridge.Database.Query([[
     INSERT IGNORE INTO `sky_phone_fliptok_video_media` (`video_id`, `media_id`, `sort_order`)
diff --git a/sky_phone/source/server/fliptok.lua b/sky_phone/source/server/fliptok.lua
index 35b5762..7b53db7 100644
--- a/sky_phone/source/server/fliptok.lua
+++ b/sky_phone/source/server/fliptok.lua
@@ -14,7 +14,27 @@ local custom_music_extensions = {
     wav = true,
     webm = true,
 }
-local password_pepper = tostring(Config.Server.FlipTokPasswordPepper or "")
+local password_pepper = ""
+
+local function refresh_runtime_configuration()
+    password_pepper = tostring(Config.Server.FlipTokPasswordPepper or "")
+    music_tracks = {}
+    music_track_list = {}
+    for _, track in ipairs(Config.FlipTok.MusicTracks) do
+        local id = tostring(track.Id or track.id or "")
+        local title = tostring(track.Title or track.title or "")
+        local artist = tostring(track.Artist or track.artist or "")
+        local url = tostring(track.Url or track.url or "")
+        if id == "" or title == "" or artist == "" or url == "" then
+            error("[sky_phone] Every configured FlipTok music track requires Id, Title, Artist, and Url.")
+        end
+        local item = { id = id, title = title, artist = artist, url = url }
+        music_tracks[id] = item
+        music_track_list[#music_track_list + 1] = item
+    end
+end
+
+refresh_runtime_configuration()
 
 if password_pepper == "" then
     Bridge.Debug(
@@ -24,18 +44,9 @@ if password_pepper == "" then
     )
 end
 
-for _, track in ipairs(Config.FlipTok.MusicTracks) do
-    local id = tostring(track.Id or track.id or "")
-    local title = tostring(track.Title or track.title or "")
-    local artist = tostring(track.Artist or track.artist or "")
-    local url = tostring(track.Url or track.url or "")
-    if id == "" or title == "" or artist == "" or url == "" then
-        error("[sky_phone] Every configured FlipTok music track requires Id, Title, Artist, and Url.")
-    end
-    local item = { id = id, title = title, artist = artist, url = url }
-    music_tracks[id] = item
-    music_track_list[#music_track_list + 1] = item
-end
+AddEventHandler("sky_phone:configurator:serverUpdated", function()
+    refresh_runtime_configuration()
+end)
 
 local function trim(value)
     if type(value) ~= "string" then return nil end
@@ -913,7 +924,10 @@ Bridge.Callbacks.Register("sky_phone:fliptok:delete", function(source, data)
     return affected > 0 and { success = true } or { success = false, error = "video_not_found" }
 end)
 
-RegisterCommand(Config.FlipTok.VerifyCommand, function(source, arguments)
+local active_verify_command = nil
+local registered_verify_commands = {}
+
+local function run_verify_command(source, arguments)
     local command_locale = SkyPhoneLocales.Resolve(Config.Bridge.Locale).FlipTokCommand
     local function command_message(template, values)
         return template:gsub("{(%w+)}", function(key) return values[key] or "" end)
@@ -973,5 +987,26 @@ RegisterCommand(Config.FlipTok.VerifyCommand, function(source, arguments)
         state = verified and command_locale.verified or command_locale.unverified,
     })
     send_command_feedback(message, "success")
-end, false)
+end
+
+local function refresh_verify_command()
+    local command_name = Config.FlipTok.VerifyCommand
+    if type(command_name) ~= "string" or command_name == "" then
+        error("[sky_phone] Config.FlipTok.VerifyCommand must be a non-empty command name.")
+    end
+    active_verify_command = command_name
+    if registered_verify_commands[command_name] then
+        return
+    end
+    registered_verify_commands[command_name] = true
+    RegisterCommand(command_name, function(source, arguments)
+        if active_verify_command == command_name then
+            run_verify_command(source, arguments)
+        end
+    end, false)
+end
+
+refresh_verify_command()
+
+AddEventHandler("sky_phone:configurator:serverUpdated", refresh_verify_command)
 end)
diff --git a/sky_phone/source/server/marketplace.lua b/sky_phone/source/server/marketplace.lua
index 3a39749..2a2a8f8 100644
--- a/sky_phone/source/server/marketplace.lua
+++ b/sky_phone/source/server/marketplace.lua
@@ -8,13 +8,23 @@ local offer_responses = { accepted = true, rejected = true }
 local public_statuses = { active = true, reserved = true }
 local seller_statuses = { active = true, reserved = true, sold = true, removed = true }
 
-for _, category in ipairs(Config.Marketplace.Categories) do
-    categories[category] = true
-end
-for _, district in ipairs(Config.Marketplace.Districts) do
-    districts[district] = true
+local function refresh_runtime_configuration()
+    categories = {}
+    districts = {}
+    for _, category in ipairs(Config.Marketplace.Categories) do
+        categories[category] = true
+    end
+    for _, district in ipairs(Config.Marketplace.Districts) do
+        districts[district] = true
+    end
 end
 
+refresh_runtime_configuration()
+
+AddEventHandler("sky_phone:configurator:serverUpdated", function()
+    refresh_runtime_configuration()
+end)
+
 local function trim(value)
     if type(value) ~= "string" then
         return nil
diff --git a/sky_phone/source/server/media_import.lua b/sky_phone/source/server/media_import.lua
index ec52e79..2ba40c9 100644
--- a/sky_phone/source/server/media_import.lua
+++ b/sky_phone/source/server/media_import.lua
@@ -226,14 +226,18 @@ local function validate_website(definition)
         return nil, "invalid_required_ace"
     end
 
-    definition._adapter = adapter
-    definition._media_types = allowed_media_types
-    local valid, validation_error = adapter.Validate(definition)
+    local website = {}
+    for key, value in pairs(definition) do
+        website[key] = value
+    end
+    website._adapter = adapter
+    website._media_types = allowed_media_types
+    local valid, validation_error = adapter.Validate(website)
     if not valid then
         return nil, validation_error
     end
 
-    return definition
+    return website
 end
 
 local function build_registry()
@@ -255,7 +259,7 @@ local function build_registry()
             if website_error == "missing_api_key" then
                 Bridge.Debug(
                     "warn",
-                    "[sky_phone] Media import source '%s' at index %s is disabled because Config.Media.FiveManage.ApiKey is empty in server-only config/media.lua. Add a FiveManage V3 token with Media access and restart sky_phone.",
+                    "[sky_phone] Media import source '%s' at index %s is disabled because Config.Media.FiveManage.ApiKey is empty. Add a FiveManage V3 token with Media access in the Phone Configurator and save it.",
                     tostring(source_name or "unknown"),
                     tostring(index)
                 )
@@ -756,3 +760,9 @@ function SkyPhoneMediaImport.Initialize()
         import_candidates[source] = nil
     end)
 end
+
+AddEventHandler("sky_phone:configurator:serverUpdated", function()
+    if initialized then
+        build_registry()
+    end
+end)
diff --git a/sky_phone/source/server/music.lua b/sky_phone/source/server/music.lua
index 040e372..a409b99 100644
--- a/sky_phone/source/server/music.lua
+++ b/sky_phone/source/server/music.lua
@@ -218,6 +218,10 @@ local function normalize_server_tracks()
         return
     end
 
+    server_tracks = {}
+    server_tracks_by_id = {}
+    configured_track_ids = {}
+
     for index, configured in ipairs(Config.Music.Tracks or {}) do
         local id = type(configured) == "table" and trim(configured.Id) or nil
         local title = type(configured) == "table" and trim(configured.Title) or nil
@@ -300,6 +304,8 @@ end
 
 normalize_server_tracks()
 
+AddEventHandler("sky_phone:configurator:serverUpdated", normalize_server_tracks)
+
 local function session_owner(source)
     local session, error_response = SkyPhone.RequireSession(source)
     if not session then
diff --git a/sky_phone/source/server/pages.lua b/sky_phone/source/server/pages.lua
index e3ac471..96f124f 100644
--- a/sky_phone/source/server/pages.lua
+++ b/sky_phone/source/server/pages.lua
@@ -1,8 +1,23 @@
 Bridge.Database.AfterMigration("sky_phone", function()
 local categories = {}
 local districts = {}
-for _, value in ipairs(Config.LocalPages.Categories) do categories[value] = true end
-for _, value in ipairs(Config.Marketplace.Districts) do districts[value] = true end
+
+local function refresh_runtime_configuration()
+    categories = {}
+    districts = {}
+    for _, value in ipairs(Config.LocalPages.Categories) do
+        categories[value] = true
+    end
+    for _, value in ipairs(Config.Marketplace.Districts) do
+        districts[value] = true
+    end
+end
+
+refresh_runtime_configuration()
+
+AddEventHandler("sky_phone:configurator:serverUpdated", function()
+    refresh_runtime_configuration()
+end)
 
 local function trim(value)
     if type(value) ~= "string" then return nil end
diff --git a/sky_phone/source/server/phone.lua b/sky_phone/source/server/phone.lua
index 8397dcb..7d0406e 100644
--- a/sky_phone/source/server/phone.lua
+++ b/sky_phone/source/server/phone.lua
@@ -54,8 +54,6 @@ Bridge.Debug("debug", "[sky_phone] Server initialization started after database
 
 SkyPhone = {}
 
-local unique_phones = Config.Phone.Unique ~= false
-local sim_cards_enabled = Config.Sim.Enabled ~= false
 local sessions = {}
 local preferred_device_imeis = {}
 local equipped_phone_numbers = {}
@@ -277,7 +275,7 @@ end
 local function find_device_slots(source, imei)
     local matches = {}
     local slots = Bridge.Inventory.GetSlotsWithItem(source, Config.Phone.Item)
-    if not unique_phones then
+    if Config.Phone.Unique == false then
         if not slots[1] then
             return matches
         end
@@ -368,7 +366,7 @@ local function resolve_used_slot(source, used_item)
         )
     end
 
-    if not unique_phones and #slots > 0 then
+    if Config.Phone.Unique == false and #slots > 0 then
         return slots[1]
     end
 
@@ -416,7 +414,7 @@ local function ensure_device(source, slot)
         tostring(Bridge.Inventory.GetResourceName()),
         { always = true }
     )
-    if not unique_phones then
+    if Config.Phone.Unique == false then
         if amount < 1 then
             return nil, "phone_slot_missing"
         end
@@ -561,7 +559,7 @@ local function bootstrap(source, security, security_loaded)
             sim = device.sim_id and {
                 id = device.sim_id,
                 number = device.phone_number,
-                removable = sim_cards_enabled and tonumber(device.sim_is_virtual) ~= 1,
+                removable = Config.Sim.Enabled ~= false and tonumber(device.sim_is_virtual) ~= 1,
                 type = device.sim_type,
                 registered = device.registered_at ~= nil,
             } or nil,
@@ -616,7 +614,7 @@ local function resolve_equipped_phone_number(source)
     end
 
     local imei
-    if unique_phones then
+    if Config.Phone.Unique ~= false then
         table.sort(slots, function(left, right)
             local left_slot = tonumber(left.slot)
             local right_slot = tonumber(right.slot)
@@ -802,7 +800,7 @@ function SkyPhone.NotifyAccountDevices(account_id, event_name, data)
 
     for _, player_source in ipairs(Bridge.Framework.GetPlayers()) do
         local source = tonumber(player_source) or player_source
-        if not unique_phones then
+        if Config.Phone.Unique == false then
             if Bridge.Inventory.GetSlotsWithItem(source, Config.Phone.Item)[1] then
                 local imei = load_character_device(source)
                 local device = imei and devices[imei] or nil
@@ -968,26 +966,38 @@ function SkyPhone.OpenDeviceForCall(source, imei)
     return true
 end
 
-Bridge.Debug(
-    "debug",
-    "[sky_phone] Registering usable item '%s' through inventory '%s'.",
-    Config.Phone.Item,
-    tostring(Bridge.Inventory.GetResourceName()),
-    { always = true }
-)
-local usable_registered = Bridge.Inventory.RegisterUsableItem(Config.Phone.Item, open_phone)
-if not usable_registered then
-    error(("[sky_phone] Inventory '%s' did not register phone item '%s' as usable."):format(
+local registered_usable_items = {}
+
+local function register_configured_phone_item()
+    local item_name = Config.Phone.Item
+    if registered_usable_items[item_name] then
+        return
+    end
+    Bridge.Debug(
+        "debug",
+        "[sky_phone] Registering usable item '%s' through inventory '%s'.",
+        item_name,
         tostring(Bridge.Inventory.GetResourceName()),
-        tostring(Config.Phone.Item)
-    ))
+        { always = true }
+    )
+    if not Bridge.Inventory.RegisterUsableItem(item_name, function(...)
+        if Config.Phone.Item == item_name then
+            open_phone(...)
+        end
+    end) then
+        error(("[sky_phone] Inventory '%s' did not register phone item '%s' as usable."):format(
+            tostring(Bridge.Inventory.GetResourceName()),
+            tostring(item_name)
+        ))
+    end
+    registered_usable_items[item_name] = true
 end
-Bridge.Debug(
-    "debug",
-    "[sky_phone] Usable item registration returned: %s.",
-    tostring(usable_registered),
-    { always = true }
-)
+
+register_configured_phone_item()
+
+AddEventHandler("sky_phone:configurator:serverUpdated", function()
+    register_configured_phone_item()
+end)
 
 Bridge.Callbacks.Register("sky_phone:device:close", function(source)
     sessions[source] = nil
diff --git a/sky_phone/source/server/phone_configurator.lua b/sky_phone/source/server/phone_configurator.lua
new file mode 100644
index 0000000..4d600c5
--- /dev/null
+++ b/sky_phone/source/server/phone_configurator.lua
@@ -0,0 +1,1172 @@
+SkyPhoneConfigurator = SkyPhoneConfigurator or {}
+
+local TABLE_NAME = "sky_phone_configurator"
+local CONFIG_ROW_ID = 1
+local MAX_CHANGES = 1000
+local MAX_PAYLOAD_BYTES = 8 * 1024 * 1024
+local MAX_STRUCTURED_DEPTH = 20
+local MAX_STRUCTURED_ENTRIES = 20000
+local REDACTED_VALUE = "***REDACTED***"
+local configurator_enabled = Config.PhoneConfigurator.Enabled == true
+local default_config
+local default_media
+local stored_config
+local stored_media
+local revision = 1
+local updated_at
+local updated_by_name
+local is_sequence
+
+local CLIENT_CONFIG_KEYS = {
+    AdminPanel = true,
+    Animations = true,
+    Banking = true,
+    Billing = true,
+    Bridge = true,
+    Calendar = true,
+    Calls = true,
+    Command = true,
+    CrewLink = true,
+    Crypto = true,
+    CustomApps = true,
+    DarkChat = true,
+    EasyShare = true,
+    Feather = true,
+    FlipTok = true,
+    Garage = true,
+    Health = true,
+    Housing = true,
+    LocalPages = true,
+    Mail = true,
+    MapMarkers = true,
+    Marketplace = true,
+    Memos = true,
+    Messages = true,
+    Payphones = true,
+    Phone = true,
+    Picstagram = true,
+    Radio = true,
+    Security = true,
+    Sim = true,
+    SkyRide = true,
+    Speaker = true,
+    TestData = true,
+}
+
+local function copy_value(value, active)
+    local value_type = type(value)
+    if value_type ~= "table" then
+        return value
+    end
+
+    active = active or {}
+    if active[value] then
+        error("[sky_phone] Phone configurator cannot copy a cyclic table.")
+    end
+    active[value] = true
+
+    local copy = {}
+    for key, child in pairs(value) do
+        copy[key] = copy_value(child, active)
+    end
+    active[value] = nil
+    return copy
+end
+
+local function serialize_value(value, active)
+    local value_type = type(value)
+    if value_type == "nil" or value_type == "boolean" or value_type == "string" then
+        return value
+    end
+    if value_type == "number" then
+        if value ~= value or value == math.huge or value == -math.huge then
+            error("[sky_phone] Phone configurator cannot serialize a non-finite number.")
+        end
+        return value
+    end
+    if value_type == "vector2" then
+        return { __skyType = "vector2", x = value.x, y = value.y }
+    end
+    if value_type == "vector3" then
+        return { __skyType = "vector3", x = value.x, y = value.y, z = value.z }
+    end
+    if value_type == "vector4" then
+        return { __skyType = "vector4", x = value.x, y = value.y, z = value.z, w = value.w }
+    end
+    if value_type ~= "table" then
+        error(("[sky_phone] Phone configurator cannot serialize value type '%s'."):format(value_type))
+    end
+
+    active = active or {}
+    if active[value] then
+        error("[sky_phone] Phone configurator cannot serialize a cyclic table.")
+    end
+    active[value] = true
+
+    local has_numeric_map_key = false
+    if not is_sequence(value) then
+        for key in pairs(value) do
+            if type(key) == "number" then
+                has_numeric_map_key = true
+                break
+            end
+        end
+    end
+    if has_numeric_map_key then
+        local entries = {}
+        for key, child in pairs(value) do
+            if type(key) ~= "string" and type(key) ~= "number" then
+                error("[sky_phone] Phone configurator only supports string and numeric table keys.")
+            end
+            entries[#entries + 1] = {
+                key = key,
+                keyType = type(key),
+                value = serialize_value(child, active),
+            }
+        end
+        table.sort(entries, function(left, right)
+            if left.keyType ~= right.keyType then
+                return left.keyType < right.keyType
+            end
+            if left.keyType == "number" then
+                return left.key < right.key
+            end
+            return tostring(left.key) < tostring(right.key)
+        end)
+        active[value] = nil
+        return { __skyType = "map", entries = entries }
+    end
+
+    local serialized = {}
+    for key, child in pairs(value) do
+        if type(key) ~= "string" and type(key) ~= "number" then
+            error("[sky_phone] Phone configurator only supports string and numeric table keys.")
+        end
+        serialized[key] = serialize_value(child, active)
+    end
+    active[value] = nil
+    return serialized
+end
+
+local function deserialize_value(value)
+    if type(value) ~= "table" then
+        return value
+    end
+
+    if value.__skyType == "vector2" then
+        return vector2(tonumber(value.x) or 0.0, tonumber(value.y) or 0.0)
+    end
+    if value.__skyType == "vector3" then
+        return vector3(tonumber(value.x) or 0.0, tonumber(value.y) or 0.0, tonumber(value.z) or 0.0)
+    end
+    if value.__skyType == "vector4" then
+        return vector4(
+            tonumber(value.x) or 0.0,
+            tonumber(value.y) or 0.0,
+            tonumber(value.z) or 0.0,
+            tonumber(value.w) or 0.0
+        )
+    end
+    if value.__skyType == "map" then
+        local decoded = {}
+        for _, entry in ipairs(value.entries or {}) do
+            local key = entry.keyType == "number" and tonumber(entry.key) or entry.key
+            decoded[key] = deserialize_value(entry.value)
+        end
+        return decoded
+    end
+
+    local decoded = {}
+    for key, child in pairs(value) do
+        decoded[key] = deserialize_value(child)
+    end
+    return decoded
+end
+
+local function apply_runtime_table(current, replacement)
+    for key in pairs(current) do
+        if replacement[key] == nil then
+            current[key] = nil
+        end
+    end
+
+    for key, value in pairs(replacement) do
+        local current_value = current[key]
+        if type(current_value) == "table" and type(value) == "table" then
+            apply_runtime_table(current_value, value)
+        else
+            current[key] = value
+        end
+    end
+end
+
+is_sequence = function(value)
+    if type(value) ~= "table" then
+        return false
+    end
+
+    local count = 0
+    local maximum = 0
+    for key in pairs(value) do
+        if type(key) ~= "number" or key < 1 or key % 1 ~= 0 then
+            return false
+        end
+        count = count + 1
+        maximum = math.max(maximum, key)
+    end
+    return count > 0 and count == maximum
+end
+
+local function upgrade_legacy_map(defaults, saved)
+    local default_types = {}
+    local numeric_only = true
+    for _, entry in ipairs(defaults.entries or {}) do
+        default_types[tostring(entry.key)] = entry.keyType
+        if entry.keyType ~= "number" then
+            numeric_only = false
+        end
+    end
+
+    local entries = {}
+    for key, child in pairs(saved) do
+        local key_type = default_types[tostring(key)] or (numeric_only and "number" or type(key))
+        local normalized_key = key_type == "number" and tonumber(key) or tostring(key)
+        if normalized_key == nil then
+            error("[sky_phone] Phone configurator could not migrate a numeric configuration key.")
+        end
+        entries[#entries + 1] = {
+            key = normalized_key,
+            keyType = key_type,
+            value = copy_value(child),
+        }
+    end
+    table.sort(entries, function(left, right)
+        if left.keyType ~= right.keyType then
+            return left.keyType < right.keyType
+        end
+        if left.keyType == "number" then
+            return left.key < right.key
+        end
+        return tostring(left.key) < tostring(right.key)
+    end)
+    return { __skyType = "map", entries = entries }
+end
+
+local function merge_values(defaults, saved, path)
+    path = path or ""
+    if type(defaults) ~= "table" or type(saved) ~= "table" then
+        return copy_value(saved)
+    end
+    if path == "Companies.Definitions" then
+        return copy_value(saved)
+    end
+    if defaults.__skyType == "map" and not saved.__skyType then
+        saved = upgrade_legacy_map(defaults, saved)
+    end
+    if defaults.__skyType == "map" and saved.__skyType == "map" then
+        local saved_entries = {}
+        for _, entry in ipairs(saved.entries or {}) do
+            saved_entries[entry.keyType .. ":" .. tostring(entry.key)] = entry
+        end
+
+        local entries = {}
+        local included = {}
+        for _, entry in ipairs(defaults.entries or {}) do
+            local identity = entry.keyType .. ":" .. tostring(entry.key)
+            local saved_entry = saved_entries[identity]
+            entries[#entries + 1] = {
+                key = entry.key,
+                keyType = entry.keyType,
+                value = saved_entry
+                    and merge_values(entry.value, saved_entry.value, path .. "." .. tostring(entry.key))
+                    or copy_value(entry.value),
+            }
+            included[identity] = true
+        end
+        for _, entry in ipairs(saved.entries or {}) do
+            local identity = entry.keyType .. ":" .. tostring(entry.key)
+            if not included[identity] then
+                entries[#entries + 1] = copy_value(entry)
+            end
+        end
+        return { __skyType = "map", entries = entries }
+    end
+    if defaults.__skyType or saved.__skyType then
+        return copy_value(saved)
+    end
+    if is_sequence(defaults) then
+        local merged = copy_value(saved)
+        for index, child in ipairs(defaults) do
+            merged[index] = saved[index] ~= nil
+                and merge_values(child, saved[index], path .. "." .. tostring(index))
+                or copy_value(child)
+        end
+        return merged
+    end
+    if is_sequence(saved) then
+        return copy_value(saved)
+    end
+
+    local merged = copy_value(defaults)
+    for key, child in pairs(saved) do
+        if merged[key] ~= nil then
+            local child_path = path == "" and tostring(key) or (path .. "." .. tostring(key))
+            merged[key] = merge_values(merged[key], child, child_path)
+        else
+            merged[key] = copy_value(child)
+        end
+    end
+    return merged
+end
+
+local function decode_payload(encoded, scope)
+    if type(encoded) ~= "string" or encoded == "" then
+        error(("[sky_phone] Phone configurator has an empty %s SQL payload."):format(scope))
+    end
+
+    local success, decoded = pcall(json.decode, encoded)
+    if not success or type(decoded) ~= "table" then
+        error(("[sky_phone] Phone configurator failed to decode the %s SQL payload."):format(scope))
+    end
+    return decoded
+end
+
+local function encode_payload(payload, scope)
+    local success, encoded = pcall(json.encode, payload)
+    if not success or type(encoded) ~= "string" then
+        error(("[sky_phone] Phone configurator failed to encode the %s SQL payload."):format(scope))
+    end
+    if #encoded > MAX_PAYLOAD_BYTES then
+        error(("[sky_phone] Phone configurator %s payload exceeds %s bytes."):format(scope, MAX_PAYLOAD_BYTES))
+    end
+    return encoded
+end
+
+local function affected_rows(result)
+    if type(result) == "number" then
+        return result
+    end
+    return type(result) == "table" and tonumber(result.affectedRows) or 0
+end
+
+local function apply_runtime_configuration()
+    if not configurator_enabled then
+        return
+    end
+
+    local runtime_config = deserialize_value(stored_config)
+    for key, value in pairs(runtime_config) do
+        if type(Config[key]) == "table" and type(value) == "table" then
+            apply_runtime_table(Config[key], value)
+        else
+            Config[key] = value
+        end
+    end
+    local runtime_media = deserialize_value(stored_media)
+    if type(Config.Media) == "table" and type(runtime_media) == "table" then
+        apply_runtime_table(Config.Media, runtime_media)
+    else
+        Config.Media = runtime_media
+    end
+end
+
+local function humanize(value)
+    local text = tostring(value or "")
+        :gsub("[_%-]+", " ")
+        :gsub("(%l)(%u)", "%1 %2")
+        :gsub("(%a)(%d)", "%1 %2")
+    return text:gsub("^%l", string.upper)
+end
+
+local function sensitive_path(path)
+    local leaf = tostring(path):match("([^.]+)$") or path
+    local normalized = leaf:lower():gsub("[^%w]", "")
+    if normalized:find("apikey", 1, true)
+        or normalized:find("secret", 1, true)
+        or normalized:find("pepper", 1, true)
+        or normalized == "password"
+        or normalized == "token"
+        or normalized == "authorization"
+        or normalized == "credential"
+        or normalized == "connectionstring"
+    then
+        return true
+    end
+    return false
+end
+
+local function mask_admin_value(value, path)
+    if type(value) ~= "table" then
+        return type(value) == "string" and sensitive_path(path) and REDACTED_VALUE or value
+    end
+    if value.__skyType == "map" then
+        local entries = {}
+        for index, entry in ipairs(value.entries or {}) do
+            entries[index] = {
+                key = entry.key,
+                keyType = entry.keyType,
+                value = mask_admin_value(entry.value, path .. "." .. tostring(entry.key)),
+            }
+        end
+        return { __skyType = "map", entries = entries }
+    end
+
+    local masked = {}
+    for key, child in pairs(value) do
+        masked[key] = mask_admin_value(child, path .. "." .. tostring(key))
+    end
+    return masked
+end
+
+local function restore_redacted_values(value, current, path)
+    if type(value) ~= "table" then
+        if value == REDACTED_VALUE and sensitive_path(path) then
+            return current
+        end
+        return value
+    end
+    if value.__skyType == "map" then
+        local current_entries = {}
+        if type(current) == "table" and current.__skyType == "map" then
+            for _, entry in ipairs(current.entries or {}) do
+                current_entries[entry.keyType .. ":" .. tostring(entry.key)] = entry.value
+            end
+        end
+
+        local entries = {}
+        for index, entry in ipairs(value.entries or {}) do
+            local identity = entry.keyType .. ":" .. tostring(entry.key)
+            entries[index] = {
+                key = entry.key,
+                keyType = entry.keyType,
+                value = restore_redacted_values(
+                    entry.value,
+                    current_entries[identity],
+                    path .. "." .. tostring(entry.key)
+                ),
+            }
+        end
+        return { __skyType = "map", entries = entries }
+    end
+
+    local restored = {}
+    for key, child in pairs(value) do
+        local current_child = type(current) == "table" and current[key] or nil
+        restored[key] = restore_redacted_values(child, current_child, path .. "." .. tostring(key))
+    end
+    return restored
+end
+
+local function empty_structure(scope, path)
+    if scope ~= "config" then
+        return nil
+    end
+    if path == "Garage.VehicleImages.ModelNames" then
+        return {
+            entries = {},
+            keyType = "number",
+            kind = "map",
+            template = { kind = "value", valueType = "string" },
+        }
+    end
+    if path == "CrewLink.ExternalPingResources" or path == "CustomApps.TrustedAdapters" then
+        return {
+            fields = {},
+            kind = "table",
+            mutableKeys = true,
+            template = { kind = "value", valueType = "boolean" },
+        }
+    end
+    if path == "FlipTok.MusicTracks" then
+        return {
+            items = {},
+            kind = "list",
+            template = {
+                fields = {
+                    Artist = { kind = "value", valueType = "string" },
+                    Id = { kind = "value", valueType = "string" },
+                    Title = { kind = "value", valueType = "string" },
+                    Url = { kind = "value", valueType = "string" },
+                },
+                kind = "table",
+            },
+        }
+    end
+    if path == "Music.Tracks" then
+        return {
+            items = {},
+            kind = "list",
+            template = {
+                fields = {
+                    Artist = { kind = "value", valueType = "string" },
+                    Id = { kind = "value", valueType = "string" },
+                    Title = { kind = "value", valueType = "string" },
+                },
+                kind = "table",
+            },
+        }
+    end
+    if path == "Payphones.CustomLocations" then
+        return {
+            items = {},
+            kind = "list",
+            template = { kind = "vector", vectorType = "vector4" },
+        }
+    end
+    if path:match("^Companies%.Definitions%.[^.]+%.Services$") then
+        return {
+            items = {},
+            kind = "list",
+            template = {
+                fields = {
+                    Description = { kind = "value", valueType = "string" },
+                    Id = { kind = "value", valueType = "string" },
+                    Price = { kind = "value", valueType = "string" },
+                    RequestsEnabled = { kind = "value", valueType = "boolean" },
+                    Title = { kind = "value", valueType = "string" },
+                },
+                kind = "table",
+            },
+        }
+    end
+    return nil
+end
+
+local function build_structure(value, scope, path)
+    local value_type = type(value)
+    if scope == "config" and path == "Phone.Keybind" then
+        return { kind = "optionalString" }
+    end
+    if scope == "config" and path == "Companies.Definitions" and value_type == "table" then
+        local keys = {}
+        for key in pairs(value) do
+            keys[#keys + 1] = key
+        end
+        table.sort(keys, function(left, right)
+            return tostring(left) < tostring(right)
+        end)
+        local fields = {}
+        for _, key in ipairs(keys) do
+            fields[key] = build_structure(value[key], scope, path .. "." .. tostring(key))
+        end
+        return {
+            fields = fields,
+            kind = "table",
+            mutableKeys = true,
+            template = keys[1] and fields[keys[1]] or nil,
+        }
+    end
+    if value_type ~= "table" then
+        return {
+            kind = "value",
+            valueType = value_type,
+        }
+    end
+
+    if value.__skyType == "vector2" or value.__skyType == "vector3" or value.__skyType == "vector4" then
+        return {
+            kind = "vector",
+            vectorType = value.__skyType,
+        }
+    end
+    if value.__skyType == "map" then
+        local entries = {}
+        local key_type
+        for index, entry in ipairs(value.entries or {}) do
+            entries[index] = {
+                key = entry.key,
+                keyType = entry.keyType,
+                structure = build_structure(entry.value, scope, path .. "." .. tostring(entry.key)),
+            }
+            if index == 1 then
+                key_type = entry.keyType
+            elseif key_type ~= entry.keyType then
+                key_type = nil
+            end
+        end
+        return {
+            entries = entries,
+            keyType = key_type,
+            kind = "map",
+            template = entries[1] and entries[1].structure or nil,
+        }
+    end
+    local configured_empty_structure = next(value) == nil and empty_structure(scope, path) or nil
+    if configured_empty_structure then
+        return configured_empty_structure
+    end
+    if is_sequence(value) then
+        local items = {}
+        for index, child in ipairs(value) do
+            items[index] = build_structure(child, scope, path .. "." .. tostring(index))
+        end
+        return {
+            items = items,
+            kind = "list",
+            template = items[1],
+        }
+    end
+
+    local fields = {}
+    for key, child in pairs(value) do
+        fields[key] = build_structure(child, scope, path .. "." .. tostring(key))
+    end
+    return {
+        fields = fields,
+        kind = "table",
+    }
+end
+
+local function add_field(fields, field_index, scope, path, value, default_value)
+    local value_type = type(value)
+    local field_type = value_type
+    if value_type == "table" then
+        field_type = "json"
+    elseif value_type ~= "boolean" and value_type ~= "number" and value_type ~= "string" then
+        return
+    end
+    if scope == "config" and path == "Phone.Keybind" then
+        field_type = "stringOrFalse"
+    end
+
+    local sensitive = type(value) == "string" and sensitive_path(path)
+    local field = {
+        configured = sensitive and value ~= "" or nil,
+        label = scope == "config" and path == "Companies.Definitions"
+            and "Jobs"
+            or humanize(path:match("([^.]+)$") or path),
+        path = path,
+        scope = scope,
+        sensitive = sensitive,
+        structure = field_type == "json" and build_structure(default_value, scope, path) or nil,
+        type = field_type,
+        value = sensitive and "" or mask_admin_value(value, path),
+    }
+    fields[#fields + 1] = field
+    field_index[scope .. ":" .. path] = field
+end
+
+local function flatten_company_fields(fields, field_index, path, value, default_value)
+    if path == "Companies.Definitions"
+        or type(value) ~= "table"
+        or value.__skyType
+        or is_sequence(value)
+        or next(value) == nil
+    then
+        add_field(fields, field_index, "config", path, value, default_value)
+        return
+    end
+
+    local keys = {}
+    for key in pairs(value) do
+        keys[#keys + 1] = key
+    end
+    table.sort(keys, function(left, right)
+        return tostring(left) < tostring(right)
+    end)
+    for _, key in ipairs(keys) do
+        flatten_company_fields(
+            fields,
+            field_index,
+            path .. "." .. tostring(key),
+            value[key],
+            type(default_value) == "table" and default_value[key] or nil
+        )
+    end
+end
+
+local function build_sections(scope, payload, defaults, sections, field_index)
+    local general_fields = {}
+    local keys = {}
+    for key in pairs(payload) do
+        keys[#keys + 1] = key
+    end
+    table.sort(keys, function(left, right)
+        return tostring(left) < tostring(right)
+    end)
+
+    for _, key in ipairs(keys) do
+        local value = payload[key]
+        if scope == "config" and key == "Companies" then
+            local fields = {}
+            flatten_company_fields(fields, field_index, "Companies", value, defaults[key])
+            table.sort(fields, function(left, right)
+                if left.path == "Companies.Definitions" then
+                    return false
+                end
+                if right.path == "Companies.Definitions" then
+                    return true
+                end
+                return left.path < right.path
+            end)
+            sections[#sections + 1] = {
+                fields = fields,
+                id = "config:Companies",
+                label = humanize(key),
+                scope = scope,
+            }
+        elseif type(value) == "table" and not value.__skyType and not is_sequence(value) and next(value) ~= nil then
+            local fields = {}
+            add_field(fields, field_index, scope, tostring(key), value, defaults[key])
+            sections[#sections + 1] = {
+                fields = fields,
+                id = scope .. ":" .. tostring(key),
+                label = humanize(key),
+                scope = scope,
+            }
+        else
+            add_field(general_fields, field_index, scope, tostring(key), value, defaults[key])
+        end
+    end
+
+    if #general_fields > 0 then
+        table.insert(sections, scope == "config" and 1 or (#sections + 1), {
+            fields = general_fields,
+            id = scope .. ":general",
+            label = "General",
+            scope = scope,
+        })
+    end
+end
+
+local function build_admin_data()
+    local sections = {}
+    local field_index = {}
+    build_sections("config", stored_config, default_config, sections, field_index)
+    build_sections("media", stored_media, default_media, sections, field_index)
+    return {
+        enabled = configurator_enabled,
+        revision = revision,
+        sections = sections,
+        updatedAt = updated_at,
+        updatedBy = updated_by_name,
+    }, field_index
+end
+
+local function split_path(path)
+    local parts = {}
+    for part in path:gmatch("[^.]+") do
+        parts[#parts + 1] = part
+    end
+    return parts
+end
+
+local function set_path(root, path, value)
+    local parts = split_path(path)
+    if #parts == 0 then
+        return false
+    end
+
+    local parent = root
+    for index = 1, #parts - 1 do
+        parent = parent[parts[index]]
+        if type(parent) ~= "table" then
+            return false
+        end
+    end
+    parent[parts[#parts]] = value
+    return true
+end
+
+local function get_path(root, path)
+    local value = root
+    for _, part in ipairs(split_path(path)) do
+        if type(value) ~= "table" then
+            return nil
+        end
+        value = value[part]
+    end
+    return value
+end
+
+local function validate_structured_value(value, depth, state)
+    local value_type = type(value)
+    if value_type == "string" then
+        return #value <= 65535
+    end
+    if value_type == "number" then
+        return value == value and value ~= math.huge and value ~= -math.huge
+    end
+    if value_type == "boolean" or value_type == "nil" then
+        return true
+    end
+    if value_type ~= "table" or depth > MAX_STRUCTURED_DEPTH then
+        return false
+    end
+
+    state.entries = state.entries + 1
+    if state.entries > MAX_STRUCTURED_ENTRIES then
+        return false
+    end
+
+    local sky_type = value.__skyType
+    if sky_type then
+        if sky_type == "vector2" or sky_type == "vector3" or sky_type == "vector4" then
+            local axes = sky_type == "vector2" and { "x", "y" }
+                or sky_type == "vector3" and { "x", "y", "z" }
+                or { "x", "y", "z", "w" }
+            for _, axis in ipairs(axes) do
+                local coordinate = value[axis]
+                if type(coordinate) ~= "number"
+                    or coordinate ~= coordinate
+                    or coordinate == math.huge
+                    or coordinate == -math.huge
+                then
+                    return false
+                end
+            end
+            return true
+        end
+        if sky_type ~= "map" or type(value.entries) ~= "table" then
+            return false
+        end
+        if next(value.entries) and not is_sequence(value.entries) then
+            return false
+        end
+
+        local seen = {}
+        for _, entry in ipairs(value.entries) do
+            if type(entry) ~= "table" or (entry.keyType ~= "string" and entry.keyType ~= "number") then
+                return false
+            end
+            local key = entry.key
+            if entry.keyType == "string" then
+                if type(key) ~= "string" or key == "" or #key > 255 then
+                    return false
+                end
+            elseif type(key) ~= "number"
+                or key ~= key
+                or key == math.huge
+                or key == -math.huge
+            then
+                return false
+            end
+
+            local identity = entry.keyType .. ":" .. tostring(key)
+            if seen[identity] then
+                return false
+            end
+            seen[identity] = true
+            if not validate_structured_value(entry.value, depth + 1, state) then
+                return false
+            end
+        end
+        return true
+    end
+
+    for key, child in pairs(value) do
+        if type(key) ~= "string" and type(key) ~= "number" then
+            return false
+        end
+        if not validate_structured_value(child, depth + 1, state) then
+            return false
+        end
+    end
+    return true
+end
+
+local function validate_locked_structure(structure, value)
+    if type(structure) ~= "table" or type(structure.kind) ~= "string" then
+        return false
+    end
+    if structure.kind == "value" then
+        return type(value) == structure.valueType
+    end
+    if structure.kind == "optionalString" then
+        return value == false or type(value) == "string"
+    end
+    if structure.kind == "vector" then
+        return type(value) == "table" and value.__skyType == structure.vectorType
+    end
+    if structure.kind == "list" then
+        if type(value) ~= "table" or value.__skyType or (next(value) and not is_sequence(value)) then
+            return false
+        end
+        local fixed_items = structure.items or {}
+        for index, item_structure in ipairs(fixed_items) do
+            if value[index] == nil or not validate_locked_structure(item_structure, value[index]) then
+                return false
+            end
+        end
+        if structure.template then
+            for index = #fixed_items + 1, #value do
+                if not validate_locked_structure(structure.template, value[index]) then
+                    return false
+                end
+            end
+        end
+        return true
+    end
+    if structure.kind == "table" then
+        if type(value) ~= "table" or value.__skyType or is_sequence(value) then
+            return false
+        end
+        if not structure.mutableKeys then
+            for key in pairs(value) do
+                if not structure.fields[key] then
+                    return false
+                end
+            end
+            for key, field_structure in pairs(structure.fields or {}) do
+                if value[key] == nil or not validate_locked_structure(field_structure, value[key]) then
+                    return false
+                end
+            end
+        end
+        if structure.mutableKeys and structure.template then
+            for key, child in pairs(value) do
+                if type(key) ~= "string"
+                    or #key > 64
+                    or not key:match("^[a-z0-9_-]+$")
+                    or not validate_locked_structure(structure.template, child)
+                then
+                    return false
+                end
+            end
+        end
+        return true
+    end
+    if structure.kind ~= "map" or type(value) ~= "table" then
+        return false
+    end
+    if value.__skyType ~= "map" then
+        return next(value) == nil and #(structure.entries or {}) == 0
+    end
+
+    local entries = {}
+    for _, entry in ipairs(value.entries or {}) do
+        entries[entry.keyType .. ":" .. tostring(entry.key)] = entry.value
+    end
+    for _, entry in ipairs(structure.entries or {}) do
+        local child = entries[entry.keyType .. ":" .. tostring(entry.key)]
+        if child == nil or not validate_locked_structure(entry.structure, child) then
+            return false
+        end
+    end
+    if structure.template or structure.keyType then
+        local fixed_entries = {}
+        for _, entry in ipairs(structure.entries or {}) do
+            fixed_entries[entry.keyType .. ":" .. tostring(entry.key)] = true
+        end
+        for _, entry in ipairs(value.entries or {}) do
+            local identity = entry.keyType .. ":" .. tostring(entry.key)
+            local invalid_key_type = structure.keyType and entry.keyType ~= structure.keyType
+            local invalid_value = structure.template
+                and not validate_locked_structure(structure.template, entry.value)
+            if not fixed_entries[identity] and (invalid_key_type or invalid_value) then
+                return false
+            end
+        end
+    end
+    return true
+end
+
+local function normalize_change_value(field, value)
+    if field.type == "boolean" then
+        return type(value) == "boolean" and value or nil
+    end
+    if field.type == "number" then
+        if type(value) ~= "number" or value ~= value or value == math.huge or value == -math.huge then
+            return nil
+        end
+        return value
+    end
+    if field.type == "string" then
+        if type(value) ~= "string" or #value > 65535 or value == REDACTED_VALUE then
+            return nil
+        end
+        return value
+    end
+    if field.type == "stringOrFalse" then
+        if value == false then
+            return false
+        end
+        if type(value) ~= "string" or #value > 65535 then
+            return nil
+        end
+        return value
+    end
+    if field.type == "json" and type(value) == "table" then
+        if not validate_structured_value(value, 0, { entries = 0 }) then
+            return nil
+        end
+        local serialized = serialize_value(value)
+        if not validate_locked_structure(field.structure, serialized) then
+            return nil
+        end
+        return serialized
+    end
+    return nil
+end
+
+local function client_payload()
+    local payload = {}
+    for key in pairs(CLIENT_CONFIG_KEYS) do
+        if stored_config[key] ~= nil then
+            payload[key] = copy_value(stored_config[key])
+        end
+    end
+    return payload
+end
+
+function SkyPhoneConfigurator.Broadcast(target)
+    TriggerClientEvent("sky_phone:configurator:sync", target or -1, {
+        config = client_payload(),
+        enabled = configurator_enabled,
+        revision = revision,
+    })
+end
+
+local function read_stored_row()
+    local rows = Bridge.Database.Query(([[
+        SELECT `config_payload`, `media_payload`, `revision`, `updated_at`, `updated_by_name`
+        FROM `%s`
+        WHERE `id` = ?
+        LIMIT 1
+    ]]):format(TABLE_NAME), { CONFIG_ROW_ID })
+    local row = rows[1]
+    if not row then
+        error("[sky_phone] Phone configurator could not load its SQL row.")
+    end
+    return row
+end
+
+local function apply_stored_row(row)
+    stored_config = merge_values(default_config, decode_payload(row.config_payload, "config"), "")
+    stored_media = merge_values(default_media, decode_payload(row.media_payload, "media"), "")
+    revision = tonumber(row.revision) or 1
+    updated_at = row.updated_at
+    updated_by_name = row.updated_by_name
+end
+
+default_config = {}
+for key, value in pairs(Config) do
+    if key ~= "Media" and key ~= "PhoneConfigurator" then
+        default_config[key] = serialize_value(value)
+    end
+end
+default_media = serialize_value(Config.Media)
+
+Bridge.Database.Migrate("sky_phone_configurator", { SkyPhoneConfiguratorSchema })
+Bridge.Database.Query(([[
+    INSERT IGNORE INTO `%s` (`id`, `config_payload`, `media_payload`, `revision`)
+    VALUES (?, ?, ?, 1)
+]]):format(TABLE_NAME), {
+    CONFIG_ROW_ID,
+    encode_payload(default_config, "config"),
+    encode_payload(default_media, "media"),
+})
+
+apply_stored_row(read_stored_row())
+apply_runtime_configuration()
+
+function SkyPhoneConfigurator.GetAdminData()
+    local data = build_admin_data()
+    return data
+end
+
+function SkyPhoneConfigurator.Save(expected_revision, changes, actor_identifier, actor_name)
+    if not configurator_enabled then
+        return { success = false, error = "configurator_disabled" }
+    end
+    if tonumber(expected_revision) ~= revision then
+        return { success = false, error = "revision_conflict", data = SkyPhoneConfigurator.GetAdminData() }
+    end
+    if type(changes) ~= "table" or #changes < 1 or #changes > MAX_CHANGES then
+        return { success = false, error = "invalid_request" }
+    end
+
+    local _, field_index = build_admin_data()
+    local next_config = copy_value(stored_config)
+    local next_media = copy_value(stored_media)
+    local seen = {}
+    for _, change in ipairs(changes) do
+        if type(change) ~= "table" or type(change.scope) ~= "string" or type(change.path) ~= "string" then
+            return { success = false, error = "invalid_request" }
+        end
+
+        local field_key = change.scope .. ":" .. change.path
+        local field = field_index[field_key]
+        if not field or seen[field_key] then
+            return { success = false, error = "invalid_field" }
+        end
+        seen[field_key] = true
+
+        local normalized = normalize_change_value(field, change.value)
+        if normalized == nil then
+            return { success = false, error = "invalid_value" }
+        end
+        local target = change.scope == "config" and next_config or next_media
+        if change.scope ~= "config" and change.scope ~= "media" then
+            return { success = false, error = "invalid_field" }
+        end
+        if field.type == "json" then
+            normalized = restore_redacted_values(normalized, get_path(target, change.path), change.path)
+        end
+        if not set_path(target, change.path, normalized) then
+            return { success = false, error = "invalid_field" }
+        end
+    end
+
+    local config_encoded = encode_payload(next_config, "config")
+    local media_encoded = encode_payload(next_media, "media")
+    local result = Bridge.Database.Query(([[
+        UPDATE `%s`
+        SET `config_payload` = ?, `media_payload` = ?, `revision` = `revision` + 1,
+            `updated_by_identifier` = ?, `updated_by_name` = ?
+        WHERE `id` = ? AND `revision` = ?
+    ]]):format(TABLE_NAME), {
+        config_encoded,
+        media_encoded,
+        tostring(actor_identifier or ""):sub(1, 80),
+        tostring(actor_name or ""):sub(1, 120),
+        CONFIG_ROW_ID,
+        revision,
+    })
+    if affected_rows(result) ~= 1 then
+        local latest = Bridge.Database.Query(("SELECT `revision` FROM `%s` WHERE `id` = ? LIMIT 1"):format(TABLE_NAME), {
+            CONFIG_ROW_ID,
+        })
+        revision = latest[1] and tonumber(latest[1].revision) or revision
+        return { success = false, error = "revision_conflict", data = SkyPhoneConfigurator.GetAdminData() }
+    end
+
+    local expected_revision = revision + 1
+    local persisted_row = read_stored_row()
+    if persisted_row.config_payload ~= config_encoded
+        or persisted_row.media_payload ~= media_encoded
+        or tonumber(persisted_row.revision) ~= expected_revision
+    then
+        error("[sky_phone] Phone configurator SQL verification failed after saving config and media payloads.")
+    end
+    apply_stored_row(persisted_row)
+    apply_runtime_configuration()
+    TriggerEvent("sky_phone:configurator:serverUpdated", revision)
+    SkyPhoneConfigurator.Broadcast(-1)
+    Bridge.Debug(
+        "info",
+        "[sky_phone] Applied Phone Configurator revision %s through the internal runtime refresh.",
+        tostring(revision),
+        { always = true }
+    )
+
+    return { success = true, data = SkyPhoneConfigurator.GetAdminData() }
+end
+
+Bridge.Callbacks.Register("sky_phone:configurator:runtime", function()
+    return {
+        success = true,
+        data = {
+            config = configurator_enabled and client_payload() or {},
+            enabled = configurator_enabled,
+            revision = revision,
+        },
+    }
+end)
+
+Bridge.Debug(
+    "info",
+    "[sky_phone] Phone configurator initialized enabled=%s revision=%s.",
+    tostring(configurator_enabled),
+    tostring(revision)
+)
diff --git a/sky_phone/source/server/phone_configurator_schema.lua b/sky_phone/source/server/phone_configurator_schema.lua
new file mode 100644
index 0000000..0eaca70
--- /dev/null
+++ b/sky_phone/source/server/phone_configurator_schema.lua
@@ -0,0 +1,23 @@
+SkyPhoneConfiguratorSchema = {
+    name = "sky_phone_configurator",
+    columns = {
+        { name = "id", type = "TINYINT UNSIGNED NOT NULL" },
+        { name = "config_payload", type = "LONGTEXT NOT NULL" },
+        { name = "media_payload", type = "LONGTEXT NOT NULL" },
+        { name = "revision", type = "INT UNSIGNED NOT NULL DEFAULT 1" },
+        {
+            name = "updated_by_identifier",
+            type = "VARCHAR(80) NULL",
+            characterSet = "ascii",
+            collation = "ascii_bin",
+        },
+        { name = "updated_by_name", type = "VARCHAR(120) NULL" },
+        { name = "created_at", type = "DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP" },
+        {
+            name = "updated_at",
+            type = "DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP",
+        },
+    },
+    primaryKey = "id",
+    tableOptions = "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
+}
diff --git a/sky_phone/source/server/phone_persistence.lua b/sky_phone/source/server/phone_persistence.lua
index eac924e..e8606d8 100644
--- a/sky_phone/source/server/phone_persistence.lua
+++ b/sky_phone/source/server/phone_persistence.lua
@@ -1,4 +1,6 @@
 Bridge.Database.AfterMigration("sky_phone", function()
+SkyPhonePersistence = {}
+
 local max_device_data_bytes = 100000
 local allowed_device_namespaces = {
     settings = true,
@@ -150,6 +152,69 @@ Bridge.Callbacks.Register("sky_phone:notifications:save", function(source, data)
     return { success = true }
 end)
 
+function SkyPhonePersistence.FactoryReset(imei)
+    if not SkyPhoneImei.IsValid(imei) then
+        return false, "invalid_request"
+    end
+
+    local device = SkyPhone.LoadDevice(imei)
+    if not device then
+        return false, "device_not_found"
+    end
+    local phone_number = device and device.phone_number or nil
+    local media_remote_ids = SkyPhoneMedia.GetDeviceRemoteIds(imei)
+    if not Bridge.Database.Transaction({
+        {
+            query = "DELETE FROM `sky_phone_device_security` WHERE `device_imei` = ?",
+            params = { imei },
+        },
+        {
+            query = "DELETE FROM `sky_phone_device_data` WHERE `device_imei` = ?",
+            params = { imei },
+        },
+        {
+            query = "DELETE FROM `sky_phone_custom_app_data` WHERE `device_imei` = ?",
+            params = { imei },
+        },
+        {
+            query = "DELETE FROM `sky_phone_notes` WHERE `device_imei` = ? AND `account_id` IS NULL",
+            params = { imei },
+        },
+        {
+            query = "DELETE FROM `sky_phone_media` WHERE `device_imei` = ? AND `account_id` IS NULL",
+            params = { imei },
+        },
+        {
+            query = "DELETE FROM `sky_phone_music_playlists` WHERE `device_imei` = ? AND `account_id` IS NULL",
+            params = { imei },
+        },
+        {
+            query = "DELETE FROM `sky_phone_music_youtube_songs` WHERE `device_imei` = ? AND `account_id` IS NULL",
+            params = { imei },
+        },
+        {
+            query = "DELETE FROM `sky_phone_contacts` WHERE `device_imei` = ? AND `account_id` IS NULL",
+            params = { imei },
+        },
+        {
+            query = "DELETE FROM `sky_phone_call_entries` WHERE `device_imei` = ? AND `account_id` IS NULL",
+            params = { imei },
+        },
+        {
+            query = "DELETE FROM `sky_phone_fliptok_sessions` WHERE `device_imei` = ?",
+            params = { imei },
+        },
+        {
+            query = "UPDATE `sky_phone_devices` SET `account_id` = NULL, `device_name` = ? WHERE `imei` = ?",
+            params = { Config.Phone.DeviceName, imei },
+        },
+    }) then
+        return false, "request_failed"
+    end
+    SkyPhoneMedia.CleanupRemoteFiles(media_remote_ids)
+    return true, phone_number
+end
+
 Bridge.Callbacks.Register("sky_phone:device:factory-reset", function(source)
     if not SkyPhone.AllowOperation(source, "factory_reset", 3, 60) then
         return { success = false, error = "rate_limited" }
@@ -158,58 +223,11 @@ Bridge.Callbacks.Register("sky_phone:device:factory-reset", function(source)
     if not session then
         return error_response
     end
-    local device = SkyPhone.LoadDevice(session.imei)
-    local phone_number = device and device.phone_number or nil
-    local media_remote_ids = SkyPhoneMedia.GetDeviceRemoteIds(session.imei)
-    if not Bridge.Database.Transaction({
-        {
-            query = "DELETE FROM `sky_phone_device_security` WHERE `device_imei` = ?",
-            params = { session.imei },
-        },
-        {
-            query = "DELETE FROM `sky_phone_device_data` WHERE `device_imei` = ?",
-            params = { session.imei },
-        },
-        {
-            query = "DELETE FROM `sky_phone_custom_app_data` WHERE `device_imei` = ?",
-            params = { session.imei },
-        },
-        {
-            query = "DELETE FROM `sky_phone_notes` WHERE `device_imei` = ? AND `account_id` IS NULL",
-            params = { session.imei },
-        },
-        {
-            query = "DELETE FROM `sky_phone_media` WHERE `device_imei` = ? AND `account_id` IS NULL",
-            params = { session.imei },
-        },
-        {
-            query = "DELETE FROM `sky_phone_music_playlists` WHERE `device_imei` = ? AND `account_id` IS NULL",
-            params = { session.imei },
-        },
-        {
-            query = "DELETE FROM `sky_phone_music_youtube_songs` WHERE `device_imei` = ? AND `account_id` IS NULL",
-            params = { session.imei },
-        },
-        {
-            query = "DELETE FROM `sky_phone_contacts` WHERE `device_imei` = ? AND `account_id` IS NULL",
-            params = { session.imei },
-        },
-        {
-            query = "DELETE FROM `sky_phone_call_entries` WHERE `device_imei` = ? AND `account_id` IS NULL",
-            params = { session.imei },
-        },
-        {
-            query = "DELETE FROM `sky_phone_fliptok_sessions` WHERE `device_imei` = ?",
-            params = { session.imei },
-        },
-        {
-            query = "UPDATE `sky_phone_devices` SET `account_id` = NULL, `device_name` = ? WHERE `imei` = ?",
-            params = { Config.Phone.DeviceName, session.imei },
-        },
-    }) then
-        return { success = false, error = "request_failed" }
+
+    local reset, phone_number = SkyPhonePersistence.FactoryReset(session.imei)
+    if not reset then
+        return { success = false, error = phone_number }
     end
-    SkyPhoneMedia.CleanupRemoteFiles(media_remote_ids)
     session.unlocked = true
     if phone_number then
         TriggerEvent("sky_phone:server:factoryReset", source, phone_number)
diff --git a/sky_phone/source/server/phone_security.lua b/sky_phone/source/server/phone_security.lua
index f18a414..9e54b9e 100644
--- a/sky_phone/source/server/phone_security.lua
+++ b/sky_phone/source/server/phone_security.lua
@@ -2,6 +2,10 @@ Bridge.Database.AfterMigration("sky_phone", function()
 SkyPhoneSecurity = {}
 
 local passcode_pepper = tostring(Config.Server.PasscodePepper or "")
+AddEventHandler("sky_phone:configurator:serverUpdated", function()
+    passcode_pepper = tostring(Config.Server.PasscodePepper or "")
+end)
+
 if passcode_pepper == "" then
     Bridge.Debug(
         "warn",
diff --git a/sky_phone/source/server/picstagram.lua b/sky_phone/source/server/picstagram.lua
index 9740d31..a496c5f 100644
--- a/sky_phone/source/server/picstagram.lua
+++ b/sky_phone/source/server/picstagram.lua
@@ -1,6 +1,16 @@
 Bridge.Database.AfterMigration("sky_phone", function()
 local report_reasons = {}
-local password_pepper = tostring(Config.Server.PicstagramPasswordPepper or "")
+local password_pepper = ""
+
+local function refresh_runtime_configuration()
+    password_pepper = tostring(Config.Server.PicstagramPasswordPepper or "")
+    report_reasons = {}
+    for index = 1, #Config.Picstagram.ReportReasons do
+        report_reasons[Config.Picstagram.ReportReasons[index]] = true
+    end
+end
+
+refresh_runtime_configuration()
 
 if password_pepper == "" then
     Bridge.Debug(
@@ -10,9 +20,9 @@ if password_pepper == "" then
     )
 end
 
-for index = 1, #Config.Picstagram.ReportReasons do
-    report_reasons[Config.Picstagram.ReportReasons[index]] = true
-end
+AddEventHandler("sky_phone:configurator:serverUpdated", function()
+    refresh_runtime_configuration()
+end)
 
 local function trim(value)
     if type(value) ~= "string" then
@@ -1434,7 +1444,10 @@ Bridge.Callbacks.Register("sky_phone:picstagram:admin-resolve-report", function(
     return { success = true }
 end)
 
-RegisterCommand(Config.Picstagram.VerifyCommand, function(source, args)
+local active_verify_command = nil
+local registered_verify_commands = {}
+
+local function run_verify_command(source, args)
     local command_locale = SkyPhoneLocales.Resolve(Config.Bridge.Locale).PicstagramCommand
     local function command_message(template, values)
         return template:gsub("{(%w+)}", function(key)
@@ -1489,5 +1502,26 @@ RegisterCommand(Config.Picstagram.VerifyCommand, function(source, args)
         handle = handle,
         state = state == 1 and command_locale.verified or command_locale.unverified,
     }), "success")
-end, false)
+end
+
+local function refresh_verify_command()
+    local command_name = Config.Picstagram.VerifyCommand
+    if type(command_name) ~= "string" or command_name == "" then
+        error("[sky_phone] Config.Picstagram.VerifyCommand must be a non-empty command name.")
+    end
+    active_verify_command = command_name
+    if registered_verify_commands[command_name] then
+        return
+    end
+    registered_verify_commands[command_name] = true
+    RegisterCommand(command_name, function(source, args)
+        if active_verify_command == command_name then
+            run_verify_command(source, args)
+        end
+    end, false)
+end
+
+refresh_verify_command()
+
+AddEventHandler("sky_phone:configurator:serverUpdated", refresh_verify_command)
 end)
diff --git a/sky_phone/source/server/public_api.lua b/sky_phone/source/server/public_api.lua
index 29659e7..0f3099a 100644
--- a/sky_phone/source/server/public_api.lua
+++ b/sky_phone/source/server/public_api.lua
@@ -25,6 +25,18 @@ local SERVER_CAPABILITIES = {
     side = "server",
 }
 
+local function refresh_configured_capabilities()
+    local enabled = Config.CustomApps.Enabled == true
+    local external = enabled and Config.CustomApps.ExternalApps == true
+    SERVER_CAPABILITIES.features.customApps.enabled = enabled
+    SERVER_CAPABILITIES.features.customApps.external = external
+    SERVER_CAPABILITIES.features.notifications.customApps = external
+end
+
+refresh_configured_capabilities()
+
+AddEventHandler("sky_phone:configurator:serverUpdated", refresh_configured_capabilities)
+
 local custom_app_api = SkyPhoneApps.ServerPublicApi
 if type(custom_app_api) ~= "table" then
     error("[sky_phone] Server public API initialized before the custom app policy API.")
diff --git a/sky_phone/source/server/sim.lua b/sky_phone/source/server/sim.lua
index 2581143..fce7671 100644
--- a/sky_phone/source/server/sim.lua
+++ b/sky_phone/source/server/sim.lua
@@ -2,22 +2,29 @@ Bridge.Database.AfterMigration("sky_phone", function()
 
 SkyPhoneSim = {}
 
-local valid_number_configuration, number_configuration_error = SkyPhoneSimNumber.ValidateConfiguration(
-    Config.Sim.NumberLength,
-    Config.Sim.NumberPrefix
-)
-if not valid_number_configuration then
-    error(("[sky_phone] Invalid SIM number configuration: %s."):format(number_configuration_error))
-end
-
-local unique_phones = Config.Phone.Unique ~= false
-local sim_cards_enabled = Config.Sim.Enabled ~= false
 local pending_insertions = {}
 local operation_locks = {}
-local sim_types = {
-    [Config.Sim.RegisteredItem] = "registered",
-    [Config.Sim.AnonymousItem] = "anonymous",
-}
+local sim_types = {}
+
+local function validate_number_configuration()
+    local valid, validation_error = SkyPhoneSimNumber.ValidateConfiguration(
+        Config.Sim.NumberLength,
+        Config.Sim.NumberPrefix
+    )
+    if not valid then
+        error(("[sky_phone] Invalid SIM number configuration: %s."):format(validation_error))
+    end
+end
+
+local function refresh_sim_types()
+    sim_types = {
+        [Config.Sim.RegisteredItem] = "registered",
+        [Config.Sim.AnonymousItem] = "anonymous",
+    }
+end
+
+validate_number_configuration()
+refresh_sim_types()
 
 local function affected_rows(result)
     if type(result) == "number" then
@@ -76,7 +83,7 @@ local function sim_metadata(sim)
 end
 
 local function set_phone_sim_metadata(source, phone_slot, sim)
-    if not unique_phones then
+    if Config.Phone.Unique == false then
         return true
     end
     if not phone_slot then
@@ -102,7 +109,7 @@ local function prepare_device(source, phone_slot, imei)
     end
 
     local sim = device.sim_id and load_sim(device.sim_id) or nil
-    if sim_cards_enabled then
+    if Config.Sim.Enabled ~= false then
         if sim and tonumber(sim.is_virtual) == 1 then
             local result = Bridge.Database.Query([[
                 UPDATE `sky_phone_devices`
@@ -161,6 +168,62 @@ end
 
 SkyPhoneSim.PrepareDevice = prepare_device
 
+function SkyPhoneSim.ChangeNumber(source, imei, sim_id, value)
+    local number = SkyPhoneSimNumber.Normalize(value, Config.Sim.NumberLength, Config.Sim.NumberPrefix)
+    if not number or SkyPhoneCompanies.IsServiceNumber(number) then
+        return false, "invalid_phone_number"
+    end
+
+    local sim = load_sim(sim_id)
+    if not sim then
+        return false, "no_sim"
+    end
+    if sim.phone_number == number then
+        return false, "phone_number_unchanged"
+    end
+
+    local existing = Bridge.Database.Query(
+        "SELECT `id` FROM `sky_phone_sims` WHERE `phone_number` = ? AND `id` <> ? LIMIT 1",
+        { number, sim_id }
+    )
+    if existing[1] then
+        return false, "phone_number_taken"
+    end
+
+    local phone_slot
+    if Config.Phone.Unique ~= false then
+        for _, slot in ipairs(Bridge.Inventory.GetSlotsWithItem(source, Config.Phone.Item)) do
+            if slot.metadata and slot.metadata.imei == imei then
+                phone_slot = slot
+                break
+            end
+        end
+    end
+
+    local previous_number = sim.phone_number
+    sim.phone_number = number
+    if phone_slot and not set_phone_sim_metadata(source, phone_slot, sim) then
+        return false, "metadata_unsupported"
+    end
+
+    local result = Bridge.Database.Query([[
+        UPDATE IGNORE `sky_phone_sims`
+        SET `phone_number` = ?
+        WHERE `id` = ? AND `phone_number` = ?
+    ]], { number, sim_id, previous_number })
+    if affected_rows(result) ~= 1 then
+        if phone_slot then
+            sim.phone_number = previous_number
+            if not set_phone_sim_metadata(source, phone_slot, sim) then
+                error("[sky_phone] Could not restore SIM metadata after a failed admin number change.")
+            end
+        end
+        return false, "phone_number_taken"
+    end
+
+    return true, number
+end
+
 local function resolve_used_sim(source, used_item, item_name)
     local slot_id = used_item and (used_item.slot or used_item.id)
     local slot = slot_id and Bridge.Inventory.GetSlot(source, slot_id) or nil
@@ -252,7 +315,7 @@ local function rollback_phone_metadata(source, phone_slot, old_sim)
 end
 
 local function insert_sim(source, phone_imei, confirmed)
-    if not sim_cards_enabled then
+    if Config.Sim.Enabled == false then
         return { success = false, error = "disabled" }
     end
     if operation_locks[source] then
@@ -356,7 +419,7 @@ local function insert_sim(source, phone_imei, confirmed)
 end
 
 local function use_sim(source, used_item)
-    if not sim_cards_enabled then
+    if Config.Sim.Enabled == false then
         return false
     end
     local item_name = used_item and used_item.name
@@ -411,11 +474,26 @@ end
 
 -- Register the guarded callbacks in both modes so a resource-only restart can
 -- replace registrations left behind in framework-owned usable-item tables.
-Bridge.Inventory.RegisterUsableItem(Config.Sim.RegisteredItem, use_sim)
-Bridge.Inventory.RegisterUsableItem(Config.Sim.AnonymousItem, use_sim)
+local registered_sim_items = {}
+
+local function register_configured_sim_items()
+    for item_name in pairs(sim_types) do
+        if not registered_sim_items[item_name] then
+            local registered_item_name = item_name
+            Bridge.Inventory.RegisterUsableItem(registered_item_name, function(...)
+                if Config.Sim.Enabled ~= false and sim_types[registered_item_name] then
+                    use_sim(...)
+                end
+            end)
+            registered_sim_items[registered_item_name] = true
+        end
+    end
+end
+
+register_configured_sim_items()
 
 Bridge.Callbacks.Register("sky_phone:sim:insert", function(source, data)
-    if not sim_cards_enabled then
+    if Config.Sim.Enabled == false then
         return { success = false, error = "disabled" }
     end
     if type(data) ~= "table" or not SkyPhoneImei.IsValid(data.imei) then
@@ -433,7 +511,7 @@ Bridge.Callbacks.Register("sky_phone:sim:picker-close", function(source)
 end)
 
 Bridge.Callbacks.Register("sky_phone:sim:eject", function(source)
-    if not sim_cards_enabled then
+    if Config.Sim.Enabled == false then
         return { success = false, error = "disabled" }
     end
     if operation_locks[source] then
@@ -486,7 +564,13 @@ AddEventHandler("playerDropped", function()
     operation_locks[source] = nil
 end)
 
-if sim_cards_enabled then
+AddEventHandler("sky_phone:configurator:serverUpdated", function()
+    validate_number_configuration()
+    refresh_sim_types()
+    register_configured_sim_items()
+end)
+
+if Config.Sim.Enabled ~= false then
     Bridge.Database.Query([[
         UPDATE `sky_phone_devices` d
         INNER JOIN `sky_phone_sims` s ON s.`id` = d.`sim_id`
diff --git a/sky_phone/source/server/skyride.lua b/sky_phone/source/server/skyride.lua
index a7373ea..d1f3c2f 100644
--- a/sky_phone/source/server/skyride.lua
+++ b/sky_phone/source/server/skyride.lua
@@ -11,20 +11,30 @@ local online_drivers = {}
 local operation_locks = {}
 local services = {}
 
-if Config.SkyRide.DistanceUnit ~= "kilometer" and Config.SkyRide.DistanceUnit ~= "mile" then
-    error(("[sky_phone] Invalid SkyRide distance unit '%s'."):format(tostring(Config.SkyRide.DistanceUnit)))
+local function refresh_runtime_configuration()
+    if Config.SkyRide.DistanceUnit ~= "kilometer" and Config.SkyRide.DistanceUnit ~= "mile" then
+        error(("[sky_phone] Invalid SkyRide distance unit '%s'."):format(tostring(Config.SkyRide.DistanceUnit)))
+    end
+
+    local next_services = {}
+    for index = 1, #Config.SkyRide.Services do
+        local service = Config.SkyRide.Services[index]
+        if service.Id ~= "taxi" and service.Id ~= "comfort" and service.Id ~= "xl" and service.Id ~= "premium" then
+            error(("[sky_phone] Invalid SkyRide service class '%s'."):format(tostring(service.Id)))
+        end
+        if next_services[service.Id] then
+            error(("[sky_phone] Duplicate SkyRide service class '%s'."):format(service.Id))
+        end
+        next_services[service.Id] = service
+    end
+    services = next_services
 end
 
-for index = 1, #Config.SkyRide.Services do
-    local service = Config.SkyRide.Services[index]
-    if service.Id ~= "taxi" and service.Id ~= "comfort" and service.Id ~= "xl" and service.Id ~= "premium" then
-        error(("[sky_phone] Invalid SkyRide service class '%s'."):format(tostring(service.Id)))
-    end
-    if services[service.Id] then
-        error(("[sky_phone] Duplicate SkyRide service class '%s'."):format(service.Id))
-    end
-    services[service.Id] = service
-end
+refresh_runtime_configuration()
+
+AddEventHandler("sky_phone:configurator:serverUpdated", function()
+    refresh_runtime_configuration()
+end)
 
 local ride_select = [[
     SELECT r.*,
diff --git a/sky_phone/source/server/testdata.lua b/sky_phone/source/server/testdata.lua
index 657f68f..edd857a 100644
--- a/sky_phone/source/server/testdata.lua
+++ b/sky_phone/source/server/testdata.lua
@@ -1,9 +1,5 @@
 Bridge.Database.AfterMigration("sky_phone", function()
 
-if not Config.TestData.Enabled then
-    return
-end
-
 local photo_urls = {
     city = "https://images.unsplash.com/photo-1519501025264-65ba15a82390?auto=format&fit=crop&w=1200&q=80",
     car = "https://images.unsplash.com/photo-1493238792000-8113da705763?auto=format&fit=crop&w=1200&q=80",
@@ -1041,7 +1037,10 @@ local function seed_for_source(source)
     return account.email
 end
 
-RegisterCommand(Config.TestData.Command, function(source)
+local function run_test_data_command(source)
+    if not Config.TestData.Enabled then
+        return
+    end
     if source <= 0 then
         Bridge.Debug("warn", "[sky_phone] The test data command must be run by an in-game player.")
         return
@@ -1066,7 +1065,34 @@ RegisterCommand(Config.TestData.Command, function(source)
     end
     Bridge.Debug("info", "[sky_phone] Test data seeded for source %s.", tostring(source), { always = true })
     TriggerClientEvent("sky_phone:testdata:feedback", source, true, result)
-end, false)
+end
+
+local active_test_data_command = nil
+local registered_test_data_commands = {}
+
+local function refresh_test_data_command()
+    active_test_data_command = Config.TestData.Enabled and Config.TestData.Command or nil
+    if not active_test_data_command then
+        return
+    end
+    if type(active_test_data_command) ~= "string" or active_test_data_command == "" then
+        error("[sky_phone] Config.TestData.Command must be a non-empty command name.")
+    end
+    if registered_test_data_commands[active_test_data_command] then
+        return
+    end
+    local command_name = active_test_data_command
+    registered_test_data_commands[command_name] = true
+    RegisterCommand(command_name, function(source)
+        if active_test_data_command == command_name then
+            run_test_data_command(source)
+        end
+    end, false)
+end
+
+refresh_test_data_command()
+
+AddEventHandler("sky_phone:configurator:serverUpdated", refresh_test_data_command)
 
 AddEventHandler("playerDropped", function()
     seed_attempts[source] = nil
diff --git a/sky_phone/source/server/weazel_news.lua b/sky_phone/source/server/weazel_news.lua
index bfde62e..9350e1b 100644
--- a/sky_phone/source/server/weazel_news.lua
+++ b/sky_phone/source/server/weazel_news.lua
@@ -55,25 +55,36 @@ if type(config.Categories) ~= "table" then
 end
 
 local categories = {}
-for _, category in ipairs(config.Categories or {}) do
-    if type(category) ~= "string" or #category < 1 or #category > 32
-        or not category:match("^[%l_]+$") or categories[category]
-    then
-        error(("[sky_phone] Invalid Weazel News category '%s'."):format(tostring(category)))
+
+local function refresh_categories()
+    local next_categories = {}
+    for _, category in ipairs(config.Categories or {}) do
+        if type(category) ~= "string" or #category < 1 or #category > 32
+            or not category:match("^[%l_]+$") or next_categories[category]
+        then
+            error(("[sky_phone] Invalid Weazel News category '%s'."):format(tostring(category)))
+        end
+        next_categories[category] = true
     end
-    categories[category] = true
-end
-for category in pairs(supported_categories) do
-    if not categories[category] then
-        error(("[sky_phone] Config.WeazelNews.Categories is missing supported category '%s'."):format(category))
+    for category in pairs(supported_categories) do
+        if not next_categories[category] then
+            error(("[sky_phone] Config.WeazelNews.Categories is missing supported category '%s'."):format(category))
+        end
     end
-end
-for category in pairs(categories) do
-    if not supported_categories[category] then
-        error(("[sky_phone] Config.WeazelNews.Categories contains unsupported category '%s'."):format(category))
+    for category in pairs(next_categories) do
+        if not supported_categories[category] then
+            error(("[sky_phone] Config.WeazelNews.Categories contains unsupported category '%s'."):format(category))
+        end
     end
+    categories = next_categories
 end
 
+refresh_categories()
+
+AddEventHandler("sky_phone:configurator:serverUpdated", function()
+    refresh_categories()
+end)
+
 if type(config.AllowedJobs) ~= "table" then
     error("[sky_phone] Config.WeazelNews.AllowedJobs must be a table.")
 end
diff --git a/sky_phone/source/shared/custom_apps.lua b/sky_phone/source/shared/custom_apps.lua
index d78a916..563c886 100644
--- a/sky_phone/source/shared/custom_apps.lua
+++ b/sky_phone/source/shared/custom_apps.lua
@@ -35,6 +35,7 @@ local ALLOWED_PERMISSIONS = {
 }
 
 local RESERVED_APP_IDS = {
+    admin = true,
     ["app-store"] = true,
     banking = true,
     crypto = true,
diff --git a/sky_phone/sql/install.sql b/sky_phone/sql/install.sql
index 0a2b7a5..75aea2b 100644
--- a/sky_phone/sql/install.sql
+++ b/sky_phone/sql/install.sql
@@ -185,6 +185,33 @@ CREATE TABLE IF NOT EXISTS `sky_phone_device_security` (
     FOREIGN KEY (`device_imei`) REFERENCES `sky_phone_devices` (`imei`) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 
+CREATE TABLE IF NOT EXISTS `sky_phone_admin_audit` (
+    `id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
+    `actor_identifier` VARCHAR(80) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `actor_name` VARCHAR(120) NOT NULL,
+    `target_identifier` VARCHAR(80) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `target_source` INT UNSIGNED NULL,
+    `device_imei` CHAR(15) CHARACTER SET ascii COLLATE ascii_bin NULL,
+    `action` VARCHAR(48) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `details` LONGTEXT NOT NULL,
+    `created_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    PRIMARY KEY (`id`),
+    KEY `idx_sky_phone_admin_audit_created` (`created_at`, `id`),
+    KEY `idx_sky_phone_admin_audit_target` (`target_identifier`, `created_at`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `sky_phone_configurator` (
+    `id` TINYINT UNSIGNED NOT NULL,
+    `config_payload` LONGTEXT NOT NULL,
+    `media_payload` LONGTEXT NOT NULL,
+    `revision` INT UNSIGNED NOT NULL DEFAULT 1,
+    `updated_by_identifier` VARCHAR(80) CHARACTER SET ascii COLLATE ascii_bin NULL,
+    `updated_by_name` VARCHAR(120) NULL,
+    `created_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    `updated_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+    PRIMARY KEY (`id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
 CREATE TABLE IF NOT EXISTS `sky_phone_notes` (
     `id` VARCHAR(64) NOT NULL,
     `account_id` BIGINT UNSIGNED NULL,
diff --git a/tests/server_phone_modules.lua b/tests/server_phone_modules.lua
index 6be1077..c7d98c5 100644
--- a/tests/server_phone_modules.lua
+++ b/tests/server_phone_modules.lua
@@ -24,7 +24,11 @@ Bridge = {
     },
     Debug = function()
     end,
-    Framework = {},
+    Framework = {
+        HasAdminGroup = function()
+            return true
+        end,
+    },
     Inventory = {
         GetResourceName = function()
             return "test_inventory"
@@ -37,6 +41,11 @@ Bridge = {
 }
 
 Config = {
+    AdminPanel = {
+        AdminGroups = { "admin" },
+        Command = "phoneadmin",
+        Enabled = true,
+    },
     Phone = {
         DevelopmentCommand = false,
         DeviceName = "Test Phone",
@@ -82,6 +91,12 @@ function AddEventHandler(name, callback)
     event_handlers[name][#event_handlers[name] + 1] = callback
 end
 
+function RegisterCommand(name, callback, restricted)
+    assert(name == "phoneadmin")
+    assert(type(callback) == "function")
+    assert(restricted == false)
+end
+
 function TriggerClientEvent()
 end