feat: add moderation system with labels, reports, and user preferences

Labels:
- Label definitions with severity levels (takedown, alert, inform)
- Apply/negate labels on records and accounts
- Automatic takedown filtering from all queries
- Self-labels support (author-applied labels merged with moderator labels)
- Labels field exposed on all record types

Reports:
- User-submitted reports with reason types
- Admin review and resolution workflow
- Connection pagination for admin queries

Label Preferences:
- Per-user visibility settings (ignore, show, warn, hide)
- Query and mutation via public /graphql endpoint
- System labels enforced, cannot be overridden

Admin API:
- Connection types with cursor pagination for labels and reports
- Label definition management
- Report resolution with label application

Also includes:
- Union input type support for GraphQL mutations
- Moderation documentation guide

dev-docs/plans/2025-12-29-generated-union-input-types.md

···
+# Generated Union Input Types Implementation Plan
+
+> **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.
+
+**Goal:** Generate type-safe GraphQL input types for AT Protocol union fields, with proper discriminator handling for both single and multi-variant unions, and transformation to AT Protocol format.
+
+**Architecture:** Build input types from lexicon ObjectDefs at schema build time. For single-variant unions, use the variant's input type directly. For multi-variant unions, generate a discriminated union input with a `type` enum field and optional fields for each variant. Build a registry mapping field paths to their union refs during schema generation, pass it to the mutation context, and use it for dynamic `$type` resolution.
+
+**Tech Stack:** Gleam, swell GraphQL library, lexicon_graphql type mapper, lexicon registry
+
+---
+
+## Background
+
+AT Protocol unions require a `$type` discriminator in JSON:
+```json
+{
+  "$type": "com.atproto.label.defs#selfLabels",
+  "values": [{ "val": "sexual" }]
+}
+```
+
+GraphQL can't use `$type` (reserved character), so we:
+1. Generate input types matching the union variant structure
+2. For single-variant unions: use the variant type directly
+3. For multi-variant unions: add a `type` enum field as discriminator
+4. Build a registry of union field -> refs during schema generation
+5. Transform server-side using the registry to add the correct `$type` field
+
+**Key Design: Dynamic Union Resolution**
+
+Since Quickslice works with arbitrary lexicons, we can't hardcode union variants. Instead:
+- During schema generation, build a `UnionFieldRegistry`: `Dict(String, List(String))`
+- Key: `"collection.fieldName"` (e.g., `"social.grain.gallery.labels"`)
+- Value: list of variant refs (e.g., `["com.atproto.label.defs#selfLabels"]`)
+- Pass this registry to mutation resolvers
+- Use it at transformation time to look up the correct `$type`
+
+**Example schema for single-variant union (labels):**
+```graphql
+input SelfLabelInput {
+  val: String!
+}
+
+input SelfLabelsInput {
+  values: [SelfLabelInput!]!
+}
+
+input SocialGrainGalleryInput {
+  title: String!
+  images: [BlobInput!]!
+  labels: SelfLabelsInput  # Direct variant type
+}
+```
+
+**Example schema for multi-variant union (embed):**
+```graphql
+enum AppBskyFeedPostEmbedType {
+  IMAGES
+  EXTERNAL
+  RECORD
+  RECORD_WITH_MEDIA
+}
+
+input AppBskyFeedPostEmbedInput {
+  type: AppBskyFeedPostEmbedType!  # Discriminator
+  images: AppBskyEmbedImagesInput
+  external: AppBskyEmbedExternalInput
+  record: AppBskyEmbedRecordInput
+  recordWithMedia: AppBskyEmbedRecordWithMediaInput
+}
+```
+
+---
+
+### Task 1: Create Union Input Builder Module
+
+**Files:**
+- Create: `lexicon_graphql/src/lexicon_graphql/internal/graphql/union_input_builder.gleam`
+
+**Step 1: Create the union input builder module**
+
+```gleam
+/// Union Input Builder
+///
+/// Builds GraphQL input types for AT Protocol union fields.
+/// Generates input types from lexicon ObjectDefs, handling nested refs.
+///
+/// For single-variant unions: returns the variant's input type directly
+/// For multi-variant unions: creates a discriminated input type with:
+///   - A `type` enum field for selecting the variant
+///   - Optional fields for each variant's data
+///
+/// Also builds a UnionFieldRegistry for dynamic $type resolution at runtime.
+import gleam/dict.{type Dict}
+import gleam/list
+import gleam/option.{type Option}
+import gleam/string
+import lexicon_graphql/internal/graphql/type_mapper
+import lexicon_graphql/internal/lexicon/nsid
+import lexicon_graphql/internal/lexicon/registry as lexicon_registry
+import lexicon_graphql/types
+import swell/schema
+
+/// Registry of generated union input types
+/// Maps fully-qualified ref (e.g., "com.atproto.label.defs#selfLabels") to input type
+pub type UnionInputRegistry =
+  Dict(String, schema.Type)
+
+/// Mapping of union field paths to their variant refs
+/// Key: "collection.fieldName" (e.g., "social.grain.gallery.labels")
+/// Value: list of variant refs (e.g., ["com.atproto.label.defs#selfLabels"])
+/// Used for dynamic $type resolution during mutation transformation
+pub type UnionFieldRegistry =
+  Dict(String, List(String))
+
+/// Combined registry for union inputs
+pub type UnionRegistry {
+  UnionRegistry(
+    input_types: UnionInputRegistry,
+    field_variants: UnionFieldRegistry,
+  )
+}
+
+/// Build input types for all object defs in the registry
+/// Returns a registry with input types (field_variants populated separately)
+pub fn build_union_input_types(
+  registry: lexicon_registry.Registry,
+) -> UnionRegistry {
+  let object_defs = lexicon_registry.get_all_object_defs(registry)
+
+  // Build input types in dependency order (simple types first)
+  // Do two passes: first build all without refs, then with refs
+  let first_pass =
+    dict.fold(object_defs, dict.new(), fn(acc, ref, obj_def) {
+      let input_type = build_input_type_from_object_def(ref, obj_def, acc)
+      dict.insert(acc, ref, input_type)
+    })
+
+  // Second pass to resolve any remaining refs
+  let input_types =
+    dict.fold(object_defs, first_pass, fn(acc, ref, obj_def) {
+      let input_type = build_input_type_from_object_def(ref, obj_def, acc)
+      dict.insert(acc, ref, input_type)
+    })
+
+  // field_variants is populated during build_input_type in mutation builder
+  UnionRegistry(input_types: input_types, field_variants: dict.new())
+}
+
+/// Add a union field entry to the registry
+pub fn register_union_field(
+  registry: UnionRegistry,
+  collection: String,
+  field_name: String,
+  refs: List(String),
+) -> UnionRegistry {
+  let key = collection <> "." <> field_name
+  UnionRegistry(
+    input_types: registry.input_types,
+    field_variants: dict.insert(registry.field_variants, key, refs),
+  )
+}
+
+/// Look up union refs for a field
+pub fn get_union_refs(
+  registry: UnionRegistry,
+  collection: String,
+  field_name: String,
+) -> Option(List(String)) {
+  let key = collection <> "." <> field_name
+  dict.get(registry.field_variants, key) |> option.from_result
+}
+
+/// Convert a ref like "com.atproto.label.defs#selfLabels" to "SelfLabelsInput"
+pub fn ref_to_input_type_name(ref: String) -> String {
+  let base_name = nsid.to_type_name(string.replace(ref, "#", "."))
+  base_name <> "Input"
+}
+
+/// Convert a ref to a short variant name for enum values
+/// "com.atproto.label.defs#selfLabels" -> "SELF_LABELS"
+pub fn ref_to_variant_enum_value(ref: String) -> String {
+  // Extract the part after # or the last segment
+  let short_name = case string.split(ref, "#") {
+    [_, name] -> name
+    _ -> {
+      case string.split(ref, ".") |> list.last {
+        Ok(name) -> name
+        Error(_) -> ref
+      }
+    }
+  }
+  // Convert camelCase to SCREAMING_SNAKE_CASE
+  camel_to_screaming_snake(short_name)
+}
+
+/// Convert camelCase to SCREAMING_SNAKE_CASE
+fn camel_to_screaming_snake(s: String) -> String {
+  s
+  |> string.to_graphemes
+  |> list.fold(#("", False), fn(acc, char) {
+    let #(result, prev_was_lower) = acc
+    let is_upper = string.uppercase(char) == char && string.lowercase(char) != char
+    case is_upper, prev_was_lower {
+      True, True -> #(result <> "_" <> char, False)
+      _, _ -> #(result <> string.uppercase(char), !is_upper)
+    }
+  })
+  |> fn(pair) { pair.0 }
+}
+
+/// Convert SCREAMING_SNAKE_CASE back to the original short name
+/// "SELF_LABELS" -> "selfLabels"
+pub fn enum_value_to_short_name(enum_value: String) -> String {
+  let parts = string.split(enum_value, "_")
+  case parts {
+    [first, ..rest] -> {
+      let lower_first = string.lowercase(first)
+      let capitalized_rest = list.map(rest, fn(part) {
+        case string.pop_grapheme(string.lowercase(part)) {
+          Ok(#(first_char, remaining)) -> string.uppercase(first_char) <> remaining
+          Error(_) -> part
+        }
+      })
+      lower_first <> string.join(capitalized_rest, "")
+    }
+    [] -> enum_value
+  }
+}
+
+/// Convert a ref to a camelCase field name for variant fields
+/// "com.atproto.label.defs#selfLabels" -> "selfLabels"
+pub fn ref_to_variant_field_name(ref: String) -> String {
+  case string.split(ref, "#") {
+    [_, name] -> name
+    _ -> {
+      case string.split(ref, ".") |> list.last {
+        Ok(name) -> name
+        Error(_) -> ref
+      }
+    }
+  }
+}
+
+/// Build a GraphQL input type from an ObjectDef
+fn build_input_type_from_object_def(
+  ref: String,
+  obj_def: types.ObjectDef,
+  existing_input_types: UnionInputRegistry,
+) -> schema.Type {
+  let type_name = ref_to_input_type_name(ref)
+  let required_fields = obj_def.required_fields
+
+  let input_fields =
+    list.map(obj_def.properties, fn(prop) {
+      let #(name, property) = prop
+      let is_required = list.contains(required_fields, name)
+
+      // Get the input type for this property
+      let field_type = map_property_to_input_type(property, existing_input_types)
+
+      // Wrap in non_null if required
+      let final_type = case is_required {
+        True -> schema.non_null(field_type)
+        False -> field_type
+      }
+
+      schema.input_field(name, final_type, "Input for " <> name, option.None)
+    })
+
+  schema.input_object_type(type_name, "Input type for " <> ref, input_fields)
+}
+
+/// Build a discriminated union input type for multi-variant unions
+/// Creates an input with a `type` enum and optional fields for each variant
+pub fn build_multi_variant_union_input(
+  parent_type_name: String,
+  field_name: String,
+  refs: List(String),
+  existing_input_types: UnionInputRegistry,
+) -> schema.Type {
+  let union_name = parent_type_name <> capitalize_first(field_name) <> "Input"
+  let enum_name = parent_type_name <> capitalize_first(field_name) <> "Type"
+
+  // Build the type enum with variant names
+  let enum_values =
+    list.map(refs, fn(ref) {
+      let value_name = ref_to_variant_enum_value(ref)
+      schema.enum_value(value_name, "Select " <> ref <> " variant")
+    })
+
+  let type_enum = schema.enum_type(
+    enum_name,
+    "Discriminator for " <> field_name <> " union variants",
+    enum_values,
+  )
+
+  // Build input fields: required type discriminator + optional variant fields
+  let type_field = schema.input_field(
+    "type",
+    schema.non_null(type_enum),
+    "Select which variant to use",
+    option.None,
+  )
+
+  let variant_fields =
+    list.map(refs, fn(ref) {
+      let variant_field_name = ref_to_variant_field_name(ref)
+      let field_type = case dict.get(existing_input_types, ref) {
+        Ok(input_type) -> input_type
+        Error(_) -> schema.string_type()
+      }
+      schema.input_field(
+        variant_field_name,
+        field_type,  // Optional - user provides data for selected variant
+        "Data for " <> ref <> " variant",
+        option.None,
+      )
+    })
+
+  let all_fields = [type_field, ..variant_fields]
+
+  schema.input_object_type(
+    union_name,
+    "Union input for " <> field_name <> " - use type to select variant",
+    all_fields,
+  )
+}
+
+/// Map a lexicon property to a GraphQL input type
+fn map_property_to_input_type(
+  property: types.Property,
+  existing_input_types: UnionInputRegistry,
+) -> schema.Type {
+  case property.type_ {
+    // For refs, check if we have a generated input type
+    "ref" -> {
+      case property.ref {
+        option.Some(ref) -> {
+          case dict.get(existing_input_types, ref) {
+            Ok(input_type) -> input_type
+            // Fall back to basic type mapping if no input type exists
+            Error(_) -> type_mapper.map_input_type("ref")
+          }
+        }
+        option.None -> type_mapper.map_input_type("ref")
+      }
+    }
+
+    // For arrays, handle items
+    "array" -> {
+      case property.items {
+        option.Some(types.ArrayItems(item_type, item_ref, _item_refs)) -> {
+          let item_input_type = case item_type {
+            "ref" -> {
+              case item_ref {
+                option.Some(ref) -> {
+                  case dict.get(existing_input_types, ref) {
+                    Ok(input_type) -> input_type
+                    Error(_) -> type_mapper.map_input_type("ref")
+                  }
+                }
+                option.None -> type_mapper.map_input_type("ref")
+              }
+            }
+            _ -> type_mapper.map_input_type(item_type)
+          }
+          schema.list_type(schema.non_null(item_input_type))
+        }
+        option.None -> schema.list_type(schema.non_null(schema.string_type()))
+      }
+    }
+
+    // For unions - handled differently based on variant count
+    // Single-variant: use variant type directly
+    // Multi-variant: caller should use build_multi_variant_union_input
+    "union" -> {
+      case property.refs {
+        option.Some([single_ref]) -> {
+          // Single-variant union: use that variant's input type directly
+          case dict.get(existing_input_types, single_ref) {
+            Ok(input_type) -> input_type
+            Error(_) -> type_mapper.map_input_type("union")
+          }
+        }
+        option.Some(_multiple_refs) -> {
+          // Multi-variant: return placeholder, caller handles this
+          type_mapper.map_input_type("union")
+        }
+        _ -> type_mapper.map_input_type("union")
+      }
+    }
+
+    // Default: use type_mapper
+    other -> type_mapper.map_input_type(other)
+  }
+}
+
+/// Capitalize the first letter of a string
+fn capitalize_first(s: String) -> String {
+  case string.pop_grapheme(s) {
+    Ok(#(first, rest)) -> string.uppercase(first) <> rest
+    Error(_) -> s
+  }
+}
+
+/// Get an input type from the registry by ref
+pub fn get_input_type(
+  registry: UnionRegistry,
+  ref: String,
+) -> Option(schema.Type) {
+  dict.get(registry.input_types, ref) |> option.from_result
+}
+
+/// Check if a union has multiple variants
+pub fn is_multi_variant_union(refs: Option(List(String))) -> Bool {
+  case refs {
+    option.Some([_, _, ..]) -> True
+    _ -> False
+  }
+}
+
+/// Find the ref that matches an enum value
+pub fn enum_value_to_ref(enum_value: String, refs: List(String)) -> Option(String) {
+  list.find(refs, fn(ref) {
+    ref_to_variant_enum_value(ref) == enum_value
+  })
+  |> option.from_result
+}
+```
+
+**Step 2: Verify compilation**
+
+Run: `cd lexicon_graphql && gleam build`
+Expected: Build succeeds (may have warnings about unused functions)
+
+**Step 3: Commit**
+
+```bash
+git add lexicon_graphql/src/lexicon_graphql/internal/graphql/union_input_builder.gleam
+git commit -m "feat: add union input type builder with multi-variant support and field registry"
+```
+
+---
+
+### Task 2: Add get_all_object_defs to Registry
+
+**Files:**
+- Modify: `lexicon_graphql/src/lexicon_graphql/internal/lexicon/registry.gleam`
+
+**Step 1: Add function to get all object defs**
+
+Add this function after `get_object_def`:
+
+```gleam
+/// Get all object definitions from the registry
+pub fn get_all_object_defs(registry: Registry) -> Dict(String, types.ObjectDef) {
+  registry.object_defs
+}
+```
+
+**Step 2: Verify compilation**
+
+Run: `cd lexicon_graphql && gleam build`
+Expected: Build succeeds
+
+**Step 3: Commit**
+
+```bash
+git add lexicon_graphql/src/lexicon_graphql/internal/lexicon/registry.gleam
+git commit -m "feat: add get_all_object_defs to lexicon registry"
+```
+
+---
+
+### Task 3: Update Type Mapper for Union Input Types
+
+**Files:**
+- Modify: `lexicon_graphql/src/lexicon_graphql/internal/graphql/type_mapper.gleam`
+
+**Step 1: Add imports**
+
+Add after the existing imports:
+
+```gleam
+import gleam/dict.{type Dict}
+import lexicon_graphql/types
+```
+
+**Step 2: Add new function for union input type resolution**
+
+Add this new function after `map_input_type`:
+
+```gleam
+/// Context needed for building union input types
+pub type UnionInputContext {
+  UnionInputContext(
+    input_types: Dict(String, schema.Type),
+    parent_type_name: String,
+  )
+}
+
+/// Maps a lexicon property to a GraphQL input type, with union input registry lookup
+/// This version can resolve union refs to their generated input types
+/// For multi-variant unions, builds discriminated union input types on demand
+pub fn map_input_type_with_unions(
+  property: types.Property,
+  field_name: String,
+  ctx: UnionInputContext,
+) -> schema.Type {
+  case property.type_ {
+    // For unions, handle single vs multi-variant
+    "union" -> {
+      case property.refs {
+        // Single-variant: use variant's input type directly
+        option.Some([single_ref]) -> {
+          case dict.get(ctx.input_types, single_ref) {
+            Ok(input_type) -> input_type
+            Error(_) -> schema.string_type()
+          }
+        }
+        // Multi-variant: build discriminated union input
+        option.Some(refs) if list.length(refs) > 1 -> {
+          build_multi_variant_union_input(
+            ctx.parent_type_name,
+            field_name,
+            refs,
+            ctx.input_types,
+          )
+        }
+        _ -> schema.string_type()
+      }
+    }
+
+    // For refs, check the registry
+    "ref" -> {
+      case property.ref {
+        option.Some(ref) -> {
+          case dict.get(ctx.input_types, ref) {
+            Ok(input_type) -> input_type
+            Error(_) -> map_input_type("ref")
+          }
+        }
+        option.None -> map_input_type("ref")
+      }
+    }
+
+    // For arrays with ref/union items
+    "array" -> {
+      case property.items {
+        option.Some(types.ArrayItems(item_type, item_ref, item_refs)) -> {
+          case item_type {
+            "ref" -> {
+              case item_ref {
+                option.Some(ref) -> {
+                  case dict.get(ctx.input_types, ref) {
+                    Ok(input_type) ->
+                      schema.list_type(schema.non_null(input_type))
+                    Error(_) ->
+                      schema.list_type(schema.non_null(schema.string_type()))
+                  }
+                }
+                option.None ->
+                  schema.list_type(schema.non_null(schema.string_type()))
+              }
+            }
+            "union" -> {
+              case item_refs {
+                // Single-variant array items
+                option.Some([single_ref]) -> {
+                  case dict.get(ctx.input_types, single_ref) {
+                    Ok(input_type) ->
+                      schema.list_type(schema.non_null(input_type))
+                    Error(_) ->
+                      schema.list_type(schema.non_null(schema.string_type()))
+                  }
+                }
+                // Multi-variant array items
+                option.Some(refs) if list.length(refs) > 1 -> {
+                  let item_union = build_multi_variant_union_input(
+                    ctx.parent_type_name,
+                    field_name <> "Item",
+                    refs,
+                    ctx.input_types,
+                  )
+                  schema.list_type(schema.non_null(item_union))
+                }
+                _ -> schema.list_type(schema.non_null(schema.string_type()))
+              }
+            }
+            _ -> map_array_type(property.items, dict.new(), "", "")
+          }
+        }
+        option.None -> schema.list_type(schema.non_null(schema.string_type()))
+      }
+    }
+
+    // Default to regular input type mapping
+    _ -> map_input_type(property.type_)
+  }
+}
+
+/// Build a discriminated union input type for multi-variant unions
+fn build_multi_variant_union_input(
+  parent_type_name: String,
+  field_name: String,
+  refs: List(String),
+  existing_input_types: Dict(String, schema.Type),
+) -> schema.Type {
+  let union_name = parent_type_name <> capitalize_first(field_name) <> "Input"
+  let enum_name = parent_type_name <> capitalize_first(field_name) <> "Type"
+
+  // Build the type enum with variant names
+  let enum_values =
+    list.map(refs, fn(ref) {
+      let value_name = ref_to_variant_enum_value(ref)
+      schema.enum_value(value_name, "Select " <> ref <> " variant")
+    })
+
+  let type_enum = schema.enum_type(
+    enum_name,
+    "Discriminator for " <> field_name <> " union variants",
+    enum_values,
+  )
+
+  // Build input fields: required type discriminator + optional variant fields
+  let type_field = schema.input_field(
+    "type",
+    schema.non_null(type_enum),
+    "Select which variant to use",
+    option.None,
+  )
+
+  let variant_fields =
+    list.map(refs, fn(ref) {
+      let variant_field_name = ref_to_variant_field_name(ref)
+      let field_type = case dict.get(existing_input_types, ref) {
+        Ok(input_type) -> input_type
+        Error(_) -> schema.string_type()
+      }
+      schema.input_field(
+        variant_field_name,
+        field_type,  // Optional - user provides data for selected variant
+        "Data for " <> ref <> " variant",
+        option.None,
+      )
+    })
+
+  let all_fields = [type_field, ..variant_fields]
+
+  schema.input_object_type(
+    union_name,
+    "Union input for " <> field_name <> " - use type field to select variant",
+    all_fields,
+  )
+}
+
+/// Convert a ref to SCREAMING_SNAKE_CASE enum value
+fn ref_to_variant_enum_value(ref: String) -> String {
+  let short_name = case string.split(ref, "#") {
+    [_, name] -> name
+    _ -> {
+      case string.split(ref, ".") |> list.last {
+        Ok(name) -> name
+        Error(_) -> ref
+      }
+    }
+  }
+  camel_to_screaming_snake(short_name)
+}
+
+/// Convert camelCase to SCREAMING_SNAKE_CASE
+fn camel_to_screaming_snake(s: String) -> String {
+  s
+  |> string.to_graphemes
+  |> list.fold(#("", False), fn(acc, char) {
+    let #(result, prev_was_lower) = acc
+    let is_upper = string.uppercase(char) == char && string.lowercase(char) != char
+    case is_upper, prev_was_lower {
+      True, True -> #(result <> "_" <> char, False)
+      _, _ -> #(result <> string.uppercase(char), !is_upper)
+    }
+  })
+  |> fn(pair) { pair.0 }
+}
+
+/// Convert a ref to a camelCase field name
+fn ref_to_variant_field_name(ref: String) -> String {
+  case string.split(ref, "#") {
+    [_, name] -> name
+    _ -> {
+      case string.split(ref, ".") |> list.last {
+        Ok(name) -> name
+        Error(_) -> ref
+      }
+    }
+  }
+}
+
+/// Capitalize the first letter
+fn capitalize_first(s: String) -> String {
+  case string.pop_grapheme(s) {
+    Ok(#(first, rest)) -> string.uppercase(first) <> rest
+    Error(_) -> s
+  }
+}
+```
+
+**Step 3: Verify compilation**
+
+Run: `cd lexicon_graphql && gleam build`
+Expected: Build succeeds
+
+**Step 4: Commit**
+
+```bash
+git add lexicon_graphql/src/lexicon_graphql/internal/graphql/type_mapper.gleam
+git commit -m "feat: add map_input_type_with_unions with multi-variant support"
+```
+
+---
+
+### Task 4: Update Mutation Builder to Build and Return Union Registry
+
+**Files:**
+- Modify: `lexicon_graphql/src/lexicon_graphql/mutation/builder.gleam`
+
+**Step 1: Add imports**
+
+Add to imports:
+
+```gleam
+import lexicon_graphql/internal/graphql/union_input_builder
+import lexicon_graphql/internal/lexicon/registry as lexicon_registry
+```
+
+**Step 2: Create new return type that includes the union registry**
+
+Add after the existing type definitions:
+
+```gleam
+/// Result of building mutation type - includes the type and union field registry
+pub type MutationBuildResult {
+  MutationBuildResult(
+    mutation_type: schema.Type,
+    union_registry: union_input_builder.UnionRegistry,
+  )
+}
+```
+
+**Step 3: Update build_mutation_type to return MutationBuildResult**
+
+```gleam
+/// Build a GraphQL Mutation type from lexicon definitions
+/// Returns both the mutation type and a union registry for transformation
+pub fn build_mutation_type(
+  lexicons: List(types.Lexicon),
+  object_types: dict.Dict(String, schema.Type),
+  create_factory: option.Option(ResolverFactory),
+  update_factory: option.Option(ResolverFactory),
+  delete_factory: option.Option(ResolverFactory),
+  upload_blob_factory: option.Option(UploadBlobResolverFactory),
+  custom_fields: option.Option(List(schema.Field)),
+  registry: option.Option(lexicon_registry.Registry),
+) -> MutationBuildResult {
+  // Build union input types if registry is provided
+  let initial_union_registry = case registry {
+    option.Some(reg) -> union_input_builder.build_union_input_types(reg)
+    option.None -> union_input_builder.UnionRegistry(
+      input_types: dict.new(),
+      field_variants: dict.new(),
+    )
+  }
+
+  // Extract record types
+  let record_types = extract_record_types(lexicons)
+
+  // Build mutation fields for each record type, accumulating union field registrations
+  let #(record_mutation_fields, final_union_registry) =
+    list.fold(record_types, #([], initial_union_registry), fn(acc, record) {
+      let #(fields_acc, registry_acc) = acc
+      let #(new_fields, updated_registry) = build_mutations_for_record(
+        record,
+        object_types,
+        create_factory,
+        update_factory,
+        delete_factory,
+        registry_acc,
+      )
+      #(list.append(fields_acc, new_fields), updated_registry)
+    })
+
+  // Add uploadBlob mutation if factory is provided
+  let with_upload_blob = case upload_blob_factory {
+    option.Some(factory) -> {
+      let upload_blob_mutation = build_upload_blob_mutation(factory)
+      [upload_blob_mutation, ..record_mutation_fields]
+    }
+    option.None -> record_mutation_fields
+  }
+
+  // Add custom fields if provided
+  let all_mutation_fields = case custom_fields {
+    option.Some(fields) -> list.append(with_upload_blob, fields)
+    option.None -> with_upload_blob
+  }
+
+  // Build the Mutation object type
+  let mutation_type = schema.object_type("Mutation", "Root mutation type", all_mutation_fields)
+
+  MutationBuildResult(
+    mutation_type: mutation_type,
+    union_registry: final_union_registry,
+  )
+}
+```
+
+**Step 4: Update build_mutations_for_record to return updated registry**
+
+```gleam
+fn build_mutations_for_record(
+  record: RecordInfo,
+  object_types: dict.Dict(String, schema.Type),
+  create_factory: option.Option(ResolverFactory),
+  update_factory: option.Option(ResolverFactory),
+  delete_factory: option.Option(ResolverFactory),
+  union_registry: union_input_builder.UnionRegistry,
+) -> #(List(schema.Field), union_input_builder.UnionRegistry) {
+  // Build input type and get updated registry with union field mappings
+  let #(input_type, updated_registry) = build_input_type_with_registry(
+    record.type_name <> "Input",
+    record.nsid,
+    record.properties,
+    union_registry,
+  )
+
+  let create_mutation =
+    build_create_mutation(record, object_types, create_factory, input_type)
+  let update_mutation =
+    build_update_mutation(record, object_types, update_factory, input_type)
+  let delete_mutation = build_delete_mutation(record, delete_factory)
+
+  #([create_mutation, update_mutation, delete_mutation], updated_registry)
+}
+```
+
+**Step 5: Update build_input_type to register union fields**
+
+```gleam
+/// Build an InputObjectType and register union fields
+fn build_input_type_with_registry(
+  type_name: String,
+  collection: String,
+  properties: List(#(String, types.Property)),
+  union_registry: union_input_builder.UnionRegistry,
+) -> #(schema.Type, union_input_builder.UnionRegistry) {
+  // Create context for union input type resolution
+  let ctx = type_mapper.UnionInputContext(
+    input_types: union_registry.input_types,
+    parent_type_name: type_name,
+  )
+
+  // Build fields and register union fields
+  let #(input_fields, final_registry) =
+    list.fold(properties, #([], union_registry), fn(acc, prop) {
+      let #(fields_acc, registry_acc) = acc
+      let #(name, types.Property(type_, required, _, ref, refs, items)) = prop
+
+      // Build property for type mapping
+      let property = types.Property(type_, required, option.None, ref, refs, items)
+
+      // Use union-aware type mapping with field name for multi-variant naming
+      let graphql_type = type_mapper.map_input_type_with_unions(property, name, ctx)
+
+      // Register union fields for later transformation
+      let updated_registry = case type_, refs {
+        "union", option.Some(ref_list) -> {
+          union_input_builder.register_union_field(registry_acc, collection, name, ref_list)
+        }
+        _, _ -> registry_acc
+      }
+
+      // Make required fields non-null
+      let field_type = case required {
+        True -> schema.non_null(graphql_type)
+        False -> graphql_type
+      }
+
+      let input_field = schema.input_field(
+        name,
+        field_type,
+        "Input field for " <> name,
+        option.None,
+      )
+
+      #([input_field, ..fields_acc], updated_registry)
+    })
+
+  let reversed_fields = list.reverse(input_fields)
+  let input_type = schema.input_object_type(
+    type_name,
+    "Input type for " <> type_name,
+    reversed_fields,
+  )
+
+  #(input_type, final_registry)
+}
+```
+
+**Step 6: Update create and update mutation builders to accept input_type directly**
+
+```gleam
+fn build_create_mutation(
+  record: RecordInfo,
+  object_types: dict.Dict(String, schema.Type),
+  factory: option.Option(ResolverFactory),
+  input_type: schema.Type,
+) -> schema.Field {
+  let mutation_name = "create" <> record.type_name
+
+  // Get the complete object type from the dict (includes all join fields)
+  let assert Ok(return_type) = dict.get(object_types, record.nsid)
+
+  // Create arguments
+  let arguments = [
+    schema.argument(
+      "input",
+      schema.non_null(input_type),
+      "Record data",
+      option.None,
+    ),
+    schema.argument(
+      "rkey",
+      schema.string_type(),
+      "Optional record key (defaults to TID)",
+      option.None,
+    ),
+  ]
+
+  // Get resolver - either from factory or use stub
+  let collection = record.nsid
+  let resolver = case factory {
+    option.Some(factory_fn) -> factory_fn(collection)
+    option.None -> fn(_resolver_ctx) {
+      Error("Create mutation for " <> collection <> " not yet implemented.")
+    }
+  }
+
+  schema.field_with_args(
+    mutation_name,
+    return_type,
+    "Create a new " <> record.nsid <> " record",
+    arguments,
+    resolver,
+  )
+}
+```
+
+(Same pattern for `build_update_mutation`)
+
+**Step 7: Verify compilation**
+
+Run: `cd lexicon_graphql && gleam build`
+Expected: Build succeeds
+
+**Step 8: Commit**
+
+```bash
+git add lexicon_graphql/src/lexicon_graphql/mutation/builder.gleam
+git commit -m "feat: mutation builder returns union registry for dynamic transformation"
+```
+
+---
+
+### Task 5: Update Server Schema to Use MutationBuildResult
+
+**Files:**
+- Modify: `server/src/graphql/lexicon/schema.gleam`
+
+**Step 1: Update to use MutationBuildResult**
+
+Where mutation type is built, extract the union registry:
+
+```gleam
+// Build mutation type and get union registry
+let mutation_build_result = mutation_builder.build_mutation_type(
+  lexicons,
+  object_types,
+  create_factory,
+  update_factory,
+  delete_factory,
+  upload_blob_factory,
+  custom_mutation_fields,
+  option.Some(registry),
+)
+
+let mutation_type = mutation_build_result.mutation_type
+let union_registry = mutation_build_result.union_registry
+```
+
+**Step 2: Pass union_registry to mutation context**
+
+The union_registry needs to be available to mutation resolvers. Update the schema building to include it in the resolver factories or mutation context.
+
+**Step 3: Verify compilation**
+
+Run: `cd server && gleam build`
+Expected: Build succeeds
+
+**Step 4: Commit**
+
+```bash
+git add server/src/graphql/lexicon/schema.gleam
+git commit -m "feat: extract union registry from mutation builder"
+```
+
+---
+
+### Task 6: Add Union Input Transformation in Mutations
+
+**Files:**
+- Modify: `server/src/graphql/lexicon/mutations.gleam`
+
+**Step 1: Add union registry to MutationContext**
+
+Update MutationContext to include the union registry:
+
+```gleam
+import lexicon_graphql/internal/graphql/union_input_builder
+
+pub type MutationContext {
+  MutationContext(
+    db: Executor,
+    did_cache: Subject(did_cache.Message),
+    signing_key: option.Option(String),
+    atp_client_id: String,
+    plc_url: String,
+    collection_ids: List(String),
+    external_collection_ids: List(String),
+    union_registry: union_input_builder.UnionRegistry,  // Add this
+  )
+}
+```
+
+**Step 2: Add dynamic union transformation helpers**
+
+```gleam
+/// Transform union input using registry-based lookup
+/// For single-variant: adds $type based on the single ref
+/// For multi-variant: reads "type" enum field, maps to ref, extracts variant data
+fn transform_union_input(
+  collection: String,
+  field_name: String,
+  fields: List(#(String, value.Value)),
+  union_registry: union_input_builder.UnionRegistry,
+) -> value.Value {
+  // Look up the refs for this field
+  case union_input_builder.get_union_refs(union_registry, collection, field_name) {
+    option.Some([single_ref]) -> {
+      // Single-variant: just add $type
+      let with_type = [#("$type", value.String(single_ref)), ..fields]
+      value.Object(with_type)
+    }
+    option.Some(refs) -> {
+      // Multi-variant: read "type" field and extract variant data
+      transform_multi_variant_union(fields, refs)
+    }
+    option.None -> {
+      // Not a registered union field, pass through
+      value.Object(fields)
+    }
+  }
+}
+
+/// Transform multi-variant union input
+/// Input: { type: "SELF_LABELS", selfLabels: { values: [...] } }
+/// Output: { "$type": "com.atproto.label.defs#selfLabels", "values": [...] }
+fn transform_multi_variant_union(
+  fields: List(#(String, value.Value)),
+  refs: List(String),
+) -> value.Value {
+  // Extract the type discriminator
+  let type_value = case list.key_find(fields, "type") {
+    Ok(value.String(v)) -> option.Some(v)
+    Ok(value.Enum(v)) -> option.Some(v)
+    _ -> option.None
+  }
+
+  case type_value {
+    option.Some(enum_value) -> {
+      // Find which ref matches this enum value
+      case union_input_builder.enum_value_to_ref(enum_value, refs) {
+        option.Some(type_ref) -> {
+          // Get the variant field name
+          let variant_field_name = union_input_builder.ref_to_variant_field_name(type_ref)
+
+          // Extract variant data
+          case list.key_find(fields, variant_field_name) {
+            Ok(value.Object(variant_fields)) -> {
+              // Build AT Protocol format
+              let with_type = [#("$type", value.String(type_ref)), ..variant_fields]
+              value.Object(with_type)
+            }
+            _ -> value.Object(fields)  // No variant data
+          }
+        }
+        option.None -> value.Object(fields)  // Unknown enum value
+      }
+    }
+    option.None -> value.Object(fields)  // No type field
+  }
+}
+
+/// Check if this field is a union field in the registry
+fn is_registered_union_field(
+  collection: String,
+  field_name: String,
+  union_registry: union_input_builder.UnionRegistry,
+) -> Bool {
+  case union_input_builder.get_union_refs(union_registry, collection, field_name) {
+    option.Some(_) -> True
+    option.None -> False
+  }
+}
+```
+
+**Step 3: Update transform_record_value to use registry**
+
+```gleam
+fn transform_record_value(
+  val: value.Value,
+  field_name: String,
+  collection: String,
+  union_registry: union_input_builder.UnionRegistry,
+) -> value.Value {
+  case val {
+    value.Object(fields) -> {
+      // Check if this is a registered union field
+      case is_registered_union_field(collection, field_name, union_registry) {
+        True -> transform_union_input(collection, field_name, fields, union_registry)
+        False -> {
+          // Check for blob pattern
+          case is_blob_input(fields) {
+            True -> transform_blob_object(fields)
+            False -> {
+              // Recursively transform nested objects
+              value.Object(
+                list.map(fields, fn(pair) {
+                  let #(name, v) = pair
+                  #(name, transform_record_value(v, name, collection, union_registry))
+                }),
+              )
+            }
+          }
+        }
+      }
+    }
+    value.List(items) ->
+      value.List(list.map(items, fn(item) {
+        transform_record_value(item, field_name, collection, union_registry)
+      }))
+    _ -> val
+  }
+}
+
+/// Check if an object looks like a blob input
+fn is_blob_input(fields: List(#(String, value.Value))) -> Bool {
+  case list.key_find(fields, "ref"), list.key_find(fields, "mimeType") {
+    Ok(_), Ok(_) -> True
+    _, _ -> False
+  }
+}
+```
+
+**Step 4: Update mutation resolvers to pass union_registry**
+
+In the create/update resolver factories, pass the union_registry to transform_record_value:
+
+```gleam
+// In create_resolver_factory or similar:
+let transformed_input = transform_record_value(
+  input_value,
+  "input",
+  collection,
+  ctx.union_registry,
+)
+```
+
+**Step 5: Verify compilation**
+
+Run: `cd server && gleam build`
+Expected: Build succeeds
+
+**Step 6: Commit**
+
+```bash
+git add server/src/graphql/lexicon/mutations.gleam
+git commit -m "feat: dynamic union transformation using registry lookup"
+```
+
+---
+
+### Task 7: Write Unit Tests
+
+**Files:**
+- Create: `lexicon_graphql/test/union_input_builder_test.gleam`
+
+**Step 1: Create test file**
+
+```gleam
+import gleam/dict
+import gleam/option
+import gleeunit/should
+import lexicon_graphql/internal/graphql/union_input_builder
+import lexicon_graphql/internal/graphql/type_mapper
+import lexicon_graphql/internal/lexicon/registry as lexicon_registry
+import lexicon_graphql/types
+import swell/schema
+
+pub fn ref_to_input_type_name_test() {
+  union_input_builder.ref_to_input_type_name("com.atproto.label.defs#selfLabels")
+  |> should.equal("ComAtprotoLabelDefsSelfLabelsInput")
+}
+
+pub fn ref_to_variant_enum_value_test() {
+  union_input_builder.ref_to_variant_enum_value("com.atproto.label.defs#selfLabels")
+  |> should.equal("SELF_LABELS")
+}
+
+pub fn ref_to_variant_enum_value_camel_case_test() {
+  union_input_builder.ref_to_variant_enum_value("app.bsky.embed.recordWithMedia")
+  |> should.equal("RECORD_WITH_MEDIA")
+}
+
+pub fn ref_to_variant_field_name_test() {
+  union_input_builder.ref_to_variant_field_name("com.atproto.label.defs#selfLabels")
+  |> should.equal("selfLabels")
+}
+
+pub fn enum_value_to_short_name_test() {
+  union_input_builder.enum_value_to_short_name("SELF_LABELS")
+  |> should.equal("selfLabels")
+}
+
+pub fn enum_value_to_short_name_single_word_test() {
+  union_input_builder.enum_value_to_short_name("IMAGES")
+  |> should.equal("images")
+}
+
+pub fn is_multi_variant_union_single_test() {
+  union_input_builder.is_multi_variant_union(option.Some(["ref1"]))
+  |> should.be_false()
+}
+
+pub fn is_multi_variant_union_multiple_test() {
+  union_input_builder.is_multi_variant_union(option.Some(["ref1", "ref2"]))
+  |> should.be_true()
+}
+
+pub fn register_and_get_union_field_test() {
+  let registry = union_input_builder.UnionRegistry(
+    input_types: dict.new(),
+    field_variants: dict.new(),
+  )
+
+  let refs = ["com.atproto.label.defs#selfLabels"]
+  let updated = union_input_builder.register_union_field(
+    registry,
+    "social.grain.gallery",
+    "labels",
+    refs,
+  )
+
+  case union_input_builder.get_union_refs(updated, "social.grain.gallery", "labels") {
+    option.Some(found_refs) -> found_refs |> should.equal(refs)
+    option.None -> should.fail()
+  }
+}
+
+pub fn enum_value_to_ref_test() {
+  let refs = [
+    "com.atproto.label.defs#selfLabels",
+    "app.bsky.embed.images",
+  ]
+
+  case union_input_builder.enum_value_to_ref("SELF_LABELS", refs) {
+    option.Some(ref) -> ref |> should.equal("com.atproto.label.defs#selfLabels")
+    option.None -> should.fail()
+  }
+
+  case union_input_builder.enum_value_to_ref("IMAGES", refs) {
+    option.Some(ref) -> ref |> should.equal("app.bsky.embed.images")
+    option.None -> should.fail()
+  }
+}
+
+pub fn build_union_input_types_creates_input_types_test() {
+  let self_label_def = types.ObjectDef(
+    type_: "object",
+    required_fields: ["val"],
+    properties: [
+      #("val", types.Property("string", True, option.None, option.None, option.None, option.None)),
+    ],
+  )
+
+  let self_labels_def = types.ObjectDef(
+    type_: "object",
+    required_fields: ["values"],
+    properties: [
+      #("values", types.Property(
+        "array",
+        True,
+        option.None,
+        option.None,
+        option.None,
+        option.Some(types.ArrayItems("ref", option.Some("com.atproto.label.defs#selfLabel"), option.None)),
+      )),
+    ],
+  )
+
+  let object_defs = dict.from_list([
+    #("com.atproto.label.defs#selfLabel", self_label_def),
+    #("com.atproto.label.defs#selfLabels", self_labels_def),
+  ])
+
+  let registry = lexicon_registry.Registry(
+    lexicons: dict.new(),
+    object_defs: object_defs,
+  )
+
+  let result = union_input_builder.build_union_input_types(registry)
+
+  dict.size(result.input_types) |> should.equal(2)
+
+  case dict.get(result.input_types, "com.atproto.label.defs#selfLabel") {
+    Ok(input_type) -> {
+      schema.type_name(input_type)
+      |> should.equal("ComAtprotoLabelDefsSelfLabelInput")
+    }
+    Error(_) -> should.fail()
+  }
+}
+
+pub fn multi_variant_union_input_has_type_enum_test() {
+  let input_types = dict.from_list([
+    #("app.bsky.embed.images", schema.input_object_type("ImagesInput", "Images", [])),
+    #("app.bsky.embed.external", schema.input_object_type("ExternalInput", "External", [])),
+  ])
+
+  let ctx = type_mapper.UnionInputContext(
+    input_types: input_types,
+    parent_type_name: "Post",
+  )
+
+  let property = types.Property(
+    "union",
+    False,
+    option.None,
+    option.None,
+    option.Some(["app.bsky.embed.images", "app.bsky.embed.external"]),
+    option.None,
+  )
+
+  let result = type_mapper.map_input_type_with_unions(property, "embed", ctx)
+
+  schema.type_name(result) |> should.equal("PostEmbedInput")
+  schema.is_input_object(result) |> should.be_true()
+}
+```
+
+**Step 2: Run tests**
+
+Run: `cd lexicon_graphql && gleam test`
+Expected: Tests pass
+
+**Step 3: Commit**
+
+```bash
+git add lexicon_graphql/test/union_input_builder_test.gleam
+git commit -m "test: add unit tests for union input builder with registry"
+```
+
+---
+
+### Task 8: Integration Test
+
+**Step 1: Start server and test**
+
+Follow manual testing steps from original plan.
+
+**Step 2: Commit fixes**
+
+---
+
+### Task 9: Final Verification
+
+**Step 1: Run all tests**
+
+**Step 2: Final commit**
+
+---
+
+## Usage Examples
+
+### Single-Variant Union (selfLabels)
+
+```graphql
+mutation {
+  createSocialGrainGallery(input: {
+    title: "My Gallery"
+    images: []
+    labels: {
+      values: [{ val: "art" }, { val: "photography" }]
+    }
+  }) {
+    uri
+  }
+}
+```
+
+### Multi-Variant Union (embed)
+
+```graphql
+mutation {
+  createAppBskyFeedPost(input: {
+    text: "Check this out!"
+    embed: {
+      type: IMAGES  # Discriminator selects variant
+      images: {     # Provide data for selected variant
+        images: [{ alt: "Photo", image: { ref: "...", mimeType: "image/jpeg", size: 1234 } }]
+      }
+    }
+  }) {
+    uri
+  }
+}
+```
+
+---
+
+## Notes
+
+- **No hardcoded union variants** - everything is derived from lexicons
+- Union field registry is built during schema generation from lexicon definitions
+- Registry maps `"collection.fieldName"` -> `[refs]` for dynamic lookup
+- Single-variant unions use the variant type directly
+- Multi-variant unions get a `type` enum field + optional variant fields
+- Server transformation uses registry lookup, not hardcoded patterns

dev-docs/plans/2025-12-29-labels-and-reports.md

···
+# Labels and Reports Implementation Plan
+
+> **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.
+
+**Goal:** Add AT Protocol-compatible labels and moderation reports to quickslice for self-moderation.
+
+**Architecture:** Three new tables (label_definition, label, report) with admin API for management and lexicon API for user reports. Labels attach to records/accounts via URI, with server-side filtering for `!takedown`/`!suspend` labels. Labels field added to all record types for client-side display decisions.
+
+**Tech Stack:** Gleam, SQLite/PostgreSQL, GraphQL (swell library), existing repository patterns.
+
+---
+
+## Task 1: Database Migration
+
+**Files:**
+- Create: `server/db/migrations/20251229000001_add_labels_and_reports.sql`
+
+**Step 1: Write the migration SQL**
+
+```sql
+-- migrate:up
+
+-- =============================================================================
+-- Label Definition Table
+-- =============================================================================
+
+-- Defines available label values for this instance
+CREATE TABLE IF NOT EXISTS label_definition (
+  val TEXT PRIMARY KEY NOT NULL,
+  description TEXT NOT NULL,
+  severity TEXT NOT NULL CHECK (severity IN ('inform', 'alert', 'takedown')),
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+-- Seed default label definitions (Bluesky-compatible)
+INSERT INTO label_definition (val, description, severity) VALUES
+  ('!takedown', 'Content removed by moderators', 'takedown'),
+  ('!suspend', 'Account suspended', 'takedown'),
+  ('!warn', 'Show warning before displaying', 'alert'),
+  ('!hide', 'Hide from feeds (still accessible via direct link)', 'alert'),
+  ('porn', 'Pornographic content', 'alert'),
+  ('sexual', 'Sexually suggestive content', 'alert'),
+  ('nudity', 'Non-sexual nudity', 'alert'),
+  ('gore', 'Graphic violence or gore', 'alert'),
+  ('graphic-media', 'Disturbing or graphic media', 'alert'),
+  ('impersonation', 'Account impersonating someone', 'inform'),
+  ('spam', 'Spam or unwanted content', 'inform');
+
+-- =============================================================================
+-- Label Table
+-- =============================================================================
+
+-- Applied labels on records/accounts
+CREATE TABLE IF NOT EXISTS label (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  src TEXT NOT NULL,
+  uri TEXT NOT NULL,
+  cid TEXT,
+  val TEXT NOT NULL,
+  neg INTEGER NOT NULL DEFAULT 0,
+  cts TEXT NOT NULL DEFAULT (datetime('now')),
+  exp TEXT,
+  FOREIGN KEY (val) REFERENCES label_definition(val)
+);
+
+CREATE INDEX IF NOT EXISTS idx_label_uri ON label(uri);
+CREATE INDEX IF NOT EXISTS idx_label_val ON label(val);
+CREATE INDEX IF NOT EXISTS idx_label_src ON label(src);
+CREATE INDEX IF NOT EXISTS idx_label_cts ON label(cts DESC);
+
+-- =============================================================================
+-- Report Table
+-- =============================================================================
+
+-- User-submitted reports awaiting review
+CREATE TABLE IF NOT EXISTS report (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  reporter_did TEXT NOT NULL,
+  subject_uri TEXT NOT NULL,
+  reason_type TEXT NOT NULL CHECK (reason_type IN ('spam', 'violation', 'misleading', 'sexual', 'rude', 'other')),
+  reason TEXT,
+  status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'resolved', 'dismissed')),
+  resolved_by TEXT,
+  resolved_at TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_report_status ON report(status);
+CREATE INDEX IF NOT EXISTS idx_report_subject_uri ON report(subject_uri);
+CREATE INDEX IF NOT EXISTS idx_report_reporter_did ON report(reporter_did);
+CREATE INDEX IF NOT EXISTS idx_report_created_at ON report(created_at DESC);
+
+-- migrate:down
+
+DROP TABLE IF EXISTS report;
+DROP TABLE IF EXISTS label;
+DROP TABLE IF EXISTS label_definition;
+```
+
+**Step 2: Verify migration file exists**
+
+Run: `ls -la server/db/migrations/20251229000001_add_labels_and_reports.sql`
+Expected: File exists with correct permissions
+
+**Step 3: Commit**
+
+```bash
+git add server/db/migrations/20251229000001_add_labels_and_reports.sql
+git commit -m "feat(db): add labels and reports tables migration"
+```
+
+---
+
+## Task 2: Label Definition Repository
+
+**Files:**
+- Create: `server/src/database/repositories/label_definitions.gleam`
+
+**Step 1: Write the repository module**
+
+```gleam
+/// Repository for label definitions
+import database/executor.{type DbError, type Executor, Text}
+import gleam/dynamic/decode
+import gleam/option.{type Option, None, Some}
+import gleam/result
+
+/// Label definition domain type
+pub type LabelDefinition {
+  LabelDefinition(
+    val: String,
+    description: String,
+    severity: String,
+    created_at: String,
+  )
+}
+
+/// Get all label definitions
+pub fn get_all(exec: Executor) -> Result(List(LabelDefinition), DbError) {
+  let sql = "SELECT val, description, severity, created_at FROM label_definition ORDER BY val"
+  executor.query(exec, sql, [], label_definition_decoder())
+}
+
+/// Get a label definition by value
+pub fn get(exec: Executor, val: String) -> Result(Option(LabelDefinition), DbError) {
+  let sql = "SELECT val, description, severity, created_at FROM label_definition WHERE val = " <> executor.placeholder(exec, 1)
+  case executor.query(exec, sql, [Text(val)], label_definition_decoder()) {
+    Ok([def]) -> Ok(Some(def))
+    Ok(_) -> Ok(None)
+    Error(e) -> Error(e)
+  }
+}
+
+/// Insert a new label definition
+pub fn insert(
+  exec: Executor,
+  val: String,
+  description: String,
+  severity: String,
+) -> Result(Nil, DbError) {
+  let p1 = executor.placeholder(exec, 1)
+  let p2 = executor.placeholder(exec, 2)
+  let p3 = executor.placeholder(exec, 3)
+  let sql = "INSERT INTO label_definition (val, description, severity) VALUES (" <> p1 <> ", " <> p2 <> ", " <> p3 <> ")"
+  executor.exec(exec, sql, [Text(val), Text(description), Text(severity)])
+}
+
+/// Check if a label value exists
+pub fn exists(exec: Executor, val: String) -> Result(Bool, DbError) {
+  case get(exec, val) {
+    Ok(Some(_)) -> Ok(True)
+    Ok(None) -> Ok(False)
+    Error(e) -> Error(e)
+  }
+}
+
+/// Decoder for LabelDefinition
+fn label_definition_decoder() -> decode.Decoder(LabelDefinition) {
+  use val <- decode.field(0, decode.string)
+  use description <- decode.field(1, decode.string)
+  use severity <- decode.field(2, decode.string)
+  use created_at <- decode.field(3, decode.string)
+  decode.success(LabelDefinition(val:, description:, severity:, created_at:))
+}
+```
+
+**Step 2: Verify module compiles**
+
+Run: `cd /Users/chadmiller/code/quickslice/server && gleam build`
+Expected: Build succeeds
+
+**Step 3: Commit**
+
+```bash
+git add server/src/database/repositories/label_definitions.gleam
+git commit -m "feat(repo): add label_definitions repository"
+```
+
+---
+
+## Task 3: Label Repository
+
+**Files:**
+- Create: `server/src/database/repositories/labels.gleam`
+
+**Step 1: Write the repository module**
+
+```gleam
+/// Repository for labels
+import database/executor.{type DbError, type Executor, type Value, Int, Text}
+import gleam/dynamic/decode
+import gleam/int
+import gleam/list
+import gleam/option.{type Option, None, Some}
+import gleam/result
+import gleam/string
+
+/// Label domain type
+pub type Label {
+  Label(
+    id: Int,
+    src: String,
+    uri: String,
+    cid: Option(String),
+    val: String,
+    neg: Bool,
+    cts: String,
+    exp: Option(String),
+  )
+}
+
+/// Insert a new label
+pub fn insert(
+  exec: Executor,
+  src: String,
+  uri: String,
+  cid: Option(String),
+  val: String,
+  exp: Option(String),
+) -> Result(Label, DbError) {
+  let p1 = executor.placeholder(exec, 1)
+  let p2 = executor.placeholder(exec, 2)
+  let p3 = executor.placeholder(exec, 3)
+  let p4 = executor.placeholder(exec, 4)
+  let p5 = executor.placeholder(exec, 5)
+
+  let cid_value = case cid {
+    Some(c) -> Text(c)
+    None -> executor.null_value()
+  }
+  let exp_value = case exp {
+    Some(e) -> Text(e)
+    None -> executor.null_value()
+  }
+
+  let sql = "INSERT INTO label (src, uri, cid, val, exp) VALUES (" <> p1 <> ", " <> p2 <> ", " <> p3 <> ", " <> p4 <> ", " <> p5 <> ") RETURNING id, src, uri, cid, val, neg, cts, exp"
+
+  case executor.query(exec, sql, [Text(src), Text(uri), cid_value, Text(val), exp_value], label_decoder()) {
+    Ok([label]) -> Ok(label)
+    Ok(_) -> Error(executor.QueryError("Insert did not return label"))
+    Error(e) -> Error(e)
+  }
+}
+
+/// Insert a negation label (retraction)
+pub fn insert_negation(
+  exec: Executor,
+  src: String,
+  uri: String,
+  val: String,
+) -> Result(Label, DbError) {
+  let p1 = executor.placeholder(exec, 1)
+  let p2 = executor.placeholder(exec, 2)
+  let p3 = executor.placeholder(exec, 3)
+
+  let sql = "INSERT INTO label (src, uri, val, neg) VALUES (" <> p1 <> ", " <> p2 <> ", " <> p3 <> ", 1) RETURNING id, src, uri, cid, val, neg, cts, exp"
+
+  case executor.query(exec, sql, [Text(src), Text(uri), Text(val)], label_decoder()) {
+    Ok([label]) -> Ok(label)
+    Ok(_) -> Error(executor.QueryError("Insert did not return label"))
+    Error(e) -> Error(e)
+  }
+}
+
+/// Get labels for a list of URIs (batch fetch for GraphQL)
+/// Returns only active labels (non-negated, non-expired)
+pub fn get_by_uris(exec: Executor, uris: List(String)) -> Result(List(Label), DbError) {
+  case uris {
+    [] -> Ok([])
+    _ -> {
+      let placeholders = executor.placeholders(exec, list.length(uris), 1)
+      let exp_check = case executor.dialect(exec) {
+        executor.SQLite -> "(exp IS NULL OR exp > datetime('now'))"
+        executor.PostgreSQL -> "(exp IS NULL OR exp::timestamp > NOW())"
+      }
+      let sql = "SELECT id, src, uri, cid, val, neg, cts, exp FROM label WHERE uri IN (" <> placeholders <> ") AND neg = 0 AND " <> exp_check <> " ORDER BY cts DESC"
+      executor.query(exec, sql, list.map(uris, Text), label_decoder())
+    }
+  }
+}
+
+/// Get all labels (admin query with optional filters)
+pub fn get_all(
+  exec: Executor,
+  uri_filter: Option(String),
+  val_filter: Option(String),
+  limit: Int,
+  cursor: Option(Int),
+) -> Result(List(Label), DbError) {
+  let mut_where_parts: List(String) = []
+  let mut_params: List(Value) = []
+  let mut_param_count = 0
+
+  // Add URI filter if provided
+  let #(where_parts, params, param_count) = case uri_filter {
+    Some(uri) -> {
+      let p = executor.placeholder(exec, mut_param_count + 1)
+      #([p <> " = uri", ..mut_where_parts], [Text(uri), ..mut_params], mut_param_count + 1)
+    }
+    None -> #(mut_where_parts, mut_params, mut_param_count)
+  }
+
+  // Add val filter if provided
+  let #(where_parts2, params2, param_count2) = case val_filter {
+    Some(v) -> {
+      let p = executor.placeholder(exec, param_count + 1)
+      #(["val = " <> p, ..where_parts], [Text(v), ..params], param_count + 1)
+    }
+    None -> #(where_parts, params, param_count)
+  }
+
+  // Add cursor filter if provided
+  let #(where_parts3, params3, param_count3) = case cursor {
+    Some(c) -> {
+      let p = executor.placeholder(exec, param_count2 + 1)
+      #(["id < " <> p, ..where_parts2], [Int(c), ..params2], param_count2 + 1)
+    }
+    None -> #(where_parts2, params2, param_count2)
+  }
+
+  let where_clause = case where_parts3 {
+    [] -> ""
+    parts -> " WHERE " <> string.join(list.reverse(parts), " AND ")
+  }
+
+  let limit_p = executor.placeholder(exec, param_count3 + 1)
+  let sql = "SELECT id, src, uri, cid, val, neg, cts, exp FROM label" <> where_clause <> " ORDER BY id DESC LIMIT " <> limit_p
+
+  executor.query(exec, sql, list.append(list.reverse(params3), [Int(limit)]), label_decoder())
+}
+
+/// Check if a URI has an active takedown label
+pub fn has_takedown(exec: Executor, uri: String) -> Result(Bool, DbError) {
+  let exp_check = case executor.dialect(exec) {
+    executor.SQLite -> "(exp IS NULL OR exp > datetime('now'))"
+    executor.PostgreSQL -> "(exp IS NULL OR exp::timestamp > NOW())"
+  }
+  let p1 = executor.placeholder(exec, 1)
+  let sql = "SELECT 1 FROM label WHERE uri = " <> p1 <> " AND val IN ('!takedown', '!suspend') AND neg = 0 AND " <> exp_check <> " LIMIT 1"
+
+  case executor.query(exec, sql, [Text(uri)], decode.dynamic) {
+    Ok([_]) -> Ok(True)
+    Ok([]) -> Ok(False)
+    Error(e) -> Error(e)
+  }
+}
+
+/// Batch check for takedown labels on multiple URIs
+/// Returns list of URIs that have active takedown labels
+pub fn get_takedown_uris(exec: Executor, uris: List(String)) -> Result(List(String), DbError) {
+  case uris {
+    [] -> Ok([])
+    _ -> {
+      let placeholders = executor.placeholders(exec, list.length(uris), 1)
+      let exp_check = case executor.dialect(exec) {
+        executor.SQLite -> "(exp IS NULL OR exp > datetime('now'))"
+        executor.PostgreSQL -> "(exp IS NULL OR exp::timestamp > NOW())"
+      }
+      let sql = "SELECT DISTINCT uri FROM label WHERE uri IN (" <> placeholders <> ") AND val IN ('!takedown', '!suspend') AND neg = 0 AND " <> exp_check
+
+      let uri_decoder = {
+        use uri <- decode.field(0, decode.string)
+        decode.success(uri)
+      }
+
+      executor.query(exec, sql, list.map(uris, Text), uri_decoder)
+    }
+  }
+}
+
+/// Decoder for Label
+fn label_decoder() -> decode.Decoder(Label) {
+  use id <- decode.field(0, decode.int)
+  use src <- decode.field(1, decode.string)
+  use uri <- decode.field(2, decode.string)
+  use cid <- decode.field(3, decode.optional(decode.string))
+  use val <- decode.field(4, decode.string)
+  use neg_int <- decode.field(5, decode.int)
+  use cts <- decode.field(6, decode.string)
+  use exp <- decode.field(7, decode.optional(decode.string))
+  let neg = neg_int == 1
+  decode.success(Label(id:, src:, uri:, cid:, val:, neg:, cts:, exp:))
+}
+```
+
+**Step 2: Verify module compiles**
+
+Run: `cd /Users/chadmiller/code/quickslice/server && gleam build`
+Expected: Build succeeds
+
+**Step 3: Commit**
+
+```bash
+git add server/src/database/repositories/labels.gleam
+git commit -m "feat(repo): add labels repository with takedown filtering"
+```
+
+---
+
+## Task 4: Report Repository
+
+**Files:**
+- Create: `server/src/database/repositories/reports.gleam`
+
+**Step 1: Write the repository module**
+
+```gleam
+/// Repository for moderation reports
+import database/executor.{type DbError, type Executor, type Value, Int, Text}
+import gleam/dynamic/decode
+import gleam/int
+import gleam/list
+import gleam/option.{type Option, None, Some}
+import gleam/string
+
+/// Report domain type
+pub type Report {
+  Report(
+    id: Int,
+    reporter_did: String,
+    subject_uri: String,
+    reason_type: String,
+    reason: Option(String),
+    status: String,
+    resolved_by: Option(String),
+    resolved_at: Option(String),
+    created_at: String,
+  )
+}
+
+/// Insert a new report
+pub fn insert(
+  exec: Executor,
+  reporter_did: String,
+  subject_uri: String,
+  reason_type: String,
+  reason: Option(String),
+) -> Result(Report, DbError) {
+  let p1 = executor.placeholder(exec, 1)
+  let p2 = executor.placeholder(exec, 2)
+  let p3 = executor.placeholder(exec, 3)
+  let p4 = executor.placeholder(exec, 4)
+
+  let reason_value = case reason {
+    Some(r) -> Text(r)
+    None -> executor.null_value()
+  }
+
+  let sql = "INSERT INTO report (reporter_did, subject_uri, reason_type, reason) VALUES (" <> p1 <> ", " <> p2 <> ", " <> p3 <> ", " <> p4 <> ") RETURNING id, reporter_did, subject_uri, reason_type, reason, status, resolved_by, resolved_at, created_at"
+
+  case executor.query(exec, sql, [Text(reporter_did), Text(subject_uri), Text(reason_type), reason_value], report_decoder()) {
+    Ok([report]) -> Ok(report)
+    Ok(_) -> Error(executor.QueryError("Insert did not return report"))
+    Error(e) -> Error(e)
+  }
+}
+
+/// Get a report by ID
+pub fn get(exec: Executor, id: Int) -> Result(Option(Report), DbError) {
+  let sql = "SELECT id, reporter_did, subject_uri, reason_type, reason, status, resolved_by, resolved_at, created_at FROM report WHERE id = " <> executor.placeholder(exec, 1)
+  case executor.query(exec, sql, [Int(id)], report_decoder()) {
+    Ok([report]) -> Ok(Some(report))
+    Ok(_) -> Ok(None)
+    Error(e) -> Error(e)
+  }
+}
+
+/// Get reports with optional status filter and pagination
+pub fn get_all(
+  exec: Executor,
+  status_filter: Option(String),
+  limit: Int,
+  cursor: Option(Int),
+) -> Result(List(Report), DbError) {
+  let mut_where_parts: List(String) = []
+  let mut_params: List(Value) = []
+  let mut_param_count = 0
+
+  // Add status filter if provided
+  let #(where_parts, params, param_count) = case status_filter {
+    Some(s) -> {
+      let p = executor.placeholder(exec, mut_param_count + 1)
+      #(["status = " <> p], [Text(s)], mut_param_count + 1)
+    }
+    None -> #(mut_where_parts, mut_params, mut_param_count)
+  }
+
+  // Add cursor filter if provided
+  let #(where_parts2, params2, param_count2) = case cursor {
+    Some(c) -> {
+      let p = executor.placeholder(exec, param_count + 1)
+      #(["id < " <> p, ..where_parts], [Int(c), ..params], param_count + 1)
+    }
+    None -> #(where_parts, params, param_count)
+  }
+
+  let where_clause = case where_parts2 {
+    [] -> ""
+    parts -> " WHERE " <> string.join(list.reverse(parts), " AND ")
+  }
+
+  let limit_p = executor.placeholder(exec, param_count2 + 1)
+  let sql = "SELECT id, reporter_did, subject_uri, reason_type, reason, status, resolved_by, resolved_at, created_at FROM report" <> where_clause <> " ORDER BY id DESC LIMIT " <> limit_p
+
+  executor.query(exec, sql, list.append(list.reverse(params2), [Int(limit)]), report_decoder())
+}
+
+/// Resolve a report (apply label or dismiss)
+pub fn resolve(
+  exec: Executor,
+  id: Int,
+  status: String,
+  resolved_by: String,
+) -> Result(Report, DbError) {
+  let p1 = executor.placeholder(exec, 1)
+  let p2 = executor.placeholder(exec, 2)
+  let p3 = executor.placeholder(exec, 3)
+
+  let resolved_at_expr = case executor.dialect(exec) {
+    executor.SQLite -> "datetime('now')"
+    executor.PostgreSQL -> "NOW()::text"
+  }
+
+  let sql = "UPDATE report SET status = " <> p1 <> ", resolved_by = " <> p2 <> ", resolved_at = " <> resolved_at_expr <> " WHERE id = " <> p3 <> " RETURNING id, reporter_did, subject_uri, reason_type, reason, status, resolved_by, resolved_at, created_at"
+
+  case executor.query(exec, sql, [Text(status), Text(resolved_by), Int(id)], report_decoder()) {
+    Ok([report]) -> Ok(report)
+    Ok(_) -> Error(executor.QueryError("Update did not return report"))
+    Error(e) -> Error(e)
+  }
+}
+
+/// Decoder for Report
+fn report_decoder() -> decode.Decoder(Report) {
+  use id <- decode.field(0, decode.int)
+  use reporter_did <- decode.field(1, decode.string)
+  use subject_uri <- decode.field(2, decode.string)
+  use reason_type <- decode.field(3, decode.string)
+  use reason <- decode.field(4, decode.optional(decode.string))
+  use status <- decode.field(5, decode.string)
+  use resolved_by <- decode.field(6, decode.optional(decode.string))
+  use resolved_at <- decode.field(7, decode.optional(decode.string))
+  use created_at <- decode.field(8, decode.string)
+  decode.success(Report(id:, reporter_did:, subject_uri:, reason_type:, reason:, status:, resolved_by:, resolved_at:, created_at:))
+}
+```
+
+**Step 2: Verify module compiles**
+
+Run: `cd /Users/chadmiller/code/quickslice/server && gleam build`
+Expected: Build succeeds
+
+**Step 3: Commit**
+
+```bash
+git add server/src/database/repositories/reports.gleam
+git commit -m "feat(repo): add reports repository"
+```
+
+---
+
+## Task 5: Admin GraphQL Types
+
+**Files:**
+- Modify: `server/src/graphql/admin/types.gleam`
+
+**Step 1: Add label and report types to types.gleam**
+
+Add these types after the existing types:
+
+```gleam
+/// LabelSeverity enum for label definitions
+pub fn label_severity_enum() -> schema.Type {
+  schema.enum_type("LabelSeverity", "Severity level of a label", [
+    schema.enum_value("INFORM", "Informational, client can show indicator"),
+    schema.enum_value("ALERT", "Client should warn/blur"),
+    schema.enum_value("TAKEDOWN", "Server filters, content not returned"),
+  ])
+}
+
+/// LabelDefinition type
+pub fn label_definition_type() -> schema.Type {
+  schema.object_type("LabelDefinition", "Label value definition", [
+    schema.field(
+      "val",
+      schema.non_null(schema.string_type()),
+      "Label value (e.g., 'porn', '!takedown')",
+      fn(ctx) { Ok(get_field(ctx, "val")) },
+    ),
+    schema.field(
+      "description",
+      schema.non_null(schema.string_type()),
+      "Human-readable description",
+      fn(ctx) { Ok(get_field(ctx, "description")) },
+    ),
+    schema.field(
+      "severity",
+      schema.non_null(label_severity_enum()),
+      "Severity level",
+      fn(ctx) { Ok(get_field(ctx, "severity")) },
+    ),
+    schema.field(
+      "createdAt",
+      schema.non_null(schema.string_type()),
+      "Creation timestamp",
+      fn(ctx) { Ok(get_field(ctx, "createdAt")) },
+    ),
+  ])
+}
+
+/// Label type
+pub fn label_type() -> schema.Type {
+  schema.object_type("Label", "Applied label on a record or account", [
+    schema.field(
+      "id",
+      schema.non_null(schema.int_type()),
+      "Label ID",
+      fn(ctx) { Ok(get_field(ctx, "id")) },
+    ),
+    schema.field(
+      "src",
+      schema.non_null(schema.string_type()),
+      "DID of admin who applied the label",
+      fn(ctx) { Ok(get_field(ctx, "src")) },
+    ),
+    schema.field(
+      "uri",
+      schema.non_null(schema.string_type()),
+      "Subject URI (at:// or did:)",
+      fn(ctx) { Ok(get_field(ctx, "uri")) },
+    ),
+    schema.field(
+      "cid",
+      schema.string_type(),
+      "Optional CID for version-specific label",
+      fn(ctx) { Ok(get_field(ctx, "cid")) },
+    ),
+    schema.field(
+      "val",
+      schema.non_null(schema.string_type()),
+      "Label value",
+      fn(ctx) { Ok(get_field(ctx, "val")) },
+    ),
+    schema.field(
+      "neg",
+      schema.non_null(schema.boolean_type()),
+      "True if this is a negation (retraction)",
+      fn(ctx) { Ok(get_field(ctx, "neg")) },
+    ),
+    schema.field(
+      "cts",
+      schema.non_null(schema.string_type()),
+      "Creation timestamp",
+      fn(ctx) { Ok(get_field(ctx, "cts")) },
+    ),
+    schema.field(
+      "exp",
+      schema.string_type(),
+      "Optional expiration timestamp",
+      fn(ctx) { Ok(get_field(ctx, "exp")) },
+    ),
+  ])
+}
+
+/// ReportReasonType enum
+pub fn report_reason_type_enum() -> schema.Type {
+  schema.enum_type("ReportReasonType", "Reason for submitting a report", [
+    schema.enum_value("SPAM", "Spam or unwanted content"),
+    schema.enum_value("VIOLATION", "Violates terms of service"),
+    schema.enum_value("MISLEADING", "Misleading or false information"),
+    schema.enum_value("SEXUAL", "Inappropriate sexual content"),
+    schema.enum_value("RUDE", "Rude or abusive behavior"),
+    schema.enum_value("OTHER", "Other reason"),
+  ])
+}
+
+/// ReportStatus enum
+pub fn report_status_enum() -> schema.Type {
+  schema.enum_type("ReportStatus", "Status of a moderation report", [
+    schema.enum_value("PENDING", "Awaiting review"),
+    schema.enum_value("RESOLVED", "Resolved with action"),
+    schema.enum_value("DISMISSED", "Dismissed without action"),
+  ])
+}
+
+/// ReportAction enum for resolving reports
+pub fn report_action_enum() -> schema.Type {
+  schema.enum_type("ReportAction", "Action to take when resolving a report", [
+    schema.enum_value("APPLY_LABEL", "Apply a label to the subject"),
+    schema.enum_value("DISMISS", "Dismiss the report without action"),
+  ])
+}
+
+/// Report type
+pub fn report_type() -> schema.Type {
+  schema.object_type("Report", "User-submitted moderation report", [
+    schema.field(
+      "id",
+      schema.non_null(schema.int_type()),
+      "Report ID",
+      fn(ctx) { Ok(get_field(ctx, "id")) },
+    ),
+    schema.field(
+      "reporterDid",
+      schema.non_null(schema.string_type()),
+      "DID of reporter",
+      fn(ctx) { Ok(get_field(ctx, "reporterDid")) },
+    ),
+    schema.field(
+      "subjectUri",
+      schema.non_null(schema.string_type()),
+      "Subject URI (at:// or did:)",
+      fn(ctx) { Ok(get_field(ctx, "subjectUri")) },
+    ),
+    schema.field(
+      "reasonType",
+      schema.non_null(report_reason_type_enum()),
+      "Reason type",
+      fn(ctx) { Ok(get_field(ctx, "reasonType")) },
+    ),
+    schema.field(
+      "reason",
+      schema.string_type(),
+      "Optional free-text explanation",
+      fn(ctx) { Ok(get_field(ctx, "reason")) },
+    ),
+    schema.field(
+      "status",
+      schema.non_null(report_status_enum()),
+      "Report status",
+      fn(ctx) { Ok(get_field(ctx, "status")) },
+    ),
+    schema.field(
+      "resolvedBy",
+      schema.string_type(),
+      "DID of admin who resolved",
+      fn(ctx) { Ok(get_field(ctx, "resolvedBy")) },
+    ),
+    schema.field(
+      "resolvedAt",
+      schema.string_type(),
+      "Resolution timestamp",
+      fn(ctx) { Ok(get_field(ctx, "resolvedAt")) },
+    ),
+    schema.field(
+      "createdAt",
+      schema.non_null(schema.string_type()),
+      "Creation timestamp",
+      fn(ctx) { Ok(get_field(ctx, "createdAt")) },
+    ),
+  ])
+}
+```
+
+**Step 2: Verify module compiles**
+
+Run: `cd /Users/chadmiller/code/quickslice/server && gleam build`
+Expected: Build succeeds
+
+**Step 3: Commit**
+
+```bash
+git add server/src/graphql/admin/types.gleam
+git commit -m "feat(graphql): add label and report types to admin API"
+```
+
+---
+
+## Task 6: Admin GraphQL Converters
+
+**Files:**
+- Modify: `server/src/graphql/admin/converters.gleam`
+
+**Step 1: Add converters for label and report types**
+
+Add these functions to converters.gleam:
+
+```gleam
+import database/repositories/label_definitions
+import database/repositories/labels
+import database/repositories/reports
+
+/// Convert LabelDefinition to GraphQL value
+pub fn label_definition_to_value(def: label_definitions.LabelDefinition) -> value.Value {
+  value.Object([
+    #("val", value.String(def.val)),
+    #("description", value.String(def.description)),
+    #("severity", value.Enum(string.uppercase(def.severity))),
+    #("createdAt", value.String(def.created_at)),
+  ])
+}
+
+/// Convert Label to GraphQL value
+pub fn label_to_value(label: labels.Label) -> value.Value {
+  let cid_value = case label.cid {
+    Some(c) -> value.String(c)
+    None -> value.Null
+  }
+  let exp_value = case label.exp {
+    Some(e) -> value.String(e)
+    None -> value.Null
+  }
+  value.Object([
+    #("id", value.Int(label.id)),
+    #("src", value.String(label.src)),
+    #("uri", value.String(label.uri)),
+    #("cid", cid_value),
+    #("val", value.String(label.val)),
+    #("neg", value.Boolean(label.neg)),
+    #("cts", value.String(label.cts)),
+    #("exp", exp_value),
+  ])
+}
+
+/// Convert Report to GraphQL value
+pub fn report_to_value(report: reports.Report) -> value.Value {
+  let reason_value = case report.reason {
+    Some(r) -> value.String(r)
+    None -> value.Null
+  }
+  let resolved_by_value = case report.resolved_by {
+    Some(r) -> value.String(r)
+    None -> value.Null
+  }
+  let resolved_at_value = case report.resolved_at {
+    Some(r) -> value.String(r)
+    None -> value.Null
+  }
+  value.Object([
+    #("id", value.Int(report.id)),
+    #("reporterDid", value.String(report.reporter_did)),
+    #("subjectUri", value.String(report.subject_uri)),
+    #("reasonType", value.Enum(string.uppercase(report.reason_type))),
+    #("reason", reason_value),
+    #("status", value.Enum(string.uppercase(report.status))),
+    #("resolvedBy", resolved_by_value),
+    #("resolvedAt", resolved_at_value),
+    #("createdAt", value.String(report.created_at)),
+  ])
+}
+```
+
+**Step 2: Add necessary imports at the top**
+
+```gleam
+import gleam/string
+```
+
+**Step 3: Verify module compiles**
+
+Run: `cd /Users/chadmiller/code/quickslice/server && gleam build`
+Expected: Build succeeds
+
+**Step 4: Commit**
+
+```bash
+git add server/src/graphql/admin/converters.gleam
+git commit -m "feat(graphql): add label and report converters"
+```
+
+---
+
+## Task 7: Admin GraphQL Queries
+
+**Files:**
+- Modify: `server/src/graphql/admin/queries.gleam`
+
+**Step 1: Add imports for new repositories**
+
+Add to imports:
+
+```gleam
+import database/repositories/label_definitions
+import database/repositories/labels
+import database/repositories/reports
+```
+
+**Step 2: Add label and report queries to query_type function**
+
+Add these fields to the query_type object_type list:
+
+```gleam
+    // labelDefinitions query
+    schema.field(
+      "labelDefinitions",
+      schema.non_null(
+        schema.list_type(schema.non_null(admin_types.label_definition_type())),
+      ),
+      "Get all label definitions",
+      fn(_ctx) {
+        case label_definitions.get_all(conn) {
+          Ok(defs) ->
+            Ok(value.List(list.map(defs, converters.label_definition_to_value)))
+          Error(_) -> Error("Failed to fetch label definitions")
+        }
+      },
+    ),
+    // labels query (admin only)
+    schema.field_with_args(
+      "labels",
+      schema.non_null(
+        schema.list_type(schema.non_null(admin_types.label_type())),
+      ),
+      "Get labels with optional filters (admin only)",
+      [
+        schema.argument("uri", schema.string_type(), "Filter by subject URI", None),
+        schema.argument("val", schema.string_type(), "Filter by label value", None),
+        schema.argument("limit", schema.int_type(), "Max results (default 50)", None),
+        schema.argument("cursor", schema.int_type(), "Cursor for pagination (label ID)", None),
+      ],
+      fn(ctx) {
+        case session.get_current_session(req, conn, did_cache) {
+          Ok(sess) -> {
+            case config_repo.is_admin(conn, sess.did) {
+              True -> {
+                let uri_filter = case schema.get_argument(ctx, "uri") {
+                  Some(value.String(u)) -> Some(u)
+                  _ -> None
+                }
+                let val_filter = case schema.get_argument(ctx, "val") {
+                  Some(value.String(v)) -> Some(v)
+                  _ -> None
+                }
+                let limit = case schema.get_argument(ctx, "limit") {
+                  Some(value.Int(l)) -> l
+                  _ -> 50
+                }
+                let cursor = case schema.get_argument(ctx, "cursor") {
+                  Some(value.Int(c)) -> Some(c)
+                  _ -> None
+                }
+                case labels.get_all(conn, uri_filter, val_filter, limit, cursor) {
+                  Ok(label_list) ->
+                    Ok(value.List(list.map(label_list, converters.label_to_value)))
+                  Error(_) -> Error("Failed to fetch labels")
+                }
+              }
+              False -> Error("Admin privileges required")
+            }
+          }
+          Error(_) -> Error("Authentication required")
+        }
+      },
+    ),
+    // reports query (admin only)
+    schema.field_with_args(
+      "reports",
+      schema.non_null(
+        schema.list_type(schema.non_null(admin_types.report_type())),
+      ),
+      "Get moderation reports with optional status filter (admin only)",
+      [
+        schema.argument("status", admin_types.report_status_enum(), "Filter by status", None),
+        schema.argument("limit", schema.int_type(), "Max results (default 50)", None),
+        schema.argument("cursor", schema.int_type(), "Cursor for pagination (report ID)", None),
+      ],
+      fn(ctx) {
+        case session.get_current_session(req, conn, did_cache) {
+          Ok(sess) -> {
+            case config_repo.is_admin(conn, sess.did) {
+              True -> {
+                let status_filter = case schema.get_argument(ctx, "status") {
+                  Some(value.Enum(s)) -> Some(string.lowercase(s))
+                  _ -> None
+                }
+                let limit = case schema.get_argument(ctx, "limit") {
+                  Some(value.Int(l)) -> l
+                  _ -> 50
+                }
+                let cursor = case schema.get_argument(ctx, "cursor") {
+                  Some(value.Int(c)) -> Some(c)
+                  _ -> None
+                }
+                case reports.get_all(conn, status_filter, limit, cursor) {
+                  Ok(report_list) ->
+                    Ok(value.List(list.map(report_list, converters.report_to_value)))
+                  Error(_) -> Error("Failed to fetch reports")
+                }
+              }
+              False -> Error("Admin privileges required")
+            }
+          }
+          Error(_) -> Error("Authentication required")
+        }
+      },
+    ),
+```
+
+**Step 3: Add string import if not present**
+
+```gleam
+import gleam/string
+```
+
+**Step 4: Verify module compiles**
+
+Run: `cd /Users/chadmiller/code/quickslice/server && gleam build`
+Expected: Build succeeds
+
+**Step 5: Commit**
+
+```bash
+git add server/src/graphql/admin/queries.gleam
+git commit -m "feat(graphql): add label and report queries to admin API"
+```
+
+---
+
+## Task 8: Admin GraphQL Mutations
+
+**Files:**
+- Modify: `server/src/graphql/admin/mutations.gleam`
+
+**Step 1: Add imports for new repositories**
+
+Add to imports:
+
+```gleam
+import database/repositories/label_definitions
+import database/repositories/labels
+import database/repositories/reports
+```
+
+**Step 2: Add label and report mutations to mutation_type function**
+
+Add these fields to the mutation_type object_type list:
+
+```gleam
+    // createLabel mutation (admin only)
+    schema.field_with_args(
+      "createLabel",
+      schema.non_null(admin_types.label_type()),
+      "Create a label on a record or account (admin only)",
+      [
+        schema.argument("uri", schema.non_null(schema.string_type()), "Subject URI (at:// or did:)", None),
+        schema.argument("val", schema.non_null(schema.string_type()), "Label value", None),
+        schema.argument("cid", schema.string_type(), "Optional CID for version-specific label", None),
+        schema.argument("exp", schema.string_type(), "Optional expiration datetime", None),
+      ],
+      fn(ctx) {
+        case session.get_current_session(req, conn, did_cache) {
+          Ok(sess) -> {
+            case config_repo.is_admin(conn, sess.did) {
+              True -> {
+                case schema.get_argument(ctx, "uri"), schema.get_argument(ctx, "val") {
+                  Some(value.String(uri)), Some(value.String(val)) -> {
+                    // Validate label value exists
+                    case label_definitions.exists(conn, val) {
+                      Ok(True) -> {
+                        let cid = case schema.get_argument(ctx, "cid") {
+                          Some(value.String(c)) -> Some(c)
+                          _ -> None
+                        }
+                        let exp = case schema.get_argument(ctx, "exp") {
+                          Some(value.String(e)) -> Some(e)
+                          _ -> None
+                        }
+                        case labels.insert(conn, sess.did, uri, cid, val, exp) {
+                          Ok(label) -> Ok(converters.label_to_value(label))
+                          Error(_) -> Error("Failed to create label")
+                        }
+                      }
+                      Ok(False) -> Error("Unknown label value: " <> val)
+                      Error(_) -> Error("Failed to validate label value")
+                    }
+                  }
+                  _, _ -> Error("uri and val are required")
+                }
+              }
+              False -> Error("Admin privileges required")
+            }
+          }
+          Error(_) -> Error("Authentication required")
+        }
+      },
+    ),
+    // negateLabel mutation (admin only)
+    schema.field_with_args(
+      "negateLabel",
+      schema.non_null(admin_types.label_type()),
+      "Negate (retract) a label on a record or account (admin only)",
+      [
+        schema.argument("uri", schema.non_null(schema.string_type()), "Subject URI", None),
+        schema.argument("val", schema.non_null(schema.string_type()), "Label value to negate", None),
+      ],
+      fn(ctx) {
+        case session.get_current_session(req, conn, did_cache) {
+          Ok(sess) -> {
+            case config_repo.is_admin(conn, sess.did) {
+              True -> {
+                case schema.get_argument(ctx, "uri"), schema.get_argument(ctx, "val") {
+                  Some(value.String(uri)), Some(value.String(val)) -> {
+                    case labels.insert_negation(conn, sess.did, uri, val) {
+                      Ok(label) -> Ok(converters.label_to_value(label))
+                      Error(_) -> Error("Failed to negate label")
+                    }
+                  }
+                  _, _ -> Error("uri and val are required")
+                }
+              }
+              False -> Error("Admin privileges required")
+            }
+          }
+          Error(_) -> Error("Authentication required")
+        }
+      },
+    ),
+    // createLabelDefinition mutation (admin only)
+    schema.field_with_args(
+      "createLabelDefinition",
+      schema.non_null(admin_types.label_definition_type()),
+      "Create a custom label definition (admin only)",
+      [
+        schema.argument("val", schema.non_null(schema.string_type()), "Label value", None),
+        schema.argument("description", schema.non_null(schema.string_type()), "Description", None),
+        schema.argument("severity", schema.non_null(admin_types.label_severity_enum()), "Severity level", None),
+      ],
+      fn(ctx) {
+        case session.get_current_session(req, conn, did_cache) {
+          Ok(sess) -> {
+            case config_repo.is_admin(conn, sess.did) {
+              True -> {
+                case
+                  schema.get_argument(ctx, "val"),
+                  schema.get_argument(ctx, "description"),
+                  schema.get_argument(ctx, "severity")
+                {
+                  Some(value.String(val)), Some(value.String(desc)), Some(value.Enum(sev)) -> {
+                    let severity = string.lowercase(sev)
+                    case label_definitions.insert(conn, val, desc, severity) {
+                      Ok(_) -> {
+                        case label_definitions.get(conn, val) {
+                          Ok(Some(def)) -> Ok(converters.label_definition_to_value(def))
+                          _ -> Error("Failed to fetch created definition")
+                        }
+                      }
+                      Error(_) -> Error("Failed to create label definition")
+                    }
+                  }
+                  _, _, _ -> Error("val, description, and severity are required")
+                }
+              }
+              False -> Error("Admin privileges required")
+            }
+          }
+          Error(_) -> Error("Authentication required")
+        }
+      },
+    ),
+    // resolveReport mutation (admin only)
+    schema.field_with_args(
+      "resolveReport",
+      schema.non_null(admin_types.report_type()),
+      "Resolve a moderation report (admin only)",
+      [
+        schema.argument("id", schema.non_null(schema.int_type()), "Report ID", None),
+        schema.argument("action", schema.non_null(admin_types.report_action_enum()), "Action to take", None),
+        schema.argument("labelVal", schema.string_type(), "Label value to apply (required if action is APPLY_LABEL)", None),
+      ],
+      fn(ctx) {
+        case session.get_current_session(req, conn, did_cache) {
+          Ok(sess) -> {
+            case config_repo.is_admin(conn, sess.did) {
+              True -> {
+                case schema.get_argument(ctx, "id"), schema.get_argument(ctx, "action") {
+                  Some(value.Int(id)), Some(value.Enum(action)) -> {
+                    // Get the report first
+                    case reports.get(conn, id) {
+                      Ok(Some(report)) -> {
+                        case action {
+                          "APPLY_LABEL" -> {
+                            case schema.get_argument(ctx, "labelVal") {
+                              Some(value.String(label_val)) -> {
+                                // Create the label
+                                case labels.insert(conn, sess.did, report.subject_uri, None, label_val, None) {
+                                  Ok(_) -> {
+                                    // Mark report as resolved
+                                    case reports.resolve(conn, id, "resolved", sess.did) {
+                                      Ok(resolved) -> Ok(converters.report_to_value(resolved))
+                                      Error(_) -> Error("Failed to resolve report")
+                                    }
+                                  }
+                                  Error(_) -> Error("Failed to apply label")
+                                }
+                              }
+                              _ -> Error("labelVal is required when action is APPLY_LABEL")
+                            }
+                          }
+                          "DISMISS" -> {
+                            case reports.resolve(conn, id, "dismissed", sess.did) {
+                              Ok(resolved) -> Ok(converters.report_to_value(resolved))
+                              Error(_) -> Error("Failed to dismiss report")
+                            }
+                          }
+                          _ -> Error("Invalid action")
+                        }
+                      }
+                      Ok(None) -> Error("Report not found")
+                      Error(_) -> Error("Failed to fetch report")
+                    }
+                  }
+                  _, _ -> Error("id and action are required")
+                }
+              }
+              False -> Error("Admin privileges required")
+            }
+          }
+          Error(_) -> Error("Authentication required")
+        }
+      },
+    ),
+```
+
+**Step 3: Verify module compiles**
+
+Run: `cd /Users/chadmiller/code/quickslice/server && gleam build`
+Expected: Build succeeds
+
+**Step 4: Commit**
+
+```bash
+git add server/src/graphql/admin/mutations.gleam
+git commit -m "feat(graphql): add label and report mutations to admin API"
+```
+
+---
+
+## Task 9: Lexicon API - createReport Mutation
+
+**Files:**
+- Modify: `server/src/graphql/lexicon/mutations.gleam`
+
+**Step 1: Add report repository import**
+
+```gleam
+import database/repositories/reports
+```
+
+**Step 2: Add createReport mutation**
+
+This needs to be added to the lexicon schema. Look at how mutations are structured in `mutations.gleam` and add a public function that can be called from the schema builder to add the createReport mutation.
+
+The mutation should:
+- Require authentication (get user DID from auth token)
+- Accept subjectUri, reasonType, and optional reason
+- Insert into reports table
+- Return the created report
+
+**Step 3: Verify module compiles**
+
+Run: `cd /Users/chadmiller/code/quickslice/server && gleam build`
+Expected: Build succeeds
+
+**Step 4: Commit**
+
+```bash
+git add server/src/graphql/lexicon/mutations.gleam
+git commit -m "feat(graphql): add createReport mutation to lexicon API"
+```
+
+---
+
+## Task 10: Labels Field on Record Types
+
+**Files:**
+- Modify: `server/src/graphql/lexicon/fetchers.gleam`
+- Modify: `lexicon_graphql/src/lexicon_graphql/schema/database.gleam`
+
+**Step 1: Create label fetcher in fetchers.gleam**
+
+Add a function to create a labels batch fetcher:
+
+```gleam
+import database/repositories/labels
+
+/// Create a labels fetcher for batch loading labels by URI
+pub fn labels_fetcher(db: Executor) {
+  fn(uris: List(String)) -> Result(dict.Dict(String, List(value.Value)), String) {
+    case labels.get_by_uris(db, uris) {
+      Ok(label_list) -> {
+        // Group labels by URI
+        let grouped = list.fold(label_list, dict.new(), fn(acc, label) {
+          let label_value = value.Object([
+            #("id", value.Int(label.id)),
+            #("src", value.String(label.src)),
+            #("uri", value.String(label.uri)),
+            #("cid", case label.cid {
+              Some(c) -> value.String(c)
+              None -> value.Null
+            }),
+            #("val", value.String(label.val)),
+            #("neg", value.Boolean(label.neg)),
+            #("cts", value.String(label.cts)),
+            #("exp", case label.exp {
+              Some(e) -> value.String(e)
+              None -> value.Null
+            }),
+          ])
+          let existing = dict.get(acc, label.uri) |> result.unwrap([])
+          dict.insert(acc, label.uri, [label_value, ..existing])
+        })
+        Ok(grouped)
+      }
+      Error(_) -> Error("Failed to fetch labels")
+    }
+  }
+}
+```
+
+**Step 2: Add labels field to record types in database.gleam**
+
+This requires modifying the schema builder to add a `labels` field to each record type. The field should:
+- Return `[Label!]!` (non-null list of non-null labels)
+- Use the labels fetcher to batch load labels for the record's URI
+- Be added to every record object type
+
+**Step 3: Verify module compiles**
+
+Run: `cd /Users/chadmiller/code/quickslice && gleam build`
+Expected: Build succeeds
+
+**Step 4: Commit**
+
+```bash
+git add server/src/graphql/lexicon/fetchers.gleam lexicon_graphql/src/lexicon_graphql/schema/database.gleam
+git commit -m "feat(graphql): add labels field to all record types"
+```
+
+---
+
+## Task 11: Takedown Filtering in Record Fetchers
+
+**Files:**
+- Modify: `server/src/graphql/lexicon/fetchers.gleam`
+
+**Step 1: Add takedown filtering to record_fetcher**
+
+Modify the record_fetcher to:
+1. After fetching records, get the list of URIs
+2. Call `labels.get_takedown_uris(db, uris)` to find which have takedown labels
+3. Filter out records with takedown URIs from the result
+
+**Step 2: Add takedown filtering to batch_fetcher**
+
+Similar modification for batch fetches.
+
+**Step 3: Verify module compiles**
+
+Run: `cd /Users/chadmiller/code/quickslice/server && gleam build`
+Expected: Build succeeds
+
+**Step 4: Commit**
+
+```bash
+git add server/src/graphql/lexicon/fetchers.gleam
+git commit -m "feat(moderation): filter takedown-labeled records from queries"
+```
+
+---
+
+## Task 12: Integration Testing
+
+**Files:**
+- Create: `server/test/labels_test.gleam` (if test framework exists)
+
+**Step 1: Test label creation**
+
+Test that:
+- Admin can create a label
+- Non-admin cannot create a label
+- Label appears on record query
+
+**Step 2: Test report workflow**
+
+Test that:
+- Authenticated user can create a report
+- Admin can view reports
+- Admin can resolve report with label
+- Admin can dismiss report
+
+**Step 3: Test takedown filtering**
+
+Test that:
+- Record with !takedown label is not returned in queries
+- Record is still accessible with admin includeRemoved flag (if implemented)
+
+**Step 4: Run full test suite**
+
+Run: `cd /Users/chadmiller/code/quickslice/server && gleam test`
+Expected: All tests pass
+
+**Step 5: Commit**
+
+```bash
+git add server/test/
+git commit -m "test: add labels and reports integration tests"
+```
+
+---
+
+## Summary
+
+This plan implements:
+
+1. **Database Layer** (Tasks 1-4): Migration and repositories for label_definition, label, and report tables
+2. **Admin API** (Tasks 5-8): GraphQL types, queries, and mutations for admin management
+3. **Lexicon API** (Task 9): createReport mutation for user submissions
+4. **Labels Field** (Task 10): Add labels to all record types for client display
+5. **Takedown Filtering** (Task 11): Server-side filtering of !takedown/!suspend content
+6. **Testing** (Task 12): Integration tests for the full workflow
+
+Total: 12 tasks with ~40 individual steps.

dev-docs/plans/2025-12-29-self-labels-support.md

···
+# Self-Labels Support Implementation Plan
+
+> **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.
+
+**Goal:** Merge self-labels from record JSON with moderator labels, avoiding field name collisions.
+
+**Architecture:** The `labels` field resolver checks if the record's JSON contains self-labels (`com.atproto.label.defs#selfLabels`), parses them, fetches moderator labels from the database, and returns the merged list. If a lexicon defines a `labels` property, we replace its resolver with our enhanced version instead of adding a duplicate field.
+
+**Tech Stack:** Gleam, lexicon_graphql library, GraphQL schema builder
+
+---
+
+## Background
+
+AT Protocol supports two label sources:
+1. **Self-labels** - embedded in record JSON by the author (e.g., marking own post as adult content)
+2. **Moderator labels** - applied externally by labelers, stored in our `label` table
+
+Currently, our `labels` field only returns moderator labels. If a lexicon defines `labels` with type `com.atproto.label.defs#selfLabels`, we'd have a field collision.
+
+## Tasks
+
+### Task 1: Add Helper to Check for Self-Labels Property
+
+**Files:**
+- Modify: `lexicon_graphql/src/lexicon_graphql/schema/database.gleam`
+
+**Step 1: Write the helper function**
+
+Add after line 3436 (after `build_labels_field`):
+
+```gleam
+/// Check if a record type has a labels property with selfLabels ref
+fn has_self_labels_property(properties: List(#(String, types.Property))) -> Bool {
+  list.any(properties, fn(prop) {
+    let #(name, types.Property(_, _, _, ref, _, _)) = prop
+    name == "labels" && ref == option.Some("com.atproto.label.defs#selfLabels")
+  })
+}
+```
+
+**Step 2: Verify it compiles**
+
+Run: `cd /Users/chadmiller/code/quickslice/lexicon_graphql && gleam build`
+Expected: Compiles without errors
+
+**Step 3: Commit**
+
+```bash
+git add lexicon_graphql/src/lexicon_graphql/schema/database.gleam
+git commit -m "feat(lexicon_graphql): add helper to detect selfLabels property"
+```
+
+---
+
+### Task 2: Modify build_labels_field to Accept Properties
+
+**Files:**
+- Modify: `lexicon_graphql/src/lexicon_graphql/schema/database.gleam`
+
+**Step 1: Update function signature**
+
+Change `build_labels_field` (around line 3402) from:
+
+```gleam
+fn build_labels_field(
+  labels_fetcher: option.Option(LabelsFetcher),
+) -> List(schema.Field) {
+```
+
+To:
+
+```gleam
+fn build_labels_field(
+  labels_fetcher: option.Option(LabelsFetcher),
+  properties: List(#(String, types.Property)),
+) -> List(schema.Field) {
+```
+
+**Step 2: Update the call site**
+
+Find where `build_labels_field` is called (around line 650) and change:
+
+```gleam
+let labels_field = build_labels_field(labels_fetcher)
+```
+
+To:
+
+```gleam
+let labels_field = build_labels_field(labels_fetcher, record_type.properties)
+```
+
+**Step 3: Verify it compiles**
+
+Run: `cd /Users/chadmiller/code/quickslice/lexicon_graphql && gleam build`
+Expected: Compiles without errors
+
+**Step 4: Commit**
+
+```bash
+git add lexicon_graphql/src/lexicon_graphql/schema/database.gleam
+git commit -m "refactor(lexicon_graphql): pass properties to build_labels_field"
+```
+
+---
+
+### Task 3: Add Self-Labels Parsing to Fetcher
+
+**Files:**
+- Modify: `server/src/graphql/lexicon/fetchers.gleam`
+
+**Step 1: Add helper to parse self-labels from JSON**
+
+Add after the `filter_takedowns` function (around line 39):
+
+```gleam
+/// Parse self-labels from a record's JSON if present
+/// Self-labels have format: {"$type": "com.atproto.label.defs#selfLabels", "values": [{"val": "..."}]}
+fn parse_self_labels_from_json(
+  json_str: String,
+  uri: String,
+) -> List(value.Value) {
+  case json.parse(json_str, dynamic.dynamic) {
+    Error(_) -> []
+    Ok(dyn) -> {
+      // Try to get labels field
+      case dynamic.field("labels", dynamic.dynamic)(dyn) {
+        Error(_) -> []
+        Ok(labels_dyn) -> {
+          // Check $type is selfLabels
+          case dynamic.field("$type", dynamic.string)(labels_dyn) {
+            Ok("com.atproto.label.defs#selfLabels") -> {
+              // Parse values array
+              case
+                dynamic.field(
+                  "values",
+                  dynamic.list(dynamic.decode1(
+                    fn(val) { val },
+                    dynamic.field("val", dynamic.string),
+                  )),
+                )(labels_dyn)
+              {
+                Ok(vals) -> {
+                  list.map(vals, fn(val) {
+                    value.Object([
+                      #("val", value.String(val)),
+                      #("src", value.String(uri |> string.split("/") |> list.first |> result.unwrap(""))),
+                      #("uri", value.String(uri)),
+                      #("neg", value.Boolean(False)),
+                      #("cts", value.Null),
+                      #("exp", value.Null),
+                      #("cid", value.Null),
+                      #("id", value.Null),
+                    ])
+                  })
+                }
+                Error(_) -> []
+              }
+            }
+            _ -> []
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+**Step 2: Add required imports**
+
+Add to imports at top of file:
+
+```gleam
+import gleam/json
+import gleam/dynamic
+```
+
+**Step 3: Verify it compiles**
+
+Run: `cd /Users/chadmiller/code/quickslice/server && gleam build`
+Expected: Compiles without errors
+
+**Step 4: Commit**
+
+```bash
+git add server/src/graphql/lexicon/fetchers.gleam
+git commit -m "feat(fetchers): add self-labels JSON parser"
+```
+
+---
+
+### Task 4: Modify Labels Fetcher to Accept Record JSON
+
+**Files:**
+- Modify: `server/src/graphql/lexicon/fetchers.gleam`
+- Modify: `lexicon_graphql/src/lexicon_graphql/schema/database.gleam`
+
+**Step 1: Change fetcher type to include record JSON**
+
+In `lexicon_graphql/src/lexicon_graphql/schema/database.gleam`, find `LabelsFetcher` type (around line 144):
+
+```gleam
+pub type LabelsFetcher =
+  fn(List(String)) -> Result(dict.Dict(String, List(value.Value)), String)
+```
+
+Change to:
+
+```gleam
+pub type LabelsFetcher =
+  fn(List(#(String, option.Option(String)))) ->
+    Result(dict.Dict(String, List(value.Value)), String)
+```
+
+The tuple is `#(uri, optional_record_json)`.
+
+**Step 2: Update fetcher in server**
+
+In `server/src/graphql/lexicon/fetchers.gleam`, change `labels_fetcher` (around line 469):
+
+```gleam
+pub fn labels_fetcher(db: Executor) {
+  fn(
+    uris_with_json: List(#(String, option.Option(String))),
+  ) -> Result(dict.Dict(String, List(value.Value)), String) {
+    let uris = list.map(uris_with_json, fn(pair) { pair.0 })
+
+    case labels.get_by_uris(db, uris) {
+      Ok(label_list) -> {
+        // Group moderator labels by URI
+        let mod_labels =
+          list.fold(label_list, dict.new(), fn(acc, label) {
+            let label_value =
+              value.Object([
+                #("id", value.Int(label.id)),
+                #("src", value.String(label.src)),
+                #("uri", value.String(label.uri)),
+                #("cid", case label.cid {
+                  option.Some(c) -> value.String(c)
+                  option.None -> value.Null
+                }),
+                #("val", value.String(label.val)),
+                #("neg", value.Boolean(label.neg)),
+                #("cts", value.String(label.cts)),
+                #("exp", case label.exp {
+                  option.Some(e) -> value.String(e)
+                  option.None -> value.Null
+                }),
+              ])
+            let existing = dict.get(acc, label.uri) |> result.unwrap([])
+            dict.insert(acc, label.uri, [label_value, ..existing])
+          })
+
+        // Merge with self-labels from record JSON
+        let merged =
+          list.fold(uris_with_json, mod_labels, fn(acc, pair) {
+            let #(uri, json_opt) = pair
+            case json_opt {
+              option.None -> acc
+              option.Some(json_str) -> {
+                let self_labels = parse_self_labels_from_json(json_str, uri)
+                case self_labels {
+                  [] -> acc
+                  _ -> {
+                    let existing = dict.get(acc, uri) |> result.unwrap([])
+                    dict.insert(acc, uri, list.append(self_labels, existing))
+                  }
+                }
+              }
+            }
+          })
+
+        Ok(merged)
+      }
+      Error(_) -> Error("Failed to fetch labels")
+    }
+  }
+}
+```
+
+**Step 3: Update call site in build_labels_field**
+
+In `lexicon_graphql/src/lexicon_graphql/schema/database.gleam`, update the resolver (around line 3414):
+
+```gleam
+fn(ctx) {
+  // Get the URI and JSON from the parent record
+  case get_field_from_context(ctx, "uri") {
+    Ok(uri_str) -> {
+      let json_opt = case get_field_from_context(ctx, "json") {
+        Ok(j) -> option.Some(j)
+        Error(_) -> option.None
+      }
+      case fetcher([#(uri_str, json_opt)]) {
+        Ok(results) -> {
+          case dict.get(results, uri_str) {
+            Ok(labels) -> Ok(value.List(labels))
+            Error(_) -> Ok(value.List([]))
+          }
+        }
+        Error(_) -> Ok(value.List([]))
+      }
+    }
+    Error(_) -> Ok(value.List([]))
+  }
+},
+```
+
+**Step 4: Verify it compiles**
+
+Run: `cd /Users/chadmiller/code/quickslice && gleam build`
+Expected: Compiles without errors
+
+**Step 5: Commit**
+
+```bash
+git add -A
+git commit -m "feat: merge self-labels from record JSON with moderator labels"
+```
+
+---
+
+### Task 5: Handle Field Collision
+
+**Files:**
+- Modify: `lexicon_graphql/src/lexicon_graphql/schema/database.gleam`
+
+**Step 1: Skip adding labels field if lexicon defines it**
+
+Update `build_labels_field` to check for collision:
+
+```gleam
+fn build_labels_field(
+  labels_fetcher: option.Option(LabelsFetcher),
+  properties: List(#(String, types.Property)),
+) -> List(schema.Field) {
+  case labels_fetcher {
+    option.None -> []
+    option.Some(fetcher) -> {
+      // Skip if lexicon already defines a labels field
+      case has_self_labels_property(properties) {
+        True -> []
+        False -> {
+          let label_type = build_label_type()
+          [
+            schema.field(
+              "labels",
+              schema.non_null(schema.list_type(schema.non_null(label_type))),
+              "Labels applied to this record",
+              fn(ctx) {
+                case get_field_from_context(ctx, "uri") {
+                  Ok(uri_str) -> {
+                    let json_opt = case get_field_from_context(ctx, "json") {
+                      Ok(j) -> option.Some(j)
+                      Error(_) -> option.None
+                    }
+                    case fetcher([#(uri_str, json_opt)]) {
+                      Ok(results) -> {
+                        case dict.get(results, uri_str) {
+                          Ok(labels) -> Ok(value.List(labels))
+                          Error(_) -> Ok(value.List([]))
+                        }
+                      }
+                      Error(_) -> Ok(value.List([]))
+                    }
+                  }
+                  Error(_) -> Ok(value.List([]))
+                }
+              },
+            ),
+          ]
+        }
+      }
+    }
+  }
+}
+```
+
+**Step 2: Verify it compiles**
+
+Run: `cd /Users/chadmiller/code/quickslice && gleam build`
+Expected: Compiles without errors
+
+**Step 3: Commit**
+
+```bash
+git add lexicon_graphql/src/lexicon_graphql/schema/database.gleam
+git commit -m "fix(lexicon_graphql): skip labels field if lexicon defines selfLabels"
+```
+
+---
+
+### Task 6: Override Lexicon's Labels Field Resolver
+
+When the lexicon defines a `labels` property, we need to replace its resolver with our enhanced version that merges self-labels with moderator labels.
+
+**Files:**
+- Modify: `lexicon_graphql/src/lexicon_graphql/schema/database.gleam`
+
+**Step 1: Add function to replace labels field resolver**
+
+Add after `has_self_labels_property`:
+
+```gleam
+/// Replace the labels field resolver with an enhanced version that merges moderator labels
+fn replace_labels_field_resolver(
+  fields: List(schema.Field),
+  labels_fetcher: option.Option(LabelsFetcher),
+) -> List(schema.Field) {
+  case labels_fetcher {
+    option.None -> fields
+    option.Some(fetcher) -> {
+      list.map(fields, fn(field) {
+        case schema.field_name(field) == "labels" {
+          False -> field
+          True -> {
+            // Replace with enhanced resolver
+            schema.field(
+              "labels",
+              schema.field_type(field),
+              schema.field_description(field),
+              fn(ctx) {
+                case get_field_from_context(ctx, "uri") {
+                  Ok(uri_str) -> {
+                    let json_opt = case get_field_from_context(ctx, "json") {
+                      Ok(j) -> option.Some(j)
+                      Error(_) -> option.None
+                    }
+                    case fetcher([#(uri_str, json_opt)]) {
+                      Ok(results) -> {
+                        case dict.get(results, uri_str) {
+                          Ok(labels) -> Ok(value.List(labels))
+                          Error(_) -> Ok(value.List([]))
+                        }
+                      }
+                      Error(_) -> Ok(value.List([]))
+                    }
+                  }
+                  Error(_) -> Ok(value.List([]))
+                }
+              },
+            )
+          }
+        }
+      })
+    }
+  }
+}
+```
+
+**Step 2: Add accessor functions to schema module if missing**
+
+Check if `schema.field_name`, `schema.field_type`, `schema.field_description` exist. If not, we may need to add them or use pattern matching on the Field type.
+
+**Step 3: Apply the replacement in field building**
+
+Update around line 652 where fields are combined:
+
+```gleam
+// Replace lexicon's labels field resolver if it exists
+let enhanced_fields = case has_self_labels_property(record_type.properties) {
+  True -> replace_labels_field_resolver(record_type.fields, labels_fetcher)
+  False -> record_type.fields
+}
+
+// Build labels field if labels_fetcher is provided
+let labels_field = build_labels_field(labels_fetcher, record_type.properties)
+
+// Combine all fields
+let all_fields =
+  list.flatten([
+    enhanced_fields,  // Use enhanced instead of record_type.fields
+    forward_join_fields,
+    reverse_join_fields,
+    did_join_fields,
+    viewer_fields,
+    did_viewer_fields,
+    labels_field,
+  ])
+```
+
+**Step 4: Verify it compiles**
+
+Run: `cd /Users/chadmiller/code/quickslice && gleam build`
+Expected: Compiles without errors
+
+**Step 5: Commit**
+
+```bash
+git add lexicon_graphql/src/lexicon_graphql/schema/database.gleam
+git commit -m "feat(lexicon_graphql): enhance lexicon labels field with moderator labels"
+```
+
+---
+
+### Task 7: Write Integration Test
+
+**Files:**
+- Modify: `server/test/labels_test.gleam`
+
+**Step 1: Add test for self-labels parsing**
+
+```gleam
+pub fn self_labels_parsing_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let uri = "at://did:plc:user1/app.bsky.feed.post/abc123"
+  let json_with_self_labels =
+    "{\"text\": \"hello\", \"labels\": {\"$type\": \"com.atproto.label.defs#selfLabels\", \"values\": [{\"val\": \"porn\"}]}}"
+
+  // Create labels fetcher
+  let fetcher = fetchers.labels_fetcher(db)
+
+  // Call fetcher with JSON
+  let assert Ok(results) = fetcher([#(uri, option.Some(json_with_self_labels))])
+
+  // Should have self-label
+  let assert Ok(labels) = dict.get(results, uri)
+  labels |> list.length() |> should.equal(1)
+}
+```
+
+**Step 2: Add test for merged labels**
+
+```gleam
+pub fn merged_labels_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let uri = "at://did:plc:user1/app.bsky.feed.post/abc123"
+  let json_with_self_labels =
+    "{\"text\": \"hello\", \"labels\": {\"$type\": \"com.atproto.label.defs#selfLabels\", \"values\": [{\"val\": \"porn\"}]}}"
+
+  // Add moderator label
+  let assert Ok(_) =
+    labels.insert(db, "did:plc:admin", uri, option.None, "spam", option.None)
+
+  // Create labels fetcher
+  let fetcher = fetchers.labels_fetcher(db)
+
+  // Call fetcher with JSON
+  let assert Ok(results) = fetcher([#(uri, option.Some(json_with_self_labels))])
+
+  // Should have both labels (1 self + 1 moderator)
+  let assert Ok(labels_list) = dict.get(results, uri)
+  labels_list |> list.length() |> should.equal(2)
+}
+```
+
+**Step 3: Run tests**
+
+Run: `cd /Users/chadmiller/code/quickslice/server && gleam test`
+Expected: All tests pass
+
+**Step 4: Commit**
+
+```bash
+git add server/test/labels_test.gleam
+git commit -m "test: add self-labels parsing and merging tests"
+```
+
+---
+
+### Task 8: Update Documentation
+
+**Files:**
+- Modify: `docs/guides/moderation.md`
+
+**Step 1: Add section about self-labels**
+
+Add after the "Querying Labels" section:
+
+```markdown
+### Self-Labels
+
+Authors can label their own content by including a `labels` field in their record with type `com.atproto.label.defs#selfLabels`. Quickslice automatically merges self-labels with moderator labels.
+
+Example record with self-labels:
+
+```json
+{
+  "text": "Adult content warning",
+  "labels": {
+    "$type": "com.atproto.label.defs#selfLabels",
+    "values": [{"val": "porn"}]
+  }
+}
+```
+
+When querying, both self-labels and moderator labels appear in the `labels` field:
+
+```graphql
+query {
+  xyzPosts(first: 10) {
+    nodes {
+      uri
+      labels {
+        val
+        src
+      }
+    }
+  }
+}
+```
+
+Self-labels have the record author as the `src`. Moderator labels have the moderator's DID.
+```
+
+**Step 2: Commit**
+
+```bash
+git add docs/guides/moderation.md
+git commit -m "docs: add self-labels documentation"
+```
+
+---
+
+### Task 9: Final Verification
+
+**Step 1: Run full test suite**
+
+Run: `cd /Users/chadmiller/code/quickslice/server && gleam test`
+Expected: All tests pass
+
+**Step 2: Run lexicon_graphql tests**
+
+Run: `cd /Users/chadmiller/code/quickslice/lexicon_graphql && gleam test`
+Expected: All tests pass
+
+**Step 3: Manual testing**
+
+1. Start the server
+2. Query a record type that has self-labels in the lexicon
+3. Verify the `labels` field returns merged labels
+
+---
+
+## Summary
+
+After completing these tasks:
+1. Self-labels from record JSON are parsed and merged with moderator labels
+2. No field collision when lexicons define their own `labels` property
+3. Users get a unified view of all labels via the `labels` field

dev-docs/plans/2025-12-30-admin-connection-pagination.md

···
+# Admin Connection Pagination Implementation Plan
+
+> **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.
+
+**Goal:** Convert `labels` and `reports` admin queries from simple lists to Relay-compliant Connection types with opaque cursors, totalCount, and proper PageInfo.
+
+**Architecture:** Add cursor encoding utilities, update repository functions to support cursor-based pagination with count queries, create Connection/Edge types using swell's helpers, and update resolvers to return connection values.
+
+**Tech Stack:** Gleam, swell/connection, base64 encoding for cursors, SQLite/Postgres repositories
+
+---
+
+### Task 1: Create Cursor Encoding Module
+
+**Files:**
+- Create: `server/src/graphql/admin/cursor.gleam`
+- Test: `server/test/graphql/admin/cursor_test.gleam`
+
+**Step 1: Write the failing test for encode**
+
+```gleam
+// server/test/graphql/admin/cursor_test.gleam
+import gleeunit/should
+import graphql/admin/cursor
+
+pub fn encode_cursor_test() {
+  cursor.encode("Label", 42)
+  |> should.equal("TGFiZWw6NDI=")
+}
+
+pub fn encode_cursor_with_large_id_test() {
+  cursor.encode("Report", 12345)
+  |> should.equal("UmVwb3J0OjEyMzQ1")
+}
+```
+
+**Step 2: Run test to verify it fails**
+
+Run: `cd server && gleam test -- --only cursor_test`
+Expected: FAIL with module not found
+
+**Step 3: Write minimal implementation for encode**
+
+```gleam
+// server/src/graphql/admin/cursor.gleam
+/// Cursor encoding/decoding for admin GraphQL connections
+///
+/// Cursors are opaque base64-encoded strings in format "Type:ID"
+/// Example: "Label:42" -> "TGFiZWw6NDI="
+import gleam/bit_array
+import gleam/int
+import gleam/result
+import gleam/string
+
+/// Encode a cursor from prefix and ID
+/// "Label", 42 -> "TGFiZWw6NDI="
+pub fn encode(prefix: String, id: Int) -> String {
+  let raw = prefix <> ":" <> int.to_string(id)
+  bit_array.from_string(raw)
+  |> bit_array.base64_encode(True)
+}
+```
+
+**Step 4: Run test to verify encode passes**
+
+Run: `cd server && gleam test -- --only cursor_test`
+Expected: PASS
+
+**Step 5: Write the failing test for decode**
+
+Add to `cursor_test.gleam`:
+
+```gleam
+pub fn decode_cursor_test() {
+  cursor.decode("TGFiZWw6NDI=")
+  |> should.equal(Ok(#("Label", 42)))
+}
+
+pub fn decode_cursor_with_large_id_test() {
+  cursor.decode("UmVwb3J0OjEyMzQ1")
+  |> should.equal(Ok(#("Report", 12345)))
+}
+
+pub fn decode_invalid_cursor_test() {
+  cursor.decode("not-valid-base64!!!")
+  |> should.be_error()
+}
+
+pub fn decode_malformed_cursor_test() {
+  // Valid base64 but wrong format (no colon)
+  cursor.decode("bm9jb2xvbg==")
+  |> should.be_error()
+}
+```
+
+**Step 6: Run test to verify decode fails**
+
+Run: `cd server && gleam test -- --only cursor_test`
+Expected: FAIL with function not defined
+
+**Step 7: Write minimal implementation for decode**
+
+Add to `cursor.gleam`:
+
+```gleam
+/// Decode a cursor to prefix and ID
+/// "TGFiZWw6NDI=" -> Ok(#("Label", 42))
+pub fn decode(cursor: String) -> Result(#(String, Int), Nil) {
+  use decoded <- result.try(
+    bit_array.base64_decode(cursor)
+    |> result.then(fn(bits) {
+      bit_array.to_string(bits)
+    })
+    |> result.nil_error()
+  )
+
+  case string.split(decoded, ":") {
+    [prefix, id_str] -> {
+      case int.parse(id_str) {
+        Ok(id) -> Ok(#(prefix, id))
+        Error(_) -> Error(Nil)
+      }
+    }
+    _ -> Error(Nil)
+  }
+}
+```
+
+**Step 8: Run test to verify all pass**
+
+Run: `cd server && gleam test -- --only cursor_test`
+Expected: All PASS
+
+**Step 9: Commit**
+
+```bash
+git add server/src/graphql/admin/cursor.gleam server/test/graphql/admin/cursor_test.gleam
+git commit -m "feat(admin): add cursor encoding/decoding for connection pagination"
+```
+
+---
+
+### Task 2: Add Connection Types to Admin Types
+
+**Files:**
+- Modify: `server/src/graphql/admin/types.gleam`
+
+**Step 1: Read the current types file to understand structure**
+
+Read: `server/src/graphql/admin/types.gleam`
+
+**Step 2: Add imports for swell/connection**
+
+Add to imports section:
+
+```gleam
+import swell/connection
+```
+
+**Step 3: Add LabelEdge and LabelConnection types**
+
+Add after `label_type`:
+
+```gleam
+/// Edge type for Label connection
+pub fn label_edge_type() -> schema.Type {
+  connection.edge_type("Label", label_type())
+}
+
+/// Connection type for paginated Label results
+pub fn label_connection_type() -> schema.Type {
+  connection.connection_type("Label", label_edge_type())
+}
+```
+
+**Step 4: Add ReportEdge and ReportConnection types**
+
+Add after `report_type`:
+
+```gleam
+/// Edge type for Report connection
+pub fn report_edge_type() -> schema.Type {
+  connection.edge_type("Report", report_type())
+}
+
+/// Connection type for paginated Report results
+pub fn report_connection_type() -> schema.Type {
+  connection.connection_type("Report", report_edge_type())
+}
+```
+
+**Step 5: Build to verify types compile**
+
+Run: `cd server && gleam build`
+Expected: Build succeeds
+
+**Step 6: Commit**
+
+```bash
+git add server/src/graphql/admin/types.gleam
+git commit -m "feat(admin): add Label and Report connection types"
+```
+
+---
+
+### Task 3: Update Labels Repository for Connection Pagination
+
+**Files:**
+- Modify: `server/src/database/repositories/labels.gleam`
+- Test: `server/test/database/repositories/labels_test.gleam` (if exists, otherwise add inline verification)
+
+**Step 1: Read the current labels repository**
+
+Read: `server/src/database/repositories/labels.gleam`
+
+**Step 2: Create new function signature for connection pagination**
+
+The existing `get_all` returns `Result(List(Label), Error)`. Add a new function that returns pagination info:
+
+```gleam
+/// Result type for paginated label queries
+pub type PaginatedLabels {
+  PaginatedLabels(
+    labels: List(Label),
+    has_next_page: Bool,
+    total_count: Int,
+  )
+}
+
+/// Get labels with connection-style pagination
+/// Returns labels, whether there's a next page, and total count
+pub fn get_paginated(
+  conn: Executor,
+  uri_filter: Option(String),
+  val_filter: Option(String),
+  first: Int,
+  after_id: Option(Int),
+) -> Result(PaginatedLabels, Error) {
+  // Fetch first + 1 to detect hasNextPage
+  let fetch_limit = first + 1
+
+  // Build base query conditions
+  let uri_condition = case uri_filter {
+    Some(uri) -> " AND uri = '" <> uri <> "'"
+    None -> ""
+  }
+  let val_condition = case val_filter {
+    Some(val) -> " AND val = '" <> val <> "'"
+    None -> ""
+  }
+  let cursor_condition = case after_id {
+    Some(id) -> " AND id < " <> int.to_string(id)
+    None -> ""
+  }
+
+  let where_clause = "WHERE 1=1" <> uri_condition <> val_condition <> cursor_condition
+
+  // Main query
+  let query = "SELECT id, src, uri, cid, val, neg, created_at, expires_at, signature
+               FROM labels " <> where_clause <> "
+               ORDER BY id DESC
+               LIMIT " <> int.to_string(fetch_limit)
+
+  // Count query (without cursor, with filters)
+  let count_where = "WHERE 1=1" <> uri_condition <> val_condition
+  let count_query = "SELECT COUNT(*) FROM labels " <> count_where
+
+  // Execute both queries
+  use labels_result <- result.try(execute_query(conn, query))
+  use count_result <- result.try(execute_count_query(conn, count_query))
+
+  // Determine if there's a next page
+  let has_next = list.length(labels_result) > first
+  let labels = case has_next {
+    True -> list.take(labels_result, first)
+    False -> labels_result
+  }
+
+  Ok(PaginatedLabels(
+    labels: labels,
+    has_next_page: has_next,
+    total_count: count_result,
+  ))
+}
+```
+
+Note: The actual implementation will need to match the existing query patterns in this repository. Read the file first to adapt.
+
+**Step 3: Build and verify**
+
+Run: `cd server && gleam build`
+Expected: Build succeeds
+
+**Step 4: Commit**
+
+```bash
+git add server/src/database/repositories/labels.gleam
+git commit -m "feat(labels): add get_paginated for connection pagination"
+```
+
+---
+
+### Task 4: Update Reports Repository for Connection Pagination
+
+**Files:**
+- Modify: `server/src/database/repositories/reports.gleam`
+
+**Step 1: Read the current reports repository**
+
+Read: `server/src/database/repositories/reports.gleam`
+
+**Step 2: Add paginated query function following same pattern as labels**
+
+Add similar `PaginatedReports` type and `get_paginated` function, adapting to the reports table structure and existing query patterns.
+
+**Step 3: Build and verify**
+
+Run: `cd server && gleam build`
+Expected: Build succeeds
+
+**Step 4: Commit**
+
+```bash
+git add server/src/database/repositories/reports.gleam
+git commit -m "feat(reports): add get_paginated for connection pagination"
+```
+
+---
+
+### Task 5: Update Labels Query Resolver
+
+**Files:**
+- Modify: `server/src/graphql/admin/queries.gleam`
+
+**Step 1: Read the current queries file**
+
+Read: `server/src/graphql/admin/queries.gleam`
+
+**Step 2: Add imports**
+
+Add to imports:
+
+```gleam
+import graphql/admin/cursor
+import swell/connection
+```
+
+**Step 3: Update labels field to use connection type and new arguments**
+
+Replace the labels field definition:
+
+```gleam
+// labels query (admin only) - Connection type
+schema.field_with_args(
+  "labels",
+  schema.non_null(admin_types.label_connection_type()),
+  "Get labels with optional filters (admin only)",
+  [
+    schema.argument(
+      "uri",
+      schema.string_type(),
+      "Filter by subject URI",
+      None,
+    ),
+    schema.argument(
+      "val",
+      schema.string_type(),
+      "Filter by label value",
+      None,
+    ),
+    schema.argument(
+      "first",
+      schema.int_type(),
+      "Number of items to fetch (default 50)",
+      None,
+    ),
+    schema.argument(
+      "after",
+      schema.string_type(),
+      "Cursor for pagination",
+      None,
+    ),
+  ],
+  fn(ctx) {
+    case session.get_current_session(req, conn, did_cache) {
+      Ok(sess) -> {
+        case config_repo.is_admin(conn, sess.did) {
+          True -> {
+            let uri_filter = case schema.get_argument(ctx, "uri") {
+              Some(value.String(u)) -> Some(u)
+              _ -> None
+            }
+            let val_filter = case schema.get_argument(ctx, "val") {
+              Some(value.String(v)) -> Some(v)
+              _ -> None
+            }
+            let first = case schema.get_argument(ctx, "first") {
+              Some(value.Int(f)) -> f
+              _ -> 50
+            }
+            let after_id = case schema.get_argument(ctx, "after") {
+              Some(value.String(c)) -> {
+                case cursor.decode(c) {
+                  Ok(#("Label", id)) -> Some(id)
+                  _ -> None
+                }
+              }
+              _ -> None
+            }
+
+            case labels.get_paginated(conn, uri_filter, val_filter, first, after_id) {
+              Ok(paginated) -> {
+                // Build edges with cursors
+                let edges = list.map(paginated.labels, fn(label) {
+                  let label_value = converters.label_to_value(label)
+                  let cursor_str = cursor.encode("Label", label.id)
+                  connection.edge_to_value(connection.Edge(
+                    node: label_value,
+                    cursor: cursor_str,
+                  ))
+                })
+
+                // Build page info
+                let start_cursor = case list.first(paginated.labels) {
+                  Ok(first_label) -> Some(cursor.encode("Label", first_label.id))
+                  Error(_) -> None
+                }
+                let end_cursor = case list.last(paginated.labels) {
+                  Ok(last_label) -> Some(cursor.encode("Label", last_label.id))
+                  Error(_) -> None
+                }
+
+                let page_info = connection.PageInfo(
+                  has_next_page: paginated.has_next_page,
+                  has_previous_page: option.is_some(after_id),
+                  start_cursor: start_cursor,
+                  end_cursor: end_cursor,
+                )
+
+                let conn_value = connection.Connection(
+                  edges: list.map(paginated.labels, fn(label) {
+                    connection.Edge(
+                      node: converters.label_to_value(label),
+                      cursor: cursor.encode("Label", label.id),
+                    )
+                  }),
+                  page_info: page_info,
+                  total_count: Some(paginated.total_count),
+                )
+
+                Ok(connection.connection_to_value(conn_value))
+              }
+              Error(_) -> Error("Failed to fetch labels")
+            }
+          }
+          False -> Error("Admin privileges required")
+        }
+      }
+      Error(_) -> Error("Authentication required")
+    }
+  },
+),
+```
+
+**Step 4: Build to verify**
+
+Run: `cd server && gleam build`
+Expected: Build succeeds
+
+**Step 5: Commit**
+
+```bash
+git add server/src/graphql/admin/queries.gleam
+git commit -m "feat(admin): update labels query to return Connection type"
+```
+
+---
+
+### Task 6: Update Reports Query Resolver
+
+**Files:**
+- Modify: `server/src/graphql/admin/queries.gleam`
+
+**Step 1: Update reports field following same pattern as labels**
+
+Replace the reports field with connection-based version using `report_connection_type()`, `first`/`after` arguments, cursor encoding with "Report" prefix, and `reports.get_paginated`.
+
+**Step 2: Build to verify**
+
+Run: `cd server && gleam build`
+Expected: Build succeeds
+
+**Step 3: Commit**
+
+```bash
+git add server/src/graphql/admin/queries.gleam
+git commit -m "feat(admin): update reports query to return Connection type"
+```
+
+---
+
+### Task 7: Integration Test
+
+**Files:**
+- Create: `server/test/graphql/admin/connection_test.gleam`
+
+**Step 1: Write integration test for labels connection**
+
+```gleam
+// Test that labels query returns proper connection structure
+import gleeunit/should
+// ... setup code matching existing test patterns
+
+pub fn labels_connection_structure_test() {
+  // Query should return edges, pageInfo, totalCount
+  let query = "
+    query {
+      labels(first: 10) {
+        edges {
+          node { id val uri }
+          cursor
+        }
+        pageInfo {
+          hasNextPage
+          hasPreviousPage
+          startCursor
+          endCursor
+        }
+        totalCount
+      }
+    }
+  "
+  // Execute and verify structure
+}
+
+pub fn labels_pagination_test() {
+  // Test that after cursor works correctly
+}
+```
+
+**Step 2: Run tests**
+
+Run: `cd server && gleam test`
+Expected: All tests pass
+
+**Step 3: Commit**
+
+```bash
+git add server/test/graphql/admin/connection_test.gleam
+git commit -m "test(admin): add integration tests for connection pagination"
+```
+
+---
+
+### Task 8: Final Verification and Cleanup
+
+**Step 1: Run full test suite**
+
+Run: `cd server && gleam test`
+Expected: All tests pass
+
+**Step 2: Manual verification via GraphQL**
+
+Start server and test at `/admin/graphql`:
+
+```graphql
+query {
+  labels(first: 5) {
+    edges {
+      node { id val uri createdAt }
+      cursor
+    }
+    pageInfo {
+      hasNextPage
+      endCursor
+    }
+    totalCount
+  }
+}
+```
+
+Then paginate:
+
+```graphql
+query {
+  labels(first: 5, after: "<endCursor from above>") {
+    edges {
+      node { id val }
+      cursor
+    }
+    pageInfo {
+      hasNextPage
+      hasPreviousPage
+    }
+  }
+}
+```
+
+**Step 3: Commit any final fixes**
+
+```bash
+git add -A
+git commit -m "chore: final cleanup for admin connection pagination"
+```

dev-docs/plans/2025-12-30-viewer-label-preferences.md

···
+# Viewer Label Preferences Implementation Plan
+
+> **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.
+
+**Goal:** Allow users to configure how they want each label type displayed (ignore, show, warn, hide).
+
+**Architecture:** Add `actor_label_preferences` table for per-user settings, extend `label_definitions` with `default_visibility`, expose via `viewerLabelPreferences` query and `setLabelPreference` mutation on the lexicon GraphQL API. System labels (starting with `!`) are excluded since the server enforces them.
+
+**Tech Stack:** Gleam, SQLite/Postgres, swell GraphQL library
+
+---
+
+### Task 1: Add Migration for Label Preferences
+
+**Files:**
+- Create: `server/priv/migrations/XXXXXX_add_label_preferences.sql`
+
+**Step 1: Create migration file**
+
+```sql
+-- Add default_visibility to label_definitions
+ALTER TABLE label_definitions ADD COLUMN default_visibility TEXT NOT NULL DEFAULT 'warn';
+
+-- Create actor_label_preferences table
+CREATE TABLE IF NOT EXISTS actor_label_preferences (
+  did TEXT NOT NULL,
+  label_val TEXT NOT NULL,
+  visibility TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%d %H:%M:%S', 'now')),
+  PRIMARY KEY (did, label_val)
+);
+
+-- Index for fast lookups by user
+CREATE INDEX IF NOT EXISTS idx_actor_label_preferences_did ON actor_label_preferences(did);
+```
+
+**Step 2: Run migration**
+
+Run: `cd server && gleam run -m migrate`
+Expected: Migration applies successfully
+
+**Step 3: Commit**
+
+```bash
+git add server/priv/migrations/
+git commit -m "feat(db): add label preferences migration"
+```
+
+---
+
+### Task 2: Create Label Preferences Repository
+
+**Files:**
+- Create: `server/src/database/repositories/label_preferences.gleam`
+
+**Step 1: Create repository module**
+
+```gleam
+/// Repository for actor label preferences
+import database/executor.{type Executor}
+import gleam/dynamic
+import gleam/list
+import gleam/option.{type Option, None, Some}
+import gleam/result
+
+/// A label preference record
+pub type LabelPreference {
+  LabelPreference(
+    did: String,
+    label_val: String,
+    visibility: String,
+    created_at: String,
+  )
+}
+
+/// Get all preferences for a user
+pub fn get_by_did(
+  conn: Executor,
+  did: String,
+) -> Result(List(LabelPreference), String) {
+  let sql =
+    "SELECT did, label_val, visibility, created_at
+     FROM actor_label_preferences
+     WHERE did = ?"
+
+  case executor.query(conn, sql, [executor.string(did)], preference_decoder()) {
+    Ok(rows) -> Ok(rows)
+    Error(_) -> Error("Failed to fetch label preferences")
+  }
+}
+
+/// Get a specific preference
+pub fn get(
+  conn: Executor,
+  did: String,
+  label_val: String,
+) -> Result(Option(LabelPreference), String) {
+  let sql =
+    "SELECT did, label_val, visibility, created_at
+     FROM actor_label_preferences
+     WHERE did = ? AND label_val = ?"
+
+  case
+    executor.query(conn, sql, [executor.string(did), executor.string(label_val)], preference_decoder())
+  {
+    Ok([pref, ..]) -> Ok(Some(pref))
+    Ok([]) -> Ok(None)
+    Error(_) -> Error("Failed to fetch label preference")
+  }
+}
+
+/// Set a preference (upsert)
+pub fn set(
+  conn: Executor,
+  did: String,
+  label_val: String,
+  visibility: String,
+) -> Result(LabelPreference, String) {
+  let sql =
+    "INSERT INTO actor_label_preferences (did, label_val, visibility)
+     VALUES (?, ?, ?)
+     ON CONFLICT(did, label_val) DO UPDATE SET visibility = excluded.visibility
+     RETURNING did, label_val, visibility, created_at"
+
+  case
+    executor.query(
+      conn,
+      sql,
+      [executor.string(did), executor.string(label_val), executor.string(visibility)],
+      preference_decoder(),
+    )
+  {
+    Ok([pref, ..]) -> Ok(pref)
+    Ok([]) -> Error("Failed to set preference")
+    Error(_) -> Error("Failed to set label preference")
+  }
+}
+
+/// Delete a preference (reset to default)
+pub fn delete(
+  conn: Executor,
+  did: String,
+  label_val: String,
+) -> Result(Nil, String) {
+  let sql =
+    "DELETE FROM actor_label_preferences WHERE did = ? AND label_val = ?"
+
+  case executor.execute(conn, sql, [executor.string(did), executor.string(label_val)]) {
+    Ok(_) -> Ok(Nil)
+    Error(_) -> Error("Failed to delete label preference")
+  }
+}
+
+fn preference_decoder() -> dynamic.Decoder(LabelPreference) {
+  dynamic.decode4(
+    LabelPreference,
+    dynamic.element(0, dynamic.string),
+    dynamic.element(1, dynamic.string),
+    dynamic.element(2, dynamic.string),
+    dynamic.element(3, dynamic.string),
+  )
+}
+```
+
+**Step 2: Build to verify**
+
+Run: `cd server && gleam build`
+Expected: Build succeeds
+
+**Step 3: Commit**
+
+```bash
+git add server/src/database/repositories/label_preferences.gleam
+git commit -m "feat(db): add label preferences repository"
+```
+
+---
+
+### Task 3: Update Label Definitions Repository
+
+**Files:**
+- Modify: `server/src/database/repositories/label_definitions.gleam`
+
+**Step 1: Update LabelDefinition type to include default_visibility**
+
+Add `default_visibility: String` field to the `LabelDefinition` type and update all decoders and queries to include it.
+
+**Step 2: Update insert function signature**
+
+Add `default_visibility` parameter to the `insert` function:
+
+```gleam
+pub fn insert(
+  conn: Executor,
+  val: String,
+  description: String,
+  severity: String,
+  default_visibility: String,
+) -> Result(Nil, String)
+```
+
+**Step 3: Add get_non_system function**
+
+```gleam
+/// Get all non-system label definitions (excludes labels starting with !)
+pub fn get_non_system(conn: Executor) -> Result(List(LabelDefinition), String) {
+  let sql =
+    "SELECT val, description, severity, default_visibility, created_at
+     FROM label_definitions
+     WHERE val NOT LIKE '!%'
+     ORDER BY val"
+
+  case executor.query(conn, sql, [], definition_decoder()) {
+    Ok(rows) -> Ok(rows)
+    Error(_) -> Error("Failed to fetch label definitions")
+  }
+}
+```
+
+**Step 4: Build to verify**
+
+Run: `cd server && gleam build`
+Expected: Build succeeds (may have errors in callers that need updating)
+
+**Step 5: Commit**
+
+```bash
+git add server/src/database/repositories/label_definitions.gleam
+git commit -m "feat(db): add default_visibility to label definitions"
+```
+
+---
+
+### Task 4: Update createLabelDefinition Mutation
+
+**Files:**
+- Modify: `server/src/graphql/admin/mutations.gleam`
+
+**Step 1: Add defaultVisibility argument**
+
+Add new argument to `createLabelDefinition` mutation:
+
+```gleam
+schema.argument(
+  "defaultVisibility",
+  schema.string_type(),
+  "Default visibility setting (ignore, show, warn, hide). Defaults to warn.",
+  None,
+),
+```
+
+**Step 2: Extract and validate defaultVisibility**
+
+```gleam
+let default_visibility = case
+  schema.get_argument(ctx, "defaultVisibility")
+{
+  Some(value.Enum(v)) -> string.lowercase(v)
+  Some(value.String(v)) -> string.lowercase(v)
+  _ -> "warn"
+}
+
+// Validate
+let valid_visibilities = ["ignore", "show", "warn", "hide"]
+use _ <- result.try(case list.contains(valid_visibilities, default_visibility) {
+  True -> Ok(Nil)
+  False -> Error("defaultVisibility must be one of: ignore, show, warn, hide")
+})
+```
+
+**Step 3: Pass to insert**
+
+Update the `label_definitions.insert` call to include `default_visibility`.
+
+**Step 4: Build to verify**
+
+Run: `cd server && gleam build`
+Expected: Build succeeds
+
+**Step 5: Commit**
+
+```bash
+git add server/src/graphql/admin/mutations.gleam
+git commit -m "feat(admin): add defaultVisibility to createLabelDefinition"
+```
+
+---
+
+### Task 5: Add Visibility Enum to Lexicon Types
+
+**Files:**
+- Modify: `server/src/graphql/lexicon/types.gleam`
+
+**Step 1: Add LabelVisibility enum**
+
+```gleam
+/// LabelVisibility enum for user preferences
+pub fn label_visibility_enum() -> schema.Type {
+  schema.enum_type("LabelVisibility", "How to display labeled content", [
+    schema.enum_value("IGNORE", "Show content normally, no indicator"),
+    schema.enum_value("SHOW", "Explicitly show (for adult content)"),
+    schema.enum_value("WARN", "Blur with click-through warning"),
+    schema.enum_value("HIDE", "Do not show content"),
+  ])
+}
+```
+
+**Step 2: Add LabelPreference type**
+
+```gleam
+/// LabelPreference type for viewerLabelPreferences query
+pub fn label_preference_type() -> schema.Type {
+  schema.object_type("LabelPreference", "User preference for a label type", [
+    schema.field(
+      "val",
+      schema.non_null(schema.string_type()),
+      "Label value",
+      fn(ctx) { Ok(get_field(ctx, "val")) },
+    ),
+    schema.field(
+      "description",
+      schema.non_null(schema.string_type()),
+      "Label description",
+      fn(ctx) { Ok(get_field(ctx, "description")) },
+    ),
+    schema.field(
+      "severity",
+      schema.non_null(schema.string_type()),
+      "Label severity (inform, alert, none)",
+      fn(ctx) { Ok(get_field(ctx, "severity")) },
+    ),
+    schema.field(
+      "defaultVisibility",
+      schema.non_null(label_visibility_enum()),
+      "Default visibility setting",
+      fn(ctx) { Ok(get_field(ctx, "defaultVisibility")) },
+    ),
+    schema.field(
+      "visibility",
+      schema.non_null(label_visibility_enum()),
+      "User's effective visibility setting",
+      fn(ctx) { Ok(get_field(ctx, "visibility")) },
+    ),
+  ])
+}
+```
+
+**Step 3: Build to verify**
+
+Run: `cd server && gleam build`
+Expected: Build succeeds
+
+**Step 4: Commit**
+
+```bash
+git add server/src/graphql/lexicon/types.gleam
+git commit -m "feat(lexicon): add LabelVisibility enum and LabelPreference type"
+```
+
+---
+
+### Task 6: Add viewerLabelPreferences Query
+
+**Files:**
+- Modify: `server/src/graphql/lexicon/queries.gleam`
+
+**Step 1: Add viewerLabelPreferences field**
+
+```gleam
+schema.field(
+  "viewerLabelPreferences",
+  schema.non_null(schema.list_type(schema.non_null(types.label_preference_type()))),
+  "Get label visibility preferences for the authenticated user",
+  fn(_ctx) {
+    // Check authentication
+    case get_authenticated_session(ctx) {
+      Error(e) -> Error(e)
+      Ok(auth) -> {
+        // Get all non-system label definitions
+        case label_definitions.get_non_system(conn) {
+          Error(e) -> Error(e)
+          Ok(definitions) -> {
+            // Get user's preferences
+            case label_preferences.get_by_did(conn, auth.user_info.did) {
+              Error(e) -> Error(e)
+              Ok(prefs) -> {
+                // Build preference map
+                let pref_map =
+                  list.fold(prefs, dict.new(), fn(acc, p) {
+                    dict.insert(acc, p.label_val, p.visibility)
+                  })
+
+                // Merge definitions with user prefs
+                let results =
+                  list.map(definitions, fn(def) {
+                    let visibility = case dict.get(pref_map, def.val) {
+                      Ok(v) -> v
+                      Error(_) -> def.default_visibility
+                    }
+                    value.Object([
+                      #("val", value.String(def.val)),
+                      #("description", value.String(def.description)),
+                      #("severity", value.String(def.severity)),
+                      #("defaultVisibility", value.Enum(string.uppercase(def.default_visibility))),
+                      #("visibility", value.Enum(string.uppercase(visibility))),
+                    ])
+                  })
+
+                Ok(value.List(results))
+              }
+            }
+          }
+        }
+      }
+    }
+  },
+),
+```
+
+**Step 2: Add required imports**
+
+Add imports for `label_definitions`, `label_preferences`, `dict`.
+
+**Step 3: Build to verify**
+
+Run: `cd server && gleam build`
+Expected: Build succeeds
+
+**Step 4: Commit**
+
+```bash
+git add server/src/graphql/lexicon/queries.gleam
+git commit -m "feat(lexicon): add viewerLabelPreferences query"
+```
+
+---
+
+### Task 7: Add setLabelPreference Mutation
+
+**Files:**
+- Modify: `server/src/graphql/lexicon/mutations.gleam`
+
+**Step 1: Add setLabelPreference field**
+
+```gleam
+schema.field_with_args(
+  "setLabelPreference",
+  schema.non_null(types.label_preference_type()),
+  "Set visibility preference for a label type",
+  [
+    schema.argument(
+      "val",
+      schema.non_null(schema.string_type()),
+      "Label value",
+      None,
+    ),
+    schema.argument(
+      "visibility",
+      schema.non_null(types.label_visibility_enum()),
+      "Visibility setting",
+      None,
+    ),
+  ],
+  fn(ctx) {
+    // Check authentication
+    case get_authenticated_session(resolver_ctx, ctx) {
+      Error(e) -> Error(e)
+      Ok(auth) -> {
+        // Get arguments
+        case
+          schema.get_argument(resolver_ctx, "val"),
+          schema.get_argument(resolver_ctx, "visibility")
+        {
+          Some(value.String(val)), Some(value.Enum(visibility)) -> {
+            // Validate not a system label
+            case string.starts_with(val, "!") {
+              True -> Error("Cannot set preference for system labels")
+              False -> {
+                // Validate label exists
+                case label_definitions.get(ctx.db, val) {
+                  Ok(None) -> Error("Unknown label: " <> val)
+                  Error(_) -> Error("Failed to validate label")
+                  Ok(Some(def)) -> {
+                    let visibility_lower = string.lowercase(visibility)
+                    // Set the preference
+                    case
+                      label_preferences.set(
+                        ctx.db,
+                        auth.user_info.did,
+                        val,
+                        visibility_lower,
+                      )
+                    {
+                      Error(e) -> Error(e)
+                      Ok(_) -> {
+                        Ok(value.Object([
+                          #("val", value.String(def.val)),
+                          #("description", value.String(def.description)),
+                          #("severity", value.String(def.severity)),
+                          #("defaultVisibility", value.Enum(string.uppercase(def.default_visibility))),
+                          #("visibility", value.Enum(visibility)),
+                        ]))
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+          _, _ -> Error("val and visibility are required")
+        }
+      }
+    }
+  },
+),
+```
+
+**Step 2: Add required imports**
+
+Add imports for `label_definitions`, `label_preferences`.
+
+**Step 3: Build to verify**
+
+Run: `cd server && gleam build`
+Expected: Build succeeds
+
+**Step 4: Commit**
+
+```bash
+git add server/src/graphql/lexicon/mutations.gleam
+git commit -m "feat(lexicon): add setLabelPreference mutation"
+```
+
+---
+
+### Task 8: Update Seed Data
+
+**Files:**
+- Modify: `server/src/database/seed.gleam` (or wherever labels are seeded)
+
+**Step 1: Update seed to include default_visibility**
+
+Update each seeded label definition to include appropriate default visibility:
+
+| Label | Default Visibility |
+|-------|-------------------|
+| `porn` | `hide` |
+| `sexual` | `warn` |
+| `nudity` | `warn` |
+| `gore` | `warn` |
+| `nsfl` | `warn` |
+| `graphic-media` | `warn` |
+| `spam` | `warn` |
+| `impersonation` | `warn` |
+
+**Step 2: Build and test seed**
+
+Run: `cd server && gleam build`
+Expected: Build succeeds
+
+**Step 3: Commit**
+
+```bash
+git add server/src/database/seed.gleam
+git commit -m "feat(db): add default_visibility to seeded labels"
+```
+
+---
+
+### Task 9: Add Integration Tests
+
+**Files:**
+- Create: `server/test/label_preferences_test.gleam`
+
+**Step 1: Write test for viewerLabelPreferences query**
+
+```gleam
+pub fn viewer_label_preferences_returns_all_non_system_labels_test() {
+  use conn <- test_helpers.with_test_db()
+  use auth <- test_helpers.with_authenticated_user(conn)
+
+  let query = "
+    query {
+      viewerLabelPreferences {
+        val
+        visibility
+        defaultVisibility
+      }
+    }
+  "
+
+  let result = execute_query(conn, query, auth)
+
+  // Should return labels, none starting with !
+  let prefs = get_field(result, "viewerLabelPreferences")
+  assert list.length(prefs) > 0
+  assert list.all(prefs, fn(p) { !string.starts_with(p.val, "!") })
+}
+```
+
+**Step 2: Write test for setLabelPreference mutation**
+
+```gleam
+pub fn set_label_preference_updates_visibility_test() {
+  use conn <- test_helpers.with_test_db()
+  use auth <- test_helpers.with_authenticated_user(conn)
+
+  let mutation = "
+    mutation {
+      setLabelPreference(val: \"spam\", visibility: HIDE) {
+        val
+        visibility
+      }
+    }
+  "
+
+  let result = execute_mutation(conn, mutation, auth)
+
+  assert result.val == "spam"
+  assert result.visibility == "HIDE"
+}
+```
+
+**Step 3: Write test for system label rejection**
+
+```gleam
+pub fn set_label_preference_rejects_system_labels_test() {
+  use conn <- test_helpers.with_test_db()
+  use auth <- test_helpers.with_authenticated_user(conn)
+
+  let mutation = "
+    mutation {
+      setLabelPreference(val: \"!takedown\", visibility: IGNORE) {
+        val
+      }
+    }
+  "
+
+  let result = execute_mutation(conn, mutation, auth)
+
+  assert result.errors != []
+  assert string.contains(result.errors[0], "system labels")
+}
+```
+
+**Step 4: Run tests**
+
+Run: `cd server && gleam test`
+Expected: All tests pass
+
+**Step 5: Commit**
+
+```bash
+git add server/test/label_preferences_test.gleam
+git commit -m "test(lexicon): add label preferences integration tests"
+```
+
+---
+
+### Task 10: Update Documentation
+
+**Files:**
+- Modify: `docs/guides/moderation.md`
+
+**Step 1: Add Label Preferences section**
+
+Add after "Admin Access" section:
+
+```markdown
+## Label Preferences
+
+Users can configure how labeled content appears to them.
+
+### Visibility Settings
+
+| Setting | Behavior |
+|---------|----------|
+| `IGNORE` | Show content normally, no indicator |
+| `SHOW` | Explicitly show (for adult content) |
+| `WARN` | Blur with "Show anyway" option |
+| `HIDE` | Do not display content |
+
+### Querying Preferences
+
+Authenticated users fetch their preferences:
+
+```graphql
+query {
+  viewerLabelPreferences {
+    val
+    description
+    visibility
+    defaultVisibility
+  }
+}
+```
+
+### Setting Preferences
+
+Update a preference:
+
+```graphql
+mutation {
+  setLabelPreference(val: "spam", visibility: HIDE) {
+    val
+    visibility
+  }
+}
+```
+
+System labels (starting with `!`) cannot be configured—the server enforces them.
+```
+
+**Step 2: Commit**
+
+```bash
+git add docs/guides/moderation.md
+git commit -m "docs(moderation): add label preferences documentation"
+```

docs/guides/moderation.md

···
+# Moderation
+
+Quickslice provides AT Protocol-compatible moderation through labels and reports. Labels mark content; reports let users flag problems.
+
+> **Note:** Admin operations use the `/admin/graphql` endpoint. User operations like `createReport` use the main `/graphql` endpoint.
+
+## Labels
+
+Labels attach metadata to records or accounts. Apply a `!takedown` label to hide content from queries. Apply `porn` or `gore` to trigger client-side warnings.
+
+### Label Definitions
+
+Each instance defines which labels it accepts. Quickslice seeds common defaults:
+
+| Value | Severity | Effect |
+|-------|----------|--------|
+| `!takedown` | takedown | Hides from all queries |
+| `!suspend` | takedown | Hides from all queries |
+| `!warn` | alert | Clients show warning |
+| `!hide` | alert | Hidden from feeds |
+| `porn` | alert | Adult content warning |
+| `sexual` | alert | Suggestive content warning |
+| `nudity` | alert | Non-sexual nudity warning |
+| `gore` | alert | Graphic violence warning |
+| `graphic-media` | alert | Disturbing media warning |
+| `spam` | inform | Spam indicator |
+| `impersonation` | inform | Impersonation indicator |
+
+Create custom labels through the admin API.
+
+### Applying Labels
+
+Admins apply labels via GraphQL:
+
+```graphql
+mutation {
+  createLabel(
+    uri: "at://did:plc:xyz/app.bsky.feed.post/abc123"
+    val: "!takedown"
+  ) {
+    id
+    uri
+    val
+    cts
+  }
+}
+```
+
+The `uri` identifies the target—a record URI or account DID. The `val` must match a defined label.
+
+### Retracting Labels
+
+Labels persist until negated. To remove a label, create a negation:
+
+```graphql
+mutation {
+  negateLabel(
+    uri: "at://did:plc:xyz/app.bsky.feed.post/abc123"
+    val: "!takedown"
+  ) {
+    id
+    neg
+  }
+}
+```
+
+The negation cancels the original label. Content reappears in queries.
+
+### Listing Labels (Admin)
+
+Admins can list all applied labels with optional filters:
+
+```graphql
+query {
+  labels(first: 20) {
+    edges {
+      node {
+        id
+        uri
+        val
+        src
+        neg
+        cts
+      }
+    }
+    pageInfo {
+      hasNextPage
+      endCursor
+    }
+  }
+}
+```
+
+Filter by subject URI or label value:
+
+```graphql
+query {
+  labels(uri: "at://did:plc:xyz/app.bsky.feed.post/abc123", first: 10) {
+    edges {
+      node {
+        val
+        cts
+      }
+    }
+  }
+}
+```
+
+### Takedown Behavior
+
+Records with `!takedown` or `!suspend` labels disappear from all queries. Quickslice filters them automatically—clients never see hidden content.
+
+Pagination counts adjust for filtered records. A query for 10 items returns 10 visible items, not 10 minus takedowns.
+
+### Querying Labels
+
+Every record type exposes a `labels` field:
+
+```graphql
+query {
+  xyzStatusphereStatuses(first: 10) {
+    nodes {
+      uri
+      status
+      labels {
+        val
+        src
+        cts
+      }
+    }
+  }
+}
+```
+
+Only active labels appear. Negated and expired labels are excluded.
+
+### Self-Labels
+
+Authors can label their own content by including a `labels` field in their record with type `com.atproto.label.defs#selfLabels`. Quickslice automatically merges self-labels with moderator labels.
+
+Example record with self-labels:
+
+```json
+{
+  "text": "Adult content warning",
+  "labels": {
+    "$type": "com.atproto.label.defs#selfLabels",
+    "values": [{"val": "porn"}]
+  }
+}
+```
+
+When querying, both self-labels and moderator labels appear in the `labels` field:
+
+```graphql
+query {
+  xyzPosts(first: 10) {
+    nodes {
+      uri
+      labels {
+        val
+        src
+      }
+    }
+  }
+}
+```
+
+Self-labels have the record author's DID as the `src`. Moderator labels have the moderator's DID.
+
+## Reports
+
+Reports let users flag content for moderator review.
+
+### Creating Reports
+
+Authenticated users submit reports:
+
+```graphql
+mutation {
+  createReport(
+    subjectUri: "at://did:plc:xyz/app.bsky.feed.post/abc123"
+    reasonType: SPAM
+    reason: "Promoting scam links"
+  ) {
+    id
+    status
+    createdAt
+  }
+}
+```
+
+Valid reason types: `SPAM`, `VIOLATION`, `MISLEADING`, `SEXUAL`, `RUDE`, `OTHER`.
+
+Each user can report a URI once. Duplicate reports return the existing report.
+
+### Reviewing Reports
+
+Admins list pending reports:
+
+```graphql
+query {
+  reports(status: PENDING, first: 20) {
+    edges {
+      node {
+        id
+        subjectUri
+        reasonType
+        reason
+        reporterDid
+        createdAt
+      }
+    }
+  }
+}
+```
+
+### Resolving Reports
+
+Resolve a report by applying a label or dismissing it:
+
+```graphql
+mutation {
+  resolveReport(id: 42, action: APPLY_LABEL, labelVal: "spam") {
+    id
+    status
+    resolvedBy
+    resolvedAt
+  }
+}
+```
+
+Actions:
+- `APPLY_LABEL`: Creates a label on the reported content, marks report resolved
+- `DISMISS`: Marks report dismissed without action
+
+## Admin Access
+
+Label and report management requires admin privileges. Configure admins by DID in your instance settings.
+
+Non-admins can:
+- View labels on records (via the `labels` field)
+- Submit reports
+- Configure their own label preferences
+
+Non-admins cannot:
+- Create or negate labels
+- View or resolve reports
+
+## Label Preferences
+
+Users can configure how labeled content appears to them. This is exposed through the public `/graphql` endpoint, not the admin endpoint.
+
+### Visibility Settings
+
+| Setting | Behavior |
+|---------|----------|
+| `IGNORE` | Show content normally, no indicator |
+| `SHOW` | Explicitly show (for adult content) |
+| `WARN` | Blur with "Show anyway" option |
+| `HIDE` | Do not display content |
+
+### Querying Preferences
+
+Authenticated users fetch their preferences:
+
+```graphql
+query {
+  viewerLabelPreferences {
+    val
+    description
+    severity
+    visibility
+    defaultVisibility
+  }
+}
+```
+
+This returns all non-system labels with their current visibility settings. If the user has not set a preference, `visibility` equals `defaultVisibility`.
+
+### Setting Preferences
+
+Update a preference:
+
+```graphql
+mutation {
+  setLabelPreference(val: "spam", visibility: HIDE) {
+    val
+    visibility
+  }
+}
+```
+
+Reset to default by setting visibility to match `defaultVisibility`.
+
+### System Labels
+
+System labels (starting with `!`) cannot be configured. The server enforces them:
+
+- `!takedown` and `!suspend` always hide content
+- `!warn` and `!hide` always apply their effects
+
+Attempting to set a preference for a system label returns an error.

docs/guides/queries.md

···
 # Queries
 
-Quickslice generates a GraphQL query for each Lexicon record type. Queries are public; no authentication required.
+Quickslice generates a GraphQL query for each Lexicon record type at the `/graphql` endpoint. Queries are public; no authentication required.
+
+> **Endpoints:** Lexicon queries and mutations use `/graphql`. Admin operations (labels, reports, settings) use `/admin/graphql`.
 
 ## Relay Connections
 

lexicon_graphql/src/lexicon_graphql.gleam

···
 import lexicon_graphql/schema/builder as schema_builder
 import lexicon_graphql/schema/database as db_schema_builder
 import lexicon_graphql/types
+import swell/schema
 
 // Re-export core types
 pub type Lexicon =
···
   viewer_fetcher: Option(ViewerFetcher),
   notification_fetcher: Option(NotificationFetcher),
   viewer_state_fetcher: Option(dataloader.ViewerStateFetcher),
+  labels_fetcher: Option(db_schema_builder.LabelsFetcher),
+  custom_mutation_fields: Option(List(schema.Field)),
+  custom_query_fields: Option(List(schema.Field)),
 ) {
   db_schema_builder.build_schema_with_subscriptions(
     lexicons,
···
     viewer_fetcher,
     notification_fetcher,
     viewer_state_fetcher,
+    labels_fetcher,
+    custom_mutation_fields,
+    custom_query_fields,
   )
 }
 

lexicon_graphql/src/lexicon_graphql/input/union.gleam

···
+/// Union Input Utilities
+///
+/// Functions for handling AT Protocol union fields in GraphQL inputs.
+/// Provides case conversion between naming conventions and transformation
+/// from GraphQL discriminated union format to AT Protocol $type format.
+///
+/// GraphQL input: { type: "SELF_LABELS", selfLabels: { values: [...] } }
+/// AT Protocol output: { $type: "com.atproto.label.defs#selfLabels", values: [...] }
+import gleam/list
+import gleam/string
+import swell/value
+
+// ─── Case Conversion ───────────────────────────────────────────────
+
+/// Convert camelCase to SCREAMING_SNAKE_CASE
+/// "selfLabels" -> "SELF_LABELS"
+/// "myVariantType" -> "MY_VARIANT_TYPE"
+///
+/// Note: Numbers are not treated as word boundaries.
+/// "oauth2Client" -> "OAUTH2_CLIENT" (not "OAUTH2CLIENT")
+pub fn camel_to_screaming_snake(s: String) -> String {
+  s
+  |> string.to_graphemes
+  |> list.fold(#("", False), fn(acc, char) {
+    let #(result, prev_was_lower) = acc
+    let is_upper = is_uppercase_letter(char)
+    case is_upper, prev_was_lower {
+      True, True -> #(result <> "_" <> char, False)
+      _, _ -> #(result <> string.uppercase(char), !is_upper)
+    }
+  })
+  |> fn(pair) { pair.0 }
+}
+
+/// Convert SCREAMING_SNAKE_CASE to camelCase
+/// "SELF_LABELS" -> "selfLabels"
+/// "MY_VARIANT_TYPE" -> "myVariantType"
+/// "OAUTH2_CLIENT" -> "oauth2Client"
+pub fn screaming_snake_to_camel(enum_value: String) -> String {
+  let parts = string.split(enum_value, "_")
+  case parts {
+    [first, ..rest] -> {
+      let lower_first = string.lowercase(first)
+      let capitalized_rest =
+        list.map(rest, fn(part) {
+          case string.pop_grapheme(string.lowercase(part)) {
+            Ok(#(first_char, remaining)) ->
+              string.uppercase(first_char) <> remaining
+            Error(_) -> part
+          }
+        })
+      lower_first <> string.concat(capitalized_rest)
+    }
+    [] -> enum_value
+  }
+}
+
+// ─── Ref Utilities ─────────────────────────────────────────────────
+
+/// Extract short name from a fully-qualified ref
+/// "com.atproto.label.defs#selfLabels" -> "selfLabels"
+/// "com.atproto.label.defs" -> "defs"
+pub fn ref_to_short_name(ref: String) -> String {
+  case string.split(ref, "#") {
+    [_, name] -> name
+    _ -> {
+      case string.split(ref, ".") |> list.last {
+        Ok(name) -> name
+        Error(_) -> ref
+      }
+    }
+  }
+}
+
+/// Convert a ref to SCREAMING_SNAKE_CASE enum value
+/// "com.atproto.label.defs#selfLabels" -> "SELF_LABELS"
+pub fn ref_to_enum_value(ref: String) -> String {
+  ref_to_short_name(ref) |> camel_to_screaming_snake
+}
+
+// ─── Transformation ────────────────────────────────────────────────
+
+/// Transform a union object from GraphQL discriminated format to AT Protocol format
+///
+/// Takes fields from a GraphQL input object and a list of possible refs for this union.
+/// Returns the transformed value in AT Protocol format with $type field.
+pub fn transform_union_object(
+  fields: List(#(String, value.Value)),
+  refs: List(String),
+) -> value.Value {
+  // Find the "type" discriminator field
+  let type_field = list.key_find(fields, "type")
+
+  case type_field {
+    Ok(value.Enum(enum_value)) -> {
+      transform_with_enum_value(fields, refs, enum_value)
+    }
+    Ok(value.String(str_value)) -> {
+      // Handle string type discriminator (fallback)
+      transform_with_enum_value(fields, refs, str_value)
+    }
+    _ -> value.Object(fields)
+  }
+}
+
+// ─── Internal Helpers ──────────────────────────────────────────────
+
+/// Check if a character is an uppercase letter (A-Z only)
+/// Returns False for numbers and other characters
+fn is_uppercase_letter(char: String) -> Bool {
+  let upper = string.uppercase(char)
+  let lower = string.lowercase(char)
+  // Is uppercase AND is a letter (not number/symbol)
+  upper == char && lower != char
+}
+
+/// Internal helper to transform using an enum value
+fn transform_with_enum_value(
+  fields: List(#(String, value.Value)),
+  refs: List(String),
+  enum_value: String,
+) -> value.Value {
+  // Convert enum value back to ref
+  let matching_ref = find_ref_for_enum_value(enum_value, refs)
+  case matching_ref {
+    Ok(ref) -> {
+      // Find the variant field (same name as the short ref name)
+      let short_name = screaming_snake_to_camel(enum_value)
+      case list.key_find(fields, short_name) {
+        Ok(value.Object(variant_fields)) -> {
+          // Build AT Protocol format: variant fields + $type
+          value.Object([#("$type", value.String(ref)), ..variant_fields])
+        }
+        _ -> {
+          // No variant data, just return $type
+          value.Object([#("$type", value.String(ref))])
+        }
+      }
+    }
+    Error(_) -> value.Object(fields)
+  }
+}
+
+/// Find the ref that matches an enum value
+/// "SELF_LABELS" matches "com.atproto.label.defs#selfLabels"
+fn find_ref_for_enum_value(
+  enum_value: String,
+  refs: List(String),
+) -> Result(String, Nil) {
+  list.find(refs, fn(ref) { ref_to_enum_value(ref) == enum_value })
+}

lexicon_graphql/src/lexicon_graphql/internal/graphql/type_mapper.gleam

···
     False -> ref
   }
 }
+
+/// Context needed for building union input types
+pub type UnionInputContext {
+  UnionInputContext(
+    input_types: Dict(String, schema.Type),
+    parent_type_name: String,
+  )
+}
+
+/// Maps a lexicon property to a GraphQL input type, with union input registry lookup
+/// This version can resolve union refs to their generated input types
+/// For multi-variant unions, builds discriminated union input types on demand
+pub fn map_input_type_with_unions(
+  property: types.Property,
+  field_name: String,
+  ctx: UnionInputContext,
+) -> schema.Type {
+  case property.type_ {
+    // For unions, handle single vs multi-variant
+    "union" -> {
+      case property.refs {
+        // Single-variant: use variant's input type directly
+        option.Some([single_ref]) -> {
+          case dict.get(ctx.input_types, single_ref) {
+            Ok(input_type) -> input_type
+            Error(_) -> schema.string_type()
+          }
+        }
+        // Multi-variant: build discriminated union input (2 or more refs)
+        option.Some([first, second, ..rest]) -> {
+          let refs = [first, second, ..rest]
+          build_multi_variant_union_input(
+            ctx.parent_type_name,
+            field_name,
+            refs,
+            ctx.input_types,
+          )
+        }
+        _ -> schema.string_type()
+      }
+    }
+
+    // For refs, check the registry
+    "ref" -> {
+      case property.ref {
+        option.Some(ref) -> {
+          case dict.get(ctx.input_types, ref) {
+            Ok(input_type) -> input_type
+            Error(_) -> map_input_type("ref")
+          }
+        }
+        option.None -> map_input_type("ref")
+      }
+    }
+
+    // For arrays with ref/union items
+    "array" -> {
+      case property.items {
+        option.Some(types.ArrayItems(item_type, item_ref, item_refs)) -> {
+          case item_type {
+            "ref" -> {
+              case item_ref {
+                option.Some(ref) -> {
+                  case dict.get(ctx.input_types, ref) {
+                    Ok(input_type) ->
+                      schema.list_type(schema.non_null(input_type))
+                    Error(_) ->
+                      schema.list_type(schema.non_null(schema.string_type()))
+                  }
+                }
+                option.None ->
+                  schema.list_type(schema.non_null(schema.string_type()))
+              }
+            }
+            "union" -> {
+              case item_refs {
+                // Single-variant array items
+                option.Some([single_ref]) -> {
+                  case dict.get(ctx.input_types, single_ref) {
+                    Ok(input_type) ->
+                      schema.list_type(schema.non_null(input_type))
+                    Error(_) ->
+                      schema.list_type(schema.non_null(schema.string_type()))
+                  }
+                }
+                // Multi-variant array items (2 or more refs)
+                option.Some([first, second, ..rest]) -> {
+                  let refs = [first, second, ..rest]
+                  let item_union =
+                    build_multi_variant_union_input(
+                      ctx.parent_type_name,
+                      field_name <> "Item",
+                      refs,
+                      ctx.input_types,
+                    )
+                  schema.list_type(schema.non_null(item_union))
+                }
+                _ -> schema.list_type(schema.non_null(schema.string_type()))
+              }
+            }
+            _ -> map_array_type(property.items, dict.new(), "", "")
+          }
+        }
+        option.None -> schema.list_type(schema.non_null(schema.string_type()))
+      }
+    }
+
+    // Default to regular input type mapping
+    _ -> map_input_type(property.type_)
+  }
+}
+
+/// Build a discriminated union input type for multi-variant unions
+fn build_multi_variant_union_input(
+  parent_type_name: String,
+  field_name: String,
+  refs: List(String),
+  existing_input_types: Dict(String, schema.Type),
+) -> schema.Type {
+  let union_name = parent_type_name <> capitalize_first(field_name) <> "Input"
+  let enum_name = parent_type_name <> capitalize_first(field_name) <> "Type"
+
+  // Build the type enum with variant names
+  let enum_values =
+    list.map(refs, fn(ref) {
+      let value_name = ref_to_variant_enum_value(ref)
+      schema.enum_value(value_name, "Select " <> ref <> " variant")
+    })
+
+  let type_enum =
+    schema.enum_type(
+      enum_name,
+      "Discriminator for " <> field_name <> " union variants",
+      enum_values,
+    )
+
+  // Build input fields: required type discriminator + optional variant fields
+  let type_field =
+    schema.input_field(
+      "type",
+      schema.non_null(type_enum),
+      "Select which variant to use",
+      option.None,
+    )
+
+  let variant_fields =
+    list.map(refs, fn(ref) {
+      let variant_field_name = ref_to_variant_field_name(ref)
+      let field_type = case dict.get(existing_input_types, ref) {
+        Ok(input_type) -> input_type
+        Error(_) -> schema.string_type()
+      }
+      schema.input_field(
+        variant_field_name,
+        field_type,
+        // Optional - user provides data for selected variant
+        "Data for " <> ref <> " variant",
+        option.None,
+      )
+    })
+
+  let all_fields = [type_field, ..variant_fields]
+
+  schema.input_object_type(
+    union_name,
+    "Union input for " <> field_name <> " - use type field to select variant",
+    all_fields,
+  )
+}
+
+/// Convert a ref to SCREAMING_SNAKE_CASE enum value
+fn ref_to_variant_enum_value(ref: String) -> String {
+  let short_name = case string.split(ref, "#") {
+    [_, name] -> name
+    _ -> {
+      case string.split(ref, ".") |> list.last {
+        Ok(name) -> name
+        Error(_) -> ref
+      }
+    }
+  }
+  camel_to_screaming_snake(short_name)
+}
+
+/// Convert camelCase to SCREAMING_SNAKE_CASE
+fn camel_to_screaming_snake(s: String) -> String {
+  s
+  |> string.to_graphemes
+  |> list.fold(#("", False), fn(acc, char) {
+    let #(result, prev_was_lower) = acc
+    let is_upper =
+      string.uppercase(char) == char && string.lowercase(char) != char
+    case is_upper, prev_was_lower {
+      True, True -> #(result <> "_" <> char, False)
+      _, _ -> #(result <> string.uppercase(char), !is_upper)
+    }
+  })
+  |> fn(pair) { pair.0 }
+}
+
+/// Convert a ref to a camelCase field name
+fn ref_to_variant_field_name(ref: String) -> String {
+  case string.split(ref, "#") {
+    [_, name] -> name
+    _ -> {
+      case string.split(ref, ".") |> list.last {
+        Ok(name) -> name
+        Error(_) -> ref
+      }
+    }
+  }
+}

lexicon_graphql/src/lexicon_graphql/internal/graphql/union_input_builder.gleam

···
+/// Union Input Builder
+///
+/// Builds GraphQL input types for AT Protocol union fields.
+/// Generates input types from lexicon ObjectDefs, handling nested refs.
+///
+/// For single-variant unions: returns the variant's input type directly
+/// For multi-variant unions: creates a discriminated input type with:
+///   - A `type` enum field for selecting the variant
+///   - Optional fields for each variant's data
+///
+/// Also builds a UnionFieldRegistry for dynamic $type resolution at runtime.
+import gleam/dict.{type Dict}
+import gleam/list
+import gleam/option.{type Option}
+import gleam/string
+import lexicon_graphql/input/union as union_input
+import lexicon_graphql/internal/graphql/type_mapper
+import lexicon_graphql/internal/lexicon/nsid
+import lexicon_graphql/internal/lexicon/registry as lexicon_registry
+import lexicon_graphql/types
+import swell/schema
+
+/// Registry of generated union input types
+/// Maps fully-qualified ref (e.g., "com.atproto.label.defs#selfLabels") to input type
+pub type UnionInputRegistry =
+  Dict(String, schema.Type)
+
+/// Mapping of union field paths to their variant refs
+/// Key: "collection.fieldName" (e.g., "social.grain.gallery.labels")
+/// Value: list of variant refs (e.g., ["com.atproto.label.defs#selfLabels"])
+/// Used for dynamic $type resolution during mutation transformation
+pub type UnionFieldRegistry =
+  Dict(String, List(String))
+
+/// Combined registry for union inputs
+pub type UnionRegistry {
+  UnionRegistry(
+    input_types: UnionInputRegistry,
+    field_variants: UnionFieldRegistry,
+  )
+}
+
+/// Build input types for all object defs in the registry
+/// Returns a registry with input types (field_variants populated separately)
+pub fn build_union_input_types(
+  registry: lexicon_registry.Registry,
+) -> UnionRegistry {
+  let object_defs = lexicon_registry.get_all_object_defs(registry)
+
+  // Build input types in dependency order (simple types first)
+  // Do two passes: first build all without refs, then with refs
+  let first_pass =
+    dict.fold(object_defs, dict.new(), fn(acc, ref, obj_def) {
+      let input_type = build_input_type_from_object_def(ref, obj_def, acc)
+      dict.insert(acc, ref, input_type)
+    })
+
+  // Second pass to resolve any remaining refs
+  let input_types =
+    dict.fold(object_defs, first_pass, fn(acc, ref, obj_def) {
+      let input_type = build_input_type_from_object_def(ref, obj_def, acc)
+      dict.insert(acc, ref, input_type)
+    })
+
+  // field_variants is populated during build_input_type in mutation builder
+  UnionRegistry(input_types: input_types, field_variants: dict.new())
+}
+
+/// Add a union field entry to the registry
+pub fn register_union_field(
+  registry: UnionRegistry,
+  collection: String,
+  field_name: String,
+  refs: List(String),
+) -> UnionRegistry {
+  let key = collection <> "." <> field_name
+  UnionRegistry(
+    input_types: registry.input_types,
+    field_variants: dict.insert(registry.field_variants, key, refs),
+  )
+}
+
+/// Look up union refs for a field
+pub fn get_union_refs(
+  registry: UnionRegistry,
+  collection: String,
+  field_name: String,
+) -> Option(List(String)) {
+  let key = collection <> "." <> field_name
+  dict.get(registry.field_variants, key) |> option.from_result
+}
+
+/// Convert a ref like "com.atproto.label.defs#selfLabels" to "SelfLabelsInput"
+pub fn ref_to_input_type_name(ref: String) -> String {
+  let base_name = nsid.to_type_name(string.replace(ref, "#", "."))
+  base_name <> "Input"
+}
+
+/// Convert a ref to a short variant name for enum values
+/// "com.atproto.label.defs#selfLabels" -> "SELF_LABELS"
+pub fn ref_to_variant_enum_value(ref: String) -> String {
+  union_input.ref_to_enum_value(ref)
+}
+
+/// Convert SCREAMING_SNAKE_CASE back to the original short name
+/// "SELF_LABELS" -> "selfLabels"
+pub fn enum_value_to_short_name(enum_value: String) -> String {
+  union_input.screaming_snake_to_camel(enum_value)
+}
+
+/// Convert a ref to a camelCase field name for variant fields
+/// "com.atproto.label.defs#selfLabels" -> "selfLabels"
+pub fn ref_to_variant_field_name(ref: String) -> String {
+  union_input.ref_to_short_name(ref)
+}
+
+/// Build a GraphQL input type from an ObjectDef
+fn build_input_type_from_object_def(
+  ref: String,
+  obj_def: types.ObjectDef,
+  existing_input_types: UnionInputRegistry,
+) -> schema.Type {
+  let type_name = ref_to_input_type_name(ref)
+  let required_fields = obj_def.required_fields
+
+  let input_fields =
+    list.map(obj_def.properties, fn(prop) {
+      let #(name, property) = prop
+      let is_required = list.contains(required_fields, name)
+
+      // Get the input type for this property
+      let field_type =
+        map_property_to_input_type(property, existing_input_types)
+
+      // Wrap in non_null if required
+      let final_type = case is_required {
+        True -> schema.non_null(field_type)
+        False -> field_type
+      }
+
+      schema.input_field(name, final_type, "Input for " <> name, option.None)
+    })
+
+  schema.input_object_type(type_name, "Input type for " <> ref, input_fields)
+}
+
+/// Build a discriminated union input type for multi-variant unions
+/// Creates an input with a `type` enum and optional fields for each variant
+pub fn build_multi_variant_union_input(
+  parent_type_name: String,
+  field_name: String,
+  refs: List(String),
+  existing_input_types: UnionInputRegistry,
+) -> schema.Type {
+  let union_name = parent_type_name <> capitalize_first(field_name) <> "Input"
+  let enum_name = parent_type_name <> capitalize_first(field_name) <> "Type"
+
+  // Build the type enum with variant names
+  let enum_values =
+    list.map(refs, fn(ref) {
+      let value_name = ref_to_variant_enum_value(ref)
+      schema.enum_value(value_name, "Select " <> ref <> " variant")
+    })
+
+  let type_enum =
+    schema.enum_type(
+      enum_name,
+      "Discriminator for " <> field_name <> " union variants",
+      enum_values,
+    )
+
+  // Build input fields: required type discriminator + optional variant fields
+  let type_field =
+    schema.input_field(
+      "type",
+      schema.non_null(type_enum),
+      "Select which variant to use",
+      option.None,
+    )
+
+  let variant_fields =
+    list.map(refs, fn(ref) {
+      let variant_field_name = ref_to_variant_field_name(ref)
+      let field_type = case dict.get(existing_input_types, ref) {
+        Ok(input_type) -> input_type
+        Error(_) -> schema.string_type()
+      }
+      schema.input_field(
+        variant_field_name,
+        field_type,
+        // Optional - user provides data for selected variant
+        "Data for " <> ref <> " variant",
+        option.None,
+      )
+    })
+
+  let all_fields = [type_field, ..variant_fields]
+
+  schema.input_object_type(
+    union_name,
+    "Union input for " <> field_name <> " - use type to select variant",
+    all_fields,
+  )
+}
+
+/// Map a lexicon property to a GraphQL input type
+fn map_property_to_input_type(
+  property: types.Property,
+  existing_input_types: UnionInputRegistry,
+) -> schema.Type {
+  case property.type_ {
+    // For refs, check if we have a generated input type
+    "ref" -> {
+      case property.ref {
+        option.Some(ref) -> {
+          case dict.get(existing_input_types, ref) {
+            Ok(input_type) -> input_type
+            // Fall back to basic type mapping if no input type exists
+            Error(_) -> type_mapper.map_input_type("ref")
+          }
+        }
+        option.None -> type_mapper.map_input_type("ref")
+      }
+    }
+
+    // For arrays, handle items
+    "array" -> {
+      case property.items {
+        option.Some(types.ArrayItems(item_type, item_ref, _item_refs)) -> {
+          let item_input_type = case item_type {
+            "ref" -> {
+              case item_ref {
+                option.Some(ref) -> {
+                  case dict.get(existing_input_types, ref) {
+                    Ok(input_type) -> input_type
+                    Error(_) -> type_mapper.map_input_type("ref")
+                  }
+                }
+                option.None -> type_mapper.map_input_type("ref")
+              }
+            }
+            _ -> type_mapper.map_input_type(item_type)
+          }
+          schema.list_type(schema.non_null(item_input_type))
+        }
+        option.None -> schema.list_type(schema.non_null(schema.string_type()))
+      }
+    }
+
+    // For unions - handled differently based on variant count
+    // Single-variant: use variant type directly
+    // Multi-variant: caller should use build_multi_variant_union_input
+    "union" -> {
+      case property.refs {
+        option.Some([single_ref]) -> {
+          // Single-variant union: use that variant's input type directly
+          case dict.get(existing_input_types, single_ref) {
+            Ok(input_type) -> input_type
+            Error(_) -> type_mapper.map_input_type("union")
+          }
+        }
+        option.Some(_multiple_refs) -> {
+          // Multi-variant: return placeholder, caller handles this
+          type_mapper.map_input_type("union")
+        }
+        _ -> type_mapper.map_input_type("union")
+      }
+    }
+
+    // Default: use type_mapper
+    other -> type_mapper.map_input_type(other)
+  }
+}
+
+/// Capitalize the first letter of a string
+fn capitalize_first(s: String) -> String {
+  case string.pop_grapheme(s) {
+    Ok(#(first, rest)) -> string.uppercase(first) <> rest
+    Error(_) -> s
+  }
+}
+
+/// Get an input type from the registry by ref
+pub fn get_input_type(
+  registry: UnionRegistry,
+  ref: String,
+) -> Option(schema.Type) {
+  dict.get(registry.input_types, ref) |> option.from_result
+}
+
+/// Check if a union has multiple variants
+pub fn is_multi_variant_union(refs: Option(List(String))) -> Bool {
+  case refs {
+    option.Some([_, _, ..]) -> True
+    _ -> False
+  }
+}
+
+/// Find the ref that matches an enum value
+pub fn enum_value_to_ref(
+  enum_value: String,
+  refs: List(String),
+) -> Option(String) {
+  list.find(refs, fn(ref) { ref_to_variant_enum_value(ref) == enum_value })
+  |> option.from_result
+}

lexicon_graphql/src/lexicon_graphql/internal/lexicon/registry.gleam

···
   registry.object_defs
   |> dict.keys
 }
+
+/// Get all object definitions from the registry
+pub fn get_all_object_defs(registry: Registry) -> Dict(String, types.ObjectDef) {
+  registry.object_defs
+}

lexicon_graphql/src/lexicon_graphql/mutation/builder.gleam

···
 import gleam/list
 import gleam/option
 import lexicon_graphql/internal/graphql/type_mapper
+import lexicon_graphql/internal/graphql/union_input_builder
 import lexicon_graphql/internal/lexicon/nsid
+import lexicon_graphql/internal/lexicon/registry as lexicon_registry
 import lexicon_graphql/types
 import swell/schema
 import swell/value
···
 pub type UploadBlobResolverFactory =
   fn() -> schema.Resolver
 
+/// Result of building mutation type - includes the type and union field registry
+///
+/// The union_registry is used during schema generation to create proper GraphQL
+/// input types for AT Protocol union fields. At runtime, mutation resolvers use
+/// lexicon JSON directly to transform union inputs (matching the blob transformation
+/// pattern), so union_registry is not needed after schema building.
+pub type MutationBuildResult {
+  MutationBuildResult(
+    mutation_type: schema.Type,
+    union_registry: union_input_builder.UnionRegistry,
+  )
+}
+
 /// Build a GraphQL Mutation type from lexicon definitions
 ///
 /// For each record type, generates:
···
 /// - delete{TypeName}(rkey: String!): {TypeName}
 ///
 /// Also adds uploadBlob mutation if upload_blob_factory is provided
+/// Custom fields can be passed to add additional mutations beyond collection-based ones
 ///
 /// Resolver factories are optional - if None, mutations will return errors
+/// Registry parameter enables union input type generation
 pub fn build_mutation_type(
   lexicons: List(types.Lexicon),
   object_types: dict.Dict(String, schema.Type),
···
   update_factory: option.Option(ResolverFactory),
   delete_factory: option.Option(ResolverFactory),
   upload_blob_factory: option.Option(UploadBlobResolverFactory),
-) -> schema.Type {
+  custom_fields: option.Option(List(schema.Field)),
+  registry: option.Option(lexicon_registry.Registry),
+) -> MutationBuildResult {
+  // Build union input types if registry is provided
+  let initial_union_registry = case registry {
+    option.Some(reg) -> union_input_builder.build_union_input_types(reg)
+    option.None ->
+      union_input_builder.UnionRegistry(
+        input_types: dict.new(),
+        field_variants: dict.new(),
+      )
+  }
+
   // Extract record types
   let record_types = extract_record_types(lexicons)
 
-  // Build mutation fields for each record type using complete object types
-  let record_mutation_fields =
-    list.flat_map(record_types, fn(record) {
-      build_mutations_for_record(
-        record,
-        object_types,
-        create_factory,
-        update_factory,
-        delete_factory,
-      )
+  // Build mutation fields for each record type, accumulating union field registrations
+  let #(record_mutation_fields, final_union_registry) =
+    list.fold(record_types, #([], initial_union_registry), fn(acc, record) {
+      let #(fields_acc, registry_acc) = acc
+      let #(new_fields, updated_registry) =
+        build_mutations_for_record(
+          record,
+          object_types,
+          create_factory,
+          update_factory,
+          delete_factory,
+          registry_acc,
+        )
+      #(list.append(fields_acc, new_fields), updated_registry)
     })
 
   // Add uploadBlob mutation if factory is provided
-  let all_mutation_fields = case upload_blob_factory {
+  let with_upload_blob = case upload_blob_factory {
     option.Some(factory) -> {
       let upload_blob_mutation = build_upload_blob_mutation(factory)
       [upload_blob_mutation, ..record_mutation_fields]
···
     option.None -> record_mutation_fields
   }
 
+  // Add custom fields if provided
+  let all_mutation_fields = case custom_fields {
+    option.Some(fields) -> list.append(with_upload_blob, fields)
+    option.None -> with_upload_blob
+  }
+
   // Build the Mutation object type
-  schema.object_type("Mutation", "Root mutation type", all_mutation_fields)
+  let mutation_type =
+    schema.object_type("Mutation", "Root mutation type", all_mutation_fields)
+
+  MutationBuildResult(
+    mutation_type: mutation_type,
+    union_registry: final_union_registry,
+  )
 }
 
 /// Record type info needed for building mutations
···
   create_factory: option.Option(ResolverFactory),
   update_factory: option.Option(ResolverFactory),
   delete_factory: option.Option(ResolverFactory),
-) -> List(schema.Field) {
+  union_registry: union_input_builder.UnionRegistry,
+) -> #(List(schema.Field), union_input_builder.UnionRegistry) {
+  // Build input type and get updated registry with union field mappings
+  let #(input_type, updated_registry) =
+    build_input_type_with_registry(
+      record.type_name <> "Input",
+      record.nsid,
+      record.properties,
+      union_registry,
+    )
+
   let create_mutation =
-    build_create_mutation(record, object_types, create_factory)
+    build_create_mutation(record, object_types, create_factory, input_type)
   let update_mutation =
-    build_update_mutation(record, object_types, update_factory)
+    build_update_mutation(record, object_types, update_factory, input_type)
   let delete_mutation = build_delete_mutation(record, delete_factory)
 
-  [create_mutation, update_mutation, delete_mutation]
+  #([create_mutation, update_mutation, delete_mutation], updated_registry)
 }
 
 /// Build create mutation for a record type
···
   record: RecordInfo,
   object_types: dict.Dict(String, schema.Type),
   factory: option.Option(ResolverFactory),
+  input_type: schema.Type,
 ) -> schema.Field {
   let mutation_name = "create" <> record.type_name
-  let input_type_name = record.type_name <> "Input"
-
-  // Build the input type
-  let input_type = build_input_type(input_type_name, record.properties)
 
   // Get the complete object type from the dict (includes all join fields)
   let assert Ok(return_type) = dict.get(object_types, record.nsid)
···
   record: RecordInfo,
   object_types: dict.Dict(String, schema.Type),
   factory: option.Option(ResolverFactory),
+  input_type: schema.Type,
 ) -> schema.Field {
   let mutation_name = "update" <> record.type_name
-  let input_type_name = record.type_name <> "Input"
-
-  // Build the input type
-  let input_type = build_input_type(input_type_name, record.properties)
 
   // Get the complete object type from the dict (includes all join fields)
   let assert Ok(return_type) = dict.get(object_types, record.nsid)
···
   )
 }
 
-/// Build an InputObjectType from lexicon properties
-fn build_input_type(
+/// Build an InputObjectType and register union fields
+fn build_input_type_with_registry(
   type_name: String,
+  collection: String,
   properties: List(#(String, types.Property)),
-) -> schema.Type {
-  let input_fields =
-    list.map(properties, fn(prop) {
-      let #(name, types.Property(type_, required, _, _, _, _)) = prop
-      // Use map_input_type to get input-compatible types (e.g., BlobInput instead of Blob)
-      let graphql_type = type_mapper.map_input_type(type_)
+  union_registry: union_input_builder.UnionRegistry,
+) -> #(schema.Type, union_input_builder.UnionRegistry) {
+  // Create context for union input type resolution
+  let ctx =
+    type_mapper.UnionInputContext(
+      input_types: union_registry.input_types,
+      parent_type_name: type_name,
+    )
+
+  // Build fields and register union fields
+  let #(input_fields, final_registry) =
+    list.fold(properties, #([], union_registry), fn(acc, prop) {
+      let #(fields_acc, registry_acc) = acc
+      let #(name, types.Property(type_, required, _, ref, refs, items)) = prop
+
+      // Build property for type mapping
+      let property =
+        types.Property(type_, required, option.None, ref, refs, items)
+
+      // Use union-aware type mapping with field name for multi-variant naming
+      let graphql_type =
+        type_mapper.map_input_type_with_unions(property, name, ctx)
+
+      // Register union fields for later transformation
+      let updated_registry = case type_, refs {
+        "union", option.Some(ref_list) -> {
+          union_input_builder.register_union_field(
+            registry_acc,
+            collection,
+            name,
+            ref_list,
+          )
+        }
+        _, _ -> registry_acc
+      }
 
       // Make required fields non-null
       let field_type = case required {
···
         False -> graphql_type
       }
 
-      schema.input_field(
-        name,
-        field_type,
-        "Input field for " <> name,
-        option.None,
-      )
+      let input_field =
+        schema.input_field(
+          name,
+          field_type,
+          "Input field for " <> name,
+          option.None,
+        )
+
+      #([input_field, ..fields_acc], updated_registry)
     })
 
-  schema.input_object_type(
-    type_name,
-    "Input type for " <> type_name,
-    input_fields,
-  )
+  let reversed_fields = list.reverse(input_fields)
+  let input_type =
+    schema.input_object_type(
+      type_name,
+      "Input type for " <> type_name,
+      reversed_fields,
+    )
+
+  #(input_type, final_registry)
 }
 
 /// Build a simple deletion result type that only contains URI

lexicon_graphql/src/lexicon_graphql/schema/builder.gleam

···
       let query_type = build_query_type(record_types, object_types)
 
       // Build the mutation type with stub resolvers, using shared object types
-      let mutation_type =
+      let mutation_build_result =
         mutation_builder.build_mutation_type(
           lexicons,
           object_types,
+          option.None,
+          option.None,
           option.None,
           option.None,
           option.None,
···
         )
 
       // Create the schema with queries and mutations
-      Ok(schema.schema(query_type, option.Some(mutation_type)))
+      Ok(schema.schema(
+        query_type,
+        option.Some(mutation_build_result.mutation_type),
+      ))
     }
   }
 }

lexicon_graphql/src/lexicon_graphql/schema/database.gleam

···
       String,
     )
 
+/// Type for labels batch fetcher function
+/// Takes: list of (URI, optional record JSON) tuples
+/// Returns: dict mapping URI -> List of label values
+pub type LabelsFetcher =
+  fn(List(#(String, option.Option(String)))) ->
+    Result(dict.Dict(String, List(value.Value)), String)
+
 /// Build a GraphQL schema from lexicons with database-backed resolvers
 ///
 /// The fetcher parameter should be a function that queries the database for records with pagination
···
           paginated_batch_fetcher,
           option.None,
           // No viewer state fetcher for basic schema
+          option.None,
+          // No labels fetcher for basic schema
         )
 
       // Build the query type with fields for each record using shared object types
···
           option.None,
           option.None,
           option.None,
+          option.None,
         )
 
       // Build the mutation type with provided resolver factories
       // Pass the complete object types so mutations use the same types as queries
-      let mutation_type =
+      let mutation_build_result =
         mutation_builder.build_mutation_type(
           lexicons,
           object_types,
···
           update_factory,
           delete_factory,
           upload_blob_factory,
+          option.None,
+          option.None,
         )
 
       // Create the schema with both queries and mutations
-      Ok(schema.schema(query_type, option.Some(mutation_type)))
+      Ok(schema.schema(
+        query_type,
+        option.Some(mutation_build_result.mutation_type),
+      ))
     }
   }
 }
···
   viewer_fetcher: option.Option(ViewerFetcher),
   notification_fetcher: option.Option(NotificationFetcher),
   viewer_state_fetcher: option.Option(dataloader.ViewerStateFetcher),
+  labels_fetcher: option.Option(LabelsFetcher),
+  custom_mutation_fields: option.Option(List(schema.Field)),
+  custom_query_fields: option.Option(List(schema.Field)),
 ) -> Result(schema.Schema, String) {
   case lexicons {
     [] -> Error("Cannot build schema from empty lexicon list")
···
           batch_fetcher,
           paginated_batch_fetcher,
           viewer_state_fetcher,
+          labels_fetcher,
         )
 
       // Build notification types if fetcher provided
···
           notification_fetcher,
           notification_union,
           collection_enum,
+          custom_query_fields,
         )
 
       // Build the mutation type
-      let mutation_type =
+      let mutation_build_result =
         mutation_builder.build_mutation_type(
           lexicons,
           object_types,
···
           update_factory,
           delete_factory,
           upload_blob_factory,
+          custom_mutation_fields,
+          option.None,
         )
 
       // Build the subscription type
···
       // Create the schema with queries, mutations, and subscriptions
       Ok(schema.schema_with_subscriptions(
         query_type,
-        option.Some(mutation_type),
+        option.Some(mutation_build_result.mutation_type),
         option.Some(subscription_type),
       ))
     }
···
   batch_fetcher: option.Option(dataloader.BatchFetcher),
   paginated_batch_fetcher: option.Option(dataloader.PaginatedBatchFetcher),
   viewer_state_fetcher: option.Option(dataloader.ViewerStateFetcher),
+  labels_fetcher: option.Option(LabelsFetcher),
 ) -> #(
   List(RecordType),
   dict.Dict(String, schema.Type),
···
           complete_object_types,
         )
 
+      // Replace lexicon's labels field resolver if it exists, otherwise use as-is
+      let enhanced_fields = case
+        has_self_labels_property(record_type.properties)
+      {
+        True ->
+          replace_labels_field_resolver(record_type.fields, labels_fetcher)
+        False -> record_type.fields
+      }
+
+      // Build labels field if labels_fetcher is provided (skipped if lexicon defines it)
+      let labels_field =
+        build_labels_field(labels_fetcher, record_type.properties)
+
       // Combine all fields
       let all_fields =
         list.flatten([
-          record_type.fields,
+          enhanced_fields,
           forward_join_fields,
           reverse_join_fields,
           did_join_fields,
           viewer_fields,
           did_viewer_fields,
+          labels_field,
         ])
 
       RecordType(
···
   notification_fetcher: option.Option(NotificationFetcher),
   notification_union: option.Option(schema.Type),
   collection_enum: option.Option(schema.Type),
+  custom_query_fields: option.Option(List(schema.Field)),
 ) -> schema.Type {
   // Build regular query fields
   let query_fields =
···
       ]
     }
     _, _ -> []
+  }
+
+  // Get custom query fields if provided
+  let custom_fields = case custom_query_fields {
+    option.Some(fields) -> fields
+    option.None -> []
   }
 
   // Combine all query fields
···
       aggregate_query_fields,
       viewer_field,
       notification_fields,
+      custom_fields,
     ])
 
   schema.object_type("Query", "Root query type", all_query_fields)
···
     type_resolver,
   ))
 }
+
+/// Build the Label GraphQL type used for moderation labels
+fn build_label_type() -> schema.Type {
+  schema.object_type("Label", "AT Protocol moderation label", [
+    schema.field("id", schema.non_null(schema.int_type()), "Label ID", fn(ctx) {
+      get_field_from_parent(ctx, "id")
+    }),
+    schema.field(
+      "src",
+      schema.non_null(schema.string_type()),
+      "DID of the label source (labeler)",
+      fn(ctx) { get_field_from_parent(ctx, "src") },
+    ),
+    schema.field(
+      "uri",
+      schema.non_null(schema.string_type()),
+      "AT-URI of the subject",
+      fn(ctx) { get_field_from_parent(ctx, "uri") },
+    ),
+    schema.field(
+      "cid",
+      schema.string_type(),
+      "Optional CID of the subject",
+      fn(ctx) { get_field_from_parent(ctx, "cid") },
+    ),
+    schema.field(
+      "val",
+      schema.non_null(schema.string_type()),
+      "Label value (e.g., '!takedown', 'porn')",
+      fn(ctx) { get_field_from_parent(ctx, "val") },
+    ),
+    schema.field(
+      "neg",
+      schema.non_null(schema.boolean_type()),
+      "True if this is a negation of the label",
+      fn(ctx) { get_field_from_parent(ctx, "neg") },
+    ),
+    schema.field(
+      "cts",
+      schema.non_null(schema.string_type()),
+      "Creation timestamp",
+      fn(ctx) { get_field_from_parent(ctx, "cts") },
+    ),
+    schema.field(
+      "exp",
+      schema.string_type(),
+      "Optional expiration timestamp",
+      fn(ctx) { get_field_from_parent(ctx, "exp") },
+    ),
+  ])
+}
+
+/// Build labels field for record types if labels_fetcher is provided
+/// Returns a list with one field, or empty list if no fetcher
+/// Skips adding the field if the lexicon already defines a labels field with selfLabels
+fn build_labels_field(
+  labels_fetcher: option.Option(LabelsFetcher),
+  properties: List(#(String, types.Property)),
+) -> List(schema.Field) {
+  case labels_fetcher {
+    option.None -> []
+    option.Some(fetcher) -> {
+      // Skip if lexicon already defines a labels field - we'll replace its resolver instead
+      case has_self_labels_property(properties) {
+        True -> []
+        False -> {
+          let label_type = build_label_type()
+          [
+            schema.field(
+              "labels",
+              schema.non_null(schema.list_type(schema.non_null(label_type))),
+              "Moderation labels applied to this record",
+              fn(ctx) {
+                // Get the URI and JSON from the parent record
+                case get_field_from_context(ctx, "uri") {
+                  Ok(uri_str) -> {
+                    let json_opt = case get_field_from_context(ctx, "json") {
+                      Ok(j) -> option.Some(j)
+                      Error(_) -> option.None
+                    }
+                    // Fetch labels for this URI with optional JSON for self-labels
+                    case fetcher([#(uri_str, json_opt)]) {
+                      Ok(results) -> {
+                        case dict.get(results, uri_str) {
+                          Ok(labels) -> Ok(value.List(labels))
+                          Error(_) -> Ok(value.List([]))
+                        }
+                      }
+                      Error(_) -> Ok(value.List([]))
+                    }
+                  }
+                  Error(_) -> Ok(value.List([]))
+                }
+              },
+            ),
+          ]
+        }
+      }
+    }
+  }
+}
+
+/// Check if a record type has a labels property with selfLabels ref
+/// Handles both direct ref and union refs array
+fn has_self_labels_property(properties: List(#(String, types.Property))) -> Bool {
+  list.any(properties, fn(prop) {
+    let #(name, types.Property(_, _, _, ref, refs, _)) = prop
+    case name == "labels" {
+      False -> False
+      True -> {
+        // Check direct ref
+        let has_direct_ref =
+          ref == option.Some("com.atproto.label.defs#selfLabels")
+        // Check union refs array
+        let has_union_ref = case refs {
+          option.Some(ref_list) ->
+            list.contains(ref_list, "com.atproto.label.defs#selfLabels")
+          option.None -> False
+        }
+        has_direct_ref || has_union_ref
+      }
+    }
+  })
+}
+
+/// Replace the labels field resolver with an enhanced version that merges moderator labels
+fn replace_labels_field_resolver(
+  fields: List(schema.Field),
+  labels_fetcher: option.Option(LabelsFetcher),
+) -> List(schema.Field) {
+  case labels_fetcher {
+    option.None -> fields
+    option.Some(fetcher) -> {
+      let label_type = build_label_type()
+      list.map(fields, fn(field) {
+        case schema.field_name(field) == "labels" {
+          False -> field
+          True -> {
+            // Replace with enhanced resolver that fetches moderator labels
+            // Use our Label type instead of the lexicon's selfLabels type
+            schema.field(
+              "labels",
+              schema.non_null(schema.list_type(schema.non_null(label_type))),
+              "Labels applied to this record (self-labels and moderator labels)",
+              fn(ctx) {
+                case get_field_from_context(ctx, "uri") {
+                  Ok(uri_str) -> {
+                    let json_opt = case get_field_from_context(ctx, "json") {
+                      Ok(j) -> option.Some(j)
+                      Error(_) -> option.None
+                    }
+                    case fetcher([#(uri_str, json_opt)]) {
+                      Ok(results) -> {
+                        case dict.get(results, uri_str) {
+                          Ok(labels) -> Ok(value.List(labels))
+                          Error(_) -> Ok(value.List([]))
+                        }
+                      }
+                      Error(_) -> Ok(value.List([]))
+                    }
+                  }
+                  Error(_) -> Ok(value.List([]))
+                }
+              },
+            )
+          }
+        }
+      })
+    }
+  }
+}
+
+/// Helper to get a field value from the parent context
+fn get_field_from_parent(
+  ctx: schema.Context,
+  field_name: String,
+) -> Result(value.Value, String) {
+  case ctx.data {
+    option.Some(value.Object(fields)) -> {
+      case list.key_find(fields, field_name) {
+        Ok(v) -> Ok(v)
+        Error(_) -> Error("Field " <> field_name <> " not found in parent")
+      }
+    }
+    _ -> Error("Parent is not an object")
+  }
+}

lexicon_graphql/test/mutation_builder_test.gleam

···
   }
 
   // Build mutation type with uploadBlob factory
-  let mutation_type =
+  let mutation_build_result =
     mutation_builder.build_mutation_type(
       [],
       dict.new(),
···
       None,
       None,
       Some(upload_factory),
+      None,
+      None,
     )
 
   // Verify the mutation type has uploadBlob field
-  let fields = schema.get_fields(mutation_type)
+  let fields = schema.get_fields(mutation_build_result.mutation_type)
   let has_upload_blob =
     list.any(fields, fn(field) { schema.field_name(field) == "uploadBlob" })
 
···
 /// Test that uploadBlob mutation is NOT added when factory is None
 pub fn build_mutation_type_without_upload_blob_test() {
   // Build mutation type without uploadBlob factory
-  let mutation_type =
-    mutation_builder.build_mutation_type([], dict.new(), None, None, None, None)
+  let mutation_build_result =
+    mutation_builder.build_mutation_type(
+      [],
+      dict.new(),
+      None,
+      None,
+      None,
+      None,
+      None,
+      None,
+    )
 
   // Verify the mutation type does NOT have uploadBlob field
-  let fields = schema.get_fields(mutation_type)
+  let fields = schema.get_fields(mutation_build_result.mutation_type)
   let has_upload_blob =
     list.any(fields, fn(field) { schema.field_name(field) == "uploadBlob" })
 
···
   }
 
   // Build mutation type
-  let mutation_type =
+  let mutation_build_result =
     mutation_builder.build_mutation_type(
       [],
       dict.new(),
···
       None,
       None,
       Some(upload_factory),
+      None,
+      None,
     )
 
   // Get uploadBlob field
-  let fields = schema.get_fields(mutation_type)
+  let fields = schema.get_fields(mutation_build_result.mutation_type)
   let upload_blob_field =
     list.find(fields, fn(field) { schema.field_name(field) == "uploadBlob" })
 
···
     }
   }
 
-  let mutation_type =
+  let mutation_build_result =
     mutation_builder.build_mutation_type(
       [],
       dict.new(),
···
       None,
       None,
       Some(upload_factory),
+      None,
+      None,
     )
 
   // Get uploadBlob field
-  let fields = schema.get_fields(mutation_type)
+  let fields = schema.get_fields(mutation_build_result.mutation_type)
   let upload_blob_field =
     list.find(fields, fn(field) { schema.field_name(field) == "uploadBlob" })
 
···
     }
   }
 
-  let mutation_type =
+  let mutation_build_result =
     mutation_builder.build_mutation_type(
       [],
       dict.new(),
···
       None,
       None,
       Some(upload_factory),
+      None,
+      None,
     )
 
   // Get uploadBlob field
-  let fields = schema.get_fields(mutation_type)
+  let fields = schema.get_fields(mutation_build_result.mutation_type)
   let upload_blob_field =
     list.find(fields, fn(field) { schema.field_name(field) == "uploadBlob" })
 
···
     }
   }
 
-  let mutation_type =
+  let mutation_build_result =
     mutation_builder.build_mutation_type(
       [],
       dict.new(),
···
       None,
       None,
       Some(upload_factory),
+      None,
+      None,
     )
 
   // Get uploadBlob field
-  let fields = schema.get_fields(mutation_type)
+  let fields = schema.get_fields(mutation_build_result.mutation_type)
   let upload_blob_field =
     list.find(fields, fn(field) { schema.field_name(field) == "uploadBlob" })
 
···
     }
   }
 
-  let mutation_type =
+  let mutation_build_result =
     mutation_builder.build_mutation_type(
       [],
       dict.new(),
···
       None,
       None,
       Some(upload_factory),
+      None,
+      None,
     )
 
   // Get uploadBlob field
-  let fields = schema.get_fields(mutation_type)
+  let fields = schema.get_fields(mutation_build_result.mutation_type)
   let upload_blob_field =
     list.find(fields, fn(field) { schema.field_name(field) == "uploadBlob" })
 
···
     }
   }
 
-  let mutation_type =
+  let mutation_build_result =
     mutation_builder.build_mutation_type(
       [],
       dict.new(),
···
       None,
       None,
       Some(upload_factory),
+      None,
+      None,
     )
 
   // Get uploadBlob field
-  let fields = schema.get_fields(mutation_type)
+  let fields = schema.get_fields(mutation_build_result.mutation_type)
   let upload_blob_field =
     list.find(fields, fn(field) { schema.field_name(field) == "uploadBlob" })
 
···
     }
   }
 
-  let mutation_type =
+  let mutation_build_result =
     mutation_builder.build_mutation_type(
       [],
       dict.new(),
···
       None,
       None,
       Some(upload_factory),
+      None,
+      None,
     )
 
   // Get uploadBlob field
-  let fields = schema.get_fields(mutation_type)
+  let fields = schema.get_fields(mutation_build_result.mutation_type)
   let upload_blob_field =
     list.find(fields, fn(field) { schema.field_name(field) == "uploadBlob" })
 
···
     }
   }
 
-  let mutation_type =
+  let mutation_build_result =
     mutation_builder.build_mutation_type(
       [],
       dict.new(),
···
       None,
       None,
       Some(upload_factory),
+      None,
+      None,
     )
 
   // Get uploadBlob field
-  let fields = schema.get_fields(mutation_type)
+  let fields = schema.get_fields(mutation_build_result.mutation_type)
   let upload_blob_field =
     list.find(fields, fn(field) { schema.field_name(field) == "uploadBlob" })
 

lexicon_graphql/test/sorting_test.gleam

···
       option.None,
       option.None,
       option.None,
+      option.None,
+      option.None,
+      option.None,
     )
   {
     Ok(s) -> s

lexicon_graphql/test/subscription_schema_test.gleam

···
       None,
       None,
       None,
-      // aggregate_fetcher
+      None,
+      None,
+      None,
       None,
-      // viewer_fetcher
       None,
-      // notification_fetcher
       None,
-      // viewer_state_fetcher
     )
   {
     Ok(s) -> {
···
       None,
       None,
       None,
-      // aggregate_fetcher
+      None,
+      None,
+      None,
       None,
-      // viewer_fetcher
       None,
-      // notification_fetcher
       None,
-      // viewer_state_fetcher
     )
   {
     Ok(s) -> {
···
       None,
       None,
       None,
-      // aggregate_fetcher
+      None,
+      None,
+      None,
       None,
-      // viewer_fetcher
       None,
-      // notification_fetcher
       None,
-      // viewer_state_fetcher
     )
   {
     Ok(s) -> {
···
       None,
       None,
       None,
-      // aggregate_fetcher
+      None,
+      None,
+      None,
       None,
-      // viewer_fetcher
       None,
-      // notification_fetcher
       None,
-      // viewer_state_fetcher
     )
   {
     Ok(s) -> {
···
       None,
       None,
       None,
-      // aggregate_fetcher
+      None,
+      None,
+      None,
       None,
-      // viewer_fetcher
       None,
-      // notification_fetcher
       None,
-      // viewer_state_fetcher
     )
   {
     Ok(s) -> {

lexicon_graphql/test/union_input_builder_test.gleam

···
+/// Tests for Union Input Builder
+///
+/// Tests the generation of GraphQL input types for AT Protocol union fields
+import gleam/dict
+import gleam/option.{None, Some}
+import gleeunit/should
+import lexicon_graphql/internal/graphql/union_input_builder
+import lexicon_graphql/internal/lexicon/registry
+import lexicon_graphql/types
+import swell/schema
+
+// ─── ref_to_input_type_name Tests ──────────────────────────────────
+
+pub fn ref_to_input_type_name_with_hash_test() {
+  union_input_builder.ref_to_input_type_name(
+    "com.atproto.label.defs#selfLabels",
+  )
+  |> should.equal("ComAtprotoLabelDefsSelfLabelsInput")
+}
+
+pub fn ref_to_input_type_name_without_hash_test() {
+  union_input_builder.ref_to_input_type_name("com.atproto.label.defs")
+  |> should.equal("ComAtprotoLabelDefsInput")
+}
+
+// ─── ref_to_variant_enum_value Tests ───────────────────────────────
+
+pub fn ref_to_variant_enum_value_with_hash_test() {
+  union_input_builder.ref_to_variant_enum_value(
+    "com.atproto.label.defs#selfLabels",
+  )
+  |> should.equal("SELF_LABELS")
+}
+
+pub fn ref_to_variant_enum_value_camel_case_test() {
+  union_input_builder.ref_to_variant_enum_value(
+    "com.example.defs#myVariantType",
+  )
+  |> should.equal("MY_VARIANT_TYPE")
+}
+
+pub fn ref_to_variant_enum_value_single_word_test() {
+  union_input_builder.ref_to_variant_enum_value("com.example.defs#labels")
+  |> should.equal("LABELS")
+}
+
+pub fn ref_to_variant_enum_value_with_numbers_test() {
+  // Numbers are not treated as word boundaries
+  union_input_builder.ref_to_variant_enum_value("com.example.defs#oauth2Client")
+  |> should.equal("OAUTH2_CLIENT")
+}
+
+// ─── ref_to_variant_field_name Tests ───────────────────────────────
+
+pub fn ref_to_variant_field_name_with_hash_test() {
+  union_input_builder.ref_to_variant_field_name(
+    "com.atproto.label.defs#selfLabels",
+  )
+  |> should.equal("selfLabels")
+}
+
+pub fn ref_to_variant_field_name_without_hash_test() {
+  union_input_builder.ref_to_variant_field_name("com.atproto.label.defs")
+  |> should.equal("defs")
+}
+
+// ─── enum_value_to_short_name Tests ────────────────────────────────
+
+pub fn enum_value_to_short_name_multi_word_test() {
+  union_input_builder.enum_value_to_short_name("SELF_LABELS")
+  |> should.equal("selfLabels")
+}
+
+pub fn enum_value_to_short_name_single_word_test() {
+  union_input_builder.enum_value_to_short_name("LABELS")
+  |> should.equal("labels")
+}
+
+pub fn enum_value_to_short_name_three_words_test() {
+  union_input_builder.enum_value_to_short_name("MY_VARIANT_TYPE")
+  |> should.equal("myVariantType")
+}
+
+pub fn enum_value_to_short_name_with_numbers_test() {
+  // Numbers are preserved correctly
+  union_input_builder.enum_value_to_short_name("OAUTH2_CLIENT")
+  |> should.equal("oauth2Client")
+}
+
+// ─── Round-trip Conversion Tests ──────────────────────────────────
+
+pub fn round_trip_camel_to_snake_and_back_test() {
+  // Convert camelCase -> SCREAMING_SNAKE -> camelCase
+  let original = "selfLabels"
+  let snake =
+    union_input_builder.ref_to_variant_enum_value("com.example#" <> original)
+  union_input_builder.enum_value_to_short_name(snake)
+  |> should.equal(original)
+}
+
+pub fn round_trip_with_multiple_words_test() {
+  let original = "myVariantType"
+  let snake =
+    union_input_builder.ref_to_variant_enum_value("com.example#" <> original)
+  union_input_builder.enum_value_to_short_name(snake)
+  |> should.equal(original)
+}
+
+pub fn round_trip_with_numbers_test() {
+  let original = "oauth2Client"
+  let snake =
+    union_input_builder.ref_to_variant_enum_value("com.example#" <> original)
+  union_input_builder.enum_value_to_short_name(snake)
+  |> should.equal(original)
+}
+
+// ─── is_multi_variant_union Tests ──────────────────────────────────
+
+pub fn is_multi_variant_union_with_two_refs_test() {
+  union_input_builder.is_multi_variant_union(Some(["ref1", "ref2"]))
+  |> should.be_true()
+}
+
+pub fn is_multi_variant_union_with_one_ref_test() {
+  union_input_builder.is_multi_variant_union(Some(["ref1"]))
+  |> should.be_false()
+}
+
+pub fn is_multi_variant_union_with_none_test() {
+  union_input_builder.is_multi_variant_union(None)
+  |> should.be_false()
+}
+
+pub fn is_multi_variant_union_with_empty_list_test() {
+  union_input_builder.is_multi_variant_union(Some([]))
+  |> should.be_false()
+}
+
+// ─── enum_value_to_ref Tests ───────────────────────────────────────
+
+pub fn enum_value_to_ref_finds_match_test() {
+  let refs = [
+    "com.atproto.label.defs#selfLabels",
+    "com.example.defs#otherType",
+  ]
+
+  union_input_builder.enum_value_to_ref("SELF_LABELS", refs)
+  |> should.equal(Some("com.atproto.label.defs#selfLabels"))
+}
+
+pub fn enum_value_to_ref_no_match_test() {
+  let refs = [
+    "com.atproto.label.defs#selfLabels",
+    "com.example.defs#otherType",
+  ]
+
+  union_input_builder.enum_value_to_ref("UNKNOWN_TYPE", refs)
+  |> should.equal(None)
+}
+
+// ─── UnionRegistry Tests ───────────────────────────────────────────
+
+pub fn register_union_field_stores_refs_test() {
+  let initial_registry =
+    union_input_builder.UnionRegistry(
+      input_types: dict.new(),
+      field_variants: dict.new(),
+    )
+
+  let updated_registry =
+    union_input_builder.register_union_field(
+      initial_registry,
+      "social.grain.gallery",
+      "labels",
+      ["com.atproto.label.defs#selfLabels"],
+    )
+
+  union_input_builder.get_union_refs(
+    updated_registry,
+    "social.grain.gallery",
+    "labels",
+  )
+  |> should.equal(Some(["com.atproto.label.defs#selfLabels"]))
+}
+
+pub fn get_union_refs_returns_none_for_missing_field_test() {
+  let empty_registry =
+    union_input_builder.UnionRegistry(
+      input_types: dict.new(),
+      field_variants: dict.new(),
+    )
+
+  union_input_builder.get_union_refs(empty_registry, "unknown", "field")
+  |> should.equal(None)
+}
+
+// ─── build_multi_variant_union_input Tests ─────────────────────────
+
+pub fn build_multi_variant_union_input_creates_type_with_discriminator_test() {
+  let refs = [
+    "com.atproto.label.defs#selfLabels",
+    "com.example.defs#otherLabels",
+  ]
+
+  let union_type =
+    union_input_builder.build_multi_variant_union_input(
+      "GalleryInput",
+      "labels",
+      refs,
+      dict.new(),
+    )
+
+  // Verify it's an input object type
+  schema.is_input_object(union_type)
+  |> should.be_true()
+
+  // Verify the type name
+  schema.type_name(union_type)
+  |> should.equal("GalleryInputLabelsInput")
+}
+
+// ─── build_union_input_types with lexicons Tests ───────────────────
+
+pub fn build_union_input_types_from_empty_lexicons_test() {
+  // Create a registry from empty lexicons
+  let empty_registry = registry.from_lexicons([])
+
+  let union_registry =
+    union_input_builder.build_union_input_types(empty_registry)
+
+  // Should have empty input_types and field_variants
+  dict.size(union_registry.input_types)
+  |> should.equal(0)
+
+  dict.size(union_registry.field_variants)
+  |> should.equal(0)
+}
+
+pub fn build_union_input_types_generates_input_for_object_def_test() {
+  // Create a lexicon with an object def in "others"
+  let obj_def =
+    types.ObjectDef(type_: "object", required_fields: ["values"], properties: [
+      #(
+        "values",
+        types.Property(
+          type_: "array",
+          required: True,
+          format: None,
+          ref: None,
+          refs: None,
+          items: Some(types.ArrayItems(type_: "string", ref: None, refs: None)),
+        ),
+      ),
+    ])
+
+  let lexicon =
+    types.Lexicon(
+      id: "com.atproto.label.defs",
+      defs: types.Defs(
+        main: None,
+        others: dict.from_list([#("selfLabels", types.Object(obj_def))]),
+      ),
+    )
+
+  let reg = registry.from_lexicons([lexicon])
+  let union_registry = union_input_builder.build_union_input_types(reg)
+
+  // Should have an input type for the ref
+  union_input_builder.get_input_type(
+    union_registry,
+    "com.atproto.label.defs#selfLabels",
+  )
+  |> option.is_some
+  |> should.be_true()
+}

lexicon_graphql/test/union_input_test.gleam

···
+/// Tests for Union Input
+///
+/// Tests the transformation of GraphQL discriminated union inputs
+/// to AT Protocol $type format.
+import gleeunit/should
+import lexicon_graphql/input/union as union_input
+import swell/value
+
+// ─── transform_union_object Tests ──────────────────────────────────
+
+pub fn transform_union_object_with_enum_type_test() {
+  // GraphQL input format with enum discriminator
+  let fields = [
+    #("type", value.Enum("SELF_LABELS")),
+    #(
+      "selfLabels",
+      value.Object([
+        #("values", value.List([value.String("!no-unauthenticated")])),
+      ]),
+    ),
+  ]
+  let refs = ["com.atproto.label.defs#selfLabels"]
+
+  let result = union_input.transform_union_object(fields, refs)
+
+  // Should transform to AT Protocol format
+  result
+  |> should.equal(
+    value.Object([
+      #("$type", value.String("com.atproto.label.defs#selfLabels")),
+      #("values", value.List([value.String("!no-unauthenticated")])),
+    ]),
+  )
+}
+
+pub fn transform_union_object_with_string_type_test() {
+  // GraphQL input format with string discriminator (fallback)
+  let fields = [
+    #("type", value.String("SELF_LABELS")),
+    #("selfLabels", value.Object([#("values", value.List([]))])),
+  ]
+  let refs = ["com.atproto.label.defs#selfLabels"]
+
+  let result = union_input.transform_union_object(fields, refs)
+
+  result
+  |> should.equal(
+    value.Object([
+      #("$type", value.String("com.atproto.label.defs#selfLabels")),
+      #("values", value.List([])),
+    ]),
+  )
+}
+
+pub fn transform_union_object_multi_variant_test() {
+  // Test with multiple possible refs
+  let fields = [
+    #("type", value.Enum("OTHER_LABELS")),
+    #("otherLabels", value.Object([#("data", value.String("test"))])),
+    #("selfLabels", value.Null),
+  ]
+  let refs = [
+    "com.atproto.label.defs#selfLabels",
+    "com.example.defs#otherLabels",
+  ]
+
+  let result = union_input.transform_union_object(fields, refs)
+
+  result
+  |> should.equal(
+    value.Object([
+      #("$type", value.String("com.example.defs#otherLabels")),
+      #("data", value.String("test")),
+    ]),
+  )
+}
+
+pub fn transform_union_object_no_variant_data_test() {
+  // When variant field is missing or not an object
+  let fields = [#("type", value.Enum("SELF_LABELS"))]
+  let refs = ["com.atproto.label.defs#selfLabels"]
+
+  let result = union_input.transform_union_object(fields, refs)
+
+  // Should still output $type
+  result
+  |> should.equal(
+    value.Object([#("$type", value.String("com.atproto.label.defs#selfLabels"))]),
+  )
+}
+
+pub fn transform_union_object_unknown_type_test() {
+  // When type doesn't match any ref
+  let fields = [
+    #("type", value.Enum("UNKNOWN_TYPE")),
+    #("someData", value.String("test")),
+  ]
+  let refs = ["com.atproto.label.defs#selfLabels"]
+
+  let result = union_input.transform_union_object(fields, refs)
+
+  // Should return original fields unchanged
+  result
+  |> should.equal(value.Object(fields))
+}
+
+pub fn transform_union_object_no_type_field_test() {
+  // When there's no type discriminator
+  let fields = [#("someField", value.String("value"))]
+  let refs = ["com.atproto.label.defs#selfLabels"]
+
+  let result = union_input.transform_union_object(fields, refs)
+
+  // Should return original fields unchanged
+  result
+  |> should.equal(value.Object(fields))
+}
+
+pub fn transform_union_object_with_numbers_in_name_test() {
+  // Test edge case with numbers in variant name
+  let fields = [
+    #("type", value.Enum("OAUTH2_CLIENT")),
+    #("oauth2Client", value.Object([#("id", value.String("client123"))])),
+  ]
+  let refs = ["com.example.oauth#oauth2Client"]
+
+  let result = union_input.transform_union_object(fields, refs)
+
+  result
+  |> should.equal(
+    value.Object([
+      #("$type", value.String("com.example.oauth#oauth2Client")),
+      #("id", value.String("client123")),
+    ]),
+  )
+}

lexicon_graphql/test/where_schema_test.gleam

···
       option.None,
       option.None,
       option.None,
+      option.None,
+      option.None,
+      option.None,
     )
   {
     Ok(s) -> s

server/db/migrations/20251229000001_add_labels_and_reports.sql

···
+-- migrate:up
+
+-- =============================================================================
+-- Label Definition Table
+-- =============================================================================
+
+-- Defines available label values for this instance
+CREATE TABLE IF NOT EXISTS label_definition (
+  val TEXT PRIMARY KEY NOT NULL,
+  description TEXT NOT NULL,
+  severity TEXT NOT NULL CHECK (severity IN ('inform', 'alert', 'takedown')),
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+-- Seed default label definitions (Bluesky-compatible)
+INSERT INTO label_definition (val, description, severity) VALUES
+  ('!takedown', 'Content removed by moderators', 'takedown'),
+  ('!suspend', 'Account suspended', 'takedown'),
+  ('!warn', 'Show warning before displaying', 'alert'),
+  ('!hide', 'Hide from feeds (still accessible via direct link)', 'alert'),
+  ('porn', 'Pornographic content', 'alert'),
+  ('sexual', 'Sexually suggestive content', 'alert'),
+  ('nudity', 'Non-sexual nudity', 'alert'),
+  ('gore', 'Graphic violence or gore', 'alert'),
+  ('graphic-media', 'Disturbing or graphic media', 'alert'),
+  ('impersonation', 'Account impersonating someone', 'inform'),
+  ('spam', 'Spam or unwanted content', 'inform');
+
+-- =============================================================================
+-- Label Table
+-- =============================================================================
+
+-- Applied labels on records/accounts
+CREATE TABLE IF NOT EXISTS label (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  src TEXT NOT NULL,
+  uri TEXT NOT NULL,
+  cid TEXT,
+  val TEXT NOT NULL,
+  neg INTEGER NOT NULL DEFAULT 0,
+  cts TEXT NOT NULL DEFAULT (datetime('now')),
+  exp TEXT,
+  FOREIGN KEY (val) REFERENCES label_definition(val)
+);
+
+CREATE INDEX IF NOT EXISTS idx_label_uri ON label(uri);
+CREATE INDEX IF NOT EXISTS idx_label_val ON label(val);
+CREATE INDEX IF NOT EXISTS idx_label_src ON label(src);
+CREATE INDEX IF NOT EXISTS idx_label_cts ON label(cts DESC);
+-- Composite index for takedown queries (uri + val + neg)
+CREATE INDEX IF NOT EXISTS idx_label_takedown ON label(uri, val, neg);
+
+-- =============================================================================
+-- Report Table
+-- =============================================================================
+
+-- User-submitted reports awaiting review
+CREATE TABLE IF NOT EXISTS report (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  reporter_did TEXT NOT NULL,
+  subject_uri TEXT NOT NULL,
+  reason_type TEXT NOT NULL CHECK (reason_type IN ('spam', 'violation', 'misleading', 'sexual', 'rude', 'other')),
+  reason TEXT,
+  status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'resolved', 'dismissed')),
+  resolved_by TEXT,
+  resolved_at TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  -- Prevent duplicate reports from same user for same content
+  UNIQUE(reporter_did, subject_uri)
+);
+
+CREATE INDEX IF NOT EXISTS idx_report_status ON report(status);
+CREATE INDEX IF NOT EXISTS idx_report_subject_uri ON report(subject_uri);
+CREATE INDEX IF NOT EXISTS idx_report_reporter_did ON report(reporter_did);
+CREATE INDEX IF NOT EXISTS idx_report_created_at ON report(created_at DESC);
+
+-- migrate:down
+
+DROP TABLE IF EXISTS report;
+DROP TABLE IF EXISTS label;
+DROP TABLE IF EXISTS label_definition;

server/db/migrations/20251230000001_add_label_preferences.sql

···
+-- migrate:up
+
+-- Add default_visibility to label_definition
+ALTER TABLE label_definition ADD COLUMN default_visibility TEXT NOT NULL DEFAULT 'warn';
+
+-- Set appropriate defaults for specific labels
+-- porn should hide by default, while other content warnings should show a warning
+UPDATE label_definition SET default_visibility = 'hide' WHERE val = 'porn';
+
+-- Create actor_label_preferences table
+CREATE TABLE IF NOT EXISTS actor_label_preference (
+  did TEXT NOT NULL,
+  label_val TEXT NOT NULL,
+  visibility TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  PRIMARY KEY (did, label_val)
+);
+
+-- Index for fast lookups by user
+CREATE INDEX IF NOT EXISTS idx_actor_label_preference_did ON actor_label_preference(did);
+
+-- migrate:down
+
+DROP INDEX IF EXISTS idx_actor_label_preference_did;
+DROP TABLE IF EXISTS actor_label_preference;
+-- Note: SQLite doesn't support DROP COLUMN, would need table recreation

server/db/migrations_postgres/20251229000001_add_labels_and_reports.sql

···
+-- migrate:up
+
+-- =============================================================================
+-- Label Definition Table
+-- =============================================================================
+
+-- Defines available label values for this instance
+CREATE TABLE IF NOT EXISTS label_definition (
+  val TEXT PRIMARY KEY NOT NULL,
+  description TEXT NOT NULL,
+  severity TEXT NOT NULL CHECK (severity IN ('inform', 'alert', 'takedown')),
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+-- Seed default label definitions (Bluesky-compatible)
+INSERT INTO label_definition (val, description, severity) VALUES
+  ('!takedown', 'Content removed by moderators', 'takedown'),
+  ('!suspend', 'Account suspended', 'takedown'),
+  ('!warn', 'Show warning before displaying', 'alert'),
+  ('!hide', 'Hide from feeds (still accessible via direct link)', 'alert'),
+  ('porn', 'Pornographic content', 'alert'),
+  ('sexual', 'Sexually suggestive content', 'alert'),
+  ('nudity', 'Non-sexual nudity', 'alert'),
+  ('gore', 'Graphic violence or gore', 'alert'),
+  ('graphic-media', 'Disturbing or graphic media', 'alert'),
+  ('impersonation', 'Account impersonating someone', 'inform'),
+  ('spam', 'Spam or unwanted content', 'inform');
+
+-- =============================================================================
+-- Label Table
+-- =============================================================================
+
+-- Applied labels on records/accounts
+CREATE TABLE IF NOT EXISTS label (
+  id SERIAL PRIMARY KEY,
+  src TEXT NOT NULL,
+  uri TEXT NOT NULL,
+  cid TEXT,
+  val TEXT NOT NULL,
+  neg BOOLEAN NOT NULL DEFAULT FALSE,
+  cts TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  exp TIMESTAMP WITH TIME ZONE,
+  FOREIGN KEY (val) REFERENCES label_definition(val)
+);
+
+CREATE INDEX IF NOT EXISTS idx_label_uri ON label(uri);
+CREATE INDEX IF NOT EXISTS idx_label_val ON label(val);
+CREATE INDEX IF NOT EXISTS idx_label_src ON label(src);
+CREATE INDEX IF NOT EXISTS idx_label_cts ON label(cts DESC);
+-- Composite index for takedown queries (uri + val + neg)
+CREATE INDEX IF NOT EXISTS idx_label_takedown ON label(uri, val, neg);
+
+-- =============================================================================
+-- Report Table
+-- =============================================================================
+
+-- User-submitted reports awaiting review
+CREATE TABLE IF NOT EXISTS report (
+  id SERIAL PRIMARY KEY,
+  reporter_did TEXT NOT NULL,
+  subject_uri TEXT NOT NULL,
+  reason_type TEXT NOT NULL CHECK (reason_type IN ('spam', 'violation', 'misleading', 'sexual', 'rude', 'other')),
+  reason TEXT,
+  status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'resolved', 'dismissed')),
+  resolved_by TEXT,
+  resolved_at TIMESTAMP WITH TIME ZONE,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  -- Prevent duplicate reports from same user for same content
+  UNIQUE(reporter_did, subject_uri)
+);
+
+CREATE INDEX IF NOT EXISTS idx_report_status ON report(status);
+CREATE INDEX IF NOT EXISTS idx_report_subject_uri ON report(subject_uri);
+CREATE INDEX IF NOT EXISTS idx_report_reporter_did ON report(reporter_did);
+CREATE INDEX IF NOT EXISTS idx_report_created_at ON report(created_at DESC);
+
+-- migrate:down
+
+DROP TABLE IF EXISTS report;
+DROP TABLE IF EXISTS label;
+DROP TABLE IF EXISTS label_definition;

server/db/migrations_postgres/20251230000001_add_label_preferences.sql

···
+-- migrate:up
+
+-- Add default_visibility to label_definition
+ALTER TABLE label_definition ADD COLUMN default_visibility TEXT NOT NULL DEFAULT 'warn';
+
+-- Set appropriate defaults for specific labels
+-- porn should hide by default, while other content warnings should show a warning
+UPDATE label_definition SET default_visibility = 'hide' WHERE val = 'porn';
+
+-- Create actor_label_preferences table
+CREATE TABLE IF NOT EXISTS actor_label_preference (
+  did TEXT NOT NULL,
+  label_val TEXT NOT NULL,
+  visibility TEXT NOT NULL,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  PRIMARY KEY (did, label_val)
+);
+
+-- Index for fast lookups by user
+CREATE INDEX IF NOT EXISTS idx_actor_label_preference_did ON actor_label_preference(did);
+
+-- migrate:down
+
+DROP INDEX IF EXISTS idx_actor_label_preference_did;
+DROP TABLE IF EXISTS actor_label_preference;
+ALTER TABLE label_definition DROP COLUMN default_visibility;

server/db/schema.sql

···
   created_at INTEGER NOT NULL DEFAULT (unixepoch())
 );
 CREATE INDEX idx_admin_session_atp_session_id ON admin_session(atp_session_id);
+CREATE TABLE label_definition (
+  val TEXT PRIMARY KEY NOT NULL,
+  description TEXT NOT NULL,
+  severity TEXT NOT NULL CHECK (severity IN ('inform', 'alert', 'takedown')),
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+, default_visibility TEXT NOT NULL DEFAULT 'warn');
+CREATE TABLE label (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  src TEXT NOT NULL,
+  uri TEXT NOT NULL,
+  cid TEXT,
+  val TEXT NOT NULL,
+  neg INTEGER NOT NULL DEFAULT 0,
+  cts TEXT NOT NULL DEFAULT (datetime('now')),
+  exp TEXT,
+  FOREIGN KEY (val) REFERENCES label_definition(val)
+);
+CREATE INDEX idx_label_uri ON label(uri);
+CREATE INDEX idx_label_val ON label(val);
+CREATE INDEX idx_label_src ON label(src);
+CREATE INDEX idx_label_cts ON label(cts DESC);
+CREATE INDEX idx_label_takedown ON label(uri, val, neg);
+CREATE TABLE report (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  reporter_did TEXT NOT NULL,
+  subject_uri TEXT NOT NULL,
+  reason_type TEXT NOT NULL CHECK (reason_type IN ('spam', 'violation', 'misleading', 'sexual', 'rude', 'other')),
+  reason TEXT,
+  status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'resolved', 'dismissed')),
+  resolved_by TEXT,
+  resolved_at TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  -- Prevent duplicate reports from same user for same content
+  UNIQUE(reporter_did, subject_uri)
+);
+CREATE INDEX idx_report_status ON report(status);
+CREATE INDEX idx_report_subject_uri ON report(subject_uri);
+CREATE INDEX idx_report_reporter_did ON report(reporter_did);
+CREATE INDEX idx_report_created_at ON report(created_at DESC);
+CREATE TABLE actor_label_preference (
+  did TEXT NOT NULL,
+  label_val TEXT NOT NULL,
+  visibility TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  PRIMARY KEY (did, label_val)
+);
+CREATE INDEX idx_actor_label_preference_did ON actor_label_preference(did);
 -- Dbmate schema migrations
 INSERT INTO "schema_migrations" (version) VALUES
   ('20241210000001'),
-  ('20241227000001');
+  ('20241227000001'),
+  ('20251229000001'),
+  ('20251230000001');

server/src/database/repositories/label_definitions.gleam

···
+/// Repository for label definitions
+import database/executor.{type DbError, type Executor, Text}
+import gleam/dynamic/decode
+import gleam/list
+import gleam/option.{type Option, None, Some}
+import gleam/string
+
+/// Valid visibility values for label preferences
+pub const valid_visibilities = ["ignore", "show", "warn", "hide"]
+
+/// Validate a visibility value
+/// Returns Ok(visibility) if valid, Error with message if invalid
+pub fn validate_visibility(visibility: String) -> Result(String, String) {
+  case list.contains(valid_visibilities, visibility) {
+    True -> Ok(visibility)
+    False ->
+      Error(
+        "Invalid visibility. Must be one of: "
+        <> string.join(valid_visibilities, ", "),
+      )
+  }
+}
+
+/// Label definition domain type
+pub type LabelDefinition {
+  LabelDefinition(
+    val: String,
+    description: String,
+    severity: String,
+    default_visibility: String,
+    created_at: String,
+  )
+}
+
+/// Get all label definitions
+pub fn get_all(exec: Executor) -> Result(List(LabelDefinition), DbError) {
+  let sql = case executor.dialect(exec) {
+    executor.SQLite ->
+      "SELECT val, description, severity, default_visibility, created_at FROM label_definition ORDER BY val"
+    executor.PostgreSQL ->
+      "SELECT val, description, severity, default_visibility, created_at::text FROM label_definition ORDER BY val"
+  }
+  executor.query(exec, sql, [], label_definition_decoder())
+}
+
+/// Get all non-system label definitions (excludes labels starting with !)
+pub fn get_non_system(exec: Executor) -> Result(List(LabelDefinition), DbError) {
+  let sql = case executor.dialect(exec) {
+    executor.SQLite ->
+      "SELECT val, description, severity, default_visibility, created_at FROM label_definition WHERE val NOT LIKE '!%' ORDER BY val"
+    executor.PostgreSQL ->
+      "SELECT val, description, severity, default_visibility, created_at::text FROM label_definition WHERE val NOT LIKE '!%' ORDER BY val"
+  }
+  executor.query(exec, sql, [], label_definition_decoder())
+}
+
+/// Get a label definition by value
+pub fn get(
+  exec: Executor,
+  val: String,
+) -> Result(Option(LabelDefinition), DbError) {
+  let sql = case executor.dialect(exec) {
+    executor.SQLite ->
+      "SELECT val, description, severity, default_visibility, created_at FROM label_definition WHERE val = "
+      <> executor.placeholder(exec, 1)
+    executor.PostgreSQL ->
+      "SELECT val, description, severity, default_visibility, created_at::text FROM label_definition WHERE val = "
+      <> executor.placeholder(exec, 1)
+  }
+  case executor.query(exec, sql, [Text(val)], label_definition_decoder()) {
+    Ok([def]) -> Ok(Some(def))
+    Ok(_) -> Ok(None)
+    Error(e) -> Error(e)
+  }
+}
+
+/// Insert a new label definition
+pub fn insert(
+  exec: Executor,
+  val: String,
+  description: String,
+  severity: String,
+  default_visibility: String,
+) -> Result(Nil, DbError) {
+  let p1 = executor.placeholder(exec, 1)
+  let p2 = executor.placeholder(exec, 2)
+  let p3 = executor.placeholder(exec, 3)
+  let p4 = executor.placeholder(exec, 4)
+  let sql =
+    "INSERT INTO label_definition (val, description, severity, default_visibility) VALUES ("
+    <> p1
+    <> ", "
+    <> p2
+    <> ", "
+    <> p3
+    <> ", "
+    <> p4
+    <> ")"
+  executor.exec(exec, sql, [
+    Text(val),
+    Text(description),
+    Text(severity),
+    Text(default_visibility),
+  ])
+}
+
+/// Check if a label value exists
+pub fn exists(exec: Executor, val: String) -> Result(Bool, DbError) {
+  case get(exec, val) {
+    Ok(Some(_)) -> Ok(True)
+    Ok(None) -> Ok(False)
+    Error(e) -> Error(e)
+  }
+}
+
+/// Decoder for LabelDefinition
+fn label_definition_decoder() -> decode.Decoder(LabelDefinition) {
+  use val <- decode.field(0, decode.string)
+  use description <- decode.field(1, decode.string)
+  use severity <- decode.field(2, decode.string)
+  use default_visibility <- decode.field(3, decode.string)
+  use created_at <- decode.field(4, decode.string)
+  decode.success(LabelDefinition(
+    val:,
+    description:,
+    severity:,
+    default_visibility:,
+    created_at:,
+  ))
+}

server/src/database/repositories/label_preferences.gleam

···
+/// Repository for actor label preferences
+import database/executor.{type DbError, type Executor, Text}
+import gleam/dynamic/decode
+import gleam/option.{type Option, None, Some}
+
+/// A label preference record
+pub type LabelPreference {
+  LabelPreference(
+    did: String,
+    label_val: String,
+    visibility: String,
+    created_at: String,
+  )
+}
+
+/// Get all preferences for a user
+pub fn get_by_did(
+  exec: Executor,
+  did: String,
+) -> Result(List(LabelPreference), DbError) {
+  let p1 = executor.placeholder(exec, 1)
+  let sql = case executor.dialect(exec) {
+    executor.SQLite ->
+      "SELECT did, label_val, visibility, created_at FROM actor_label_preference WHERE did = "
+      <> p1
+    executor.PostgreSQL ->
+      "SELECT did, label_val, visibility, created_at::text FROM actor_label_preference WHERE did = "
+      <> p1
+  }
+
+  executor.query(exec, sql, [Text(did)], preference_decoder())
+}
+
+/// Get a specific preference
+pub fn get(
+  exec: Executor,
+  did: String,
+  label_val: String,
+) -> Result(Option(LabelPreference), DbError) {
+  let p1 = executor.placeholder(exec, 1)
+  let p2 = executor.placeholder(exec, 2)
+  let sql = case executor.dialect(exec) {
+    executor.SQLite ->
+      "SELECT did, label_val, visibility, created_at FROM actor_label_preference WHERE did = "
+      <> p1
+      <> " AND label_val = "
+      <> p2
+    executor.PostgreSQL ->
+      "SELECT did, label_val, visibility, created_at::text FROM actor_label_preference WHERE did = "
+      <> p1
+      <> " AND label_val = "
+      <> p2
+  }
+
+  case
+    executor.query(
+      exec,
+      sql,
+      [Text(did), Text(label_val)],
+      preference_decoder(),
+    )
+  {
+    Ok([pref]) -> Ok(Some(pref))
+    Ok(_) -> Ok(None)
+    Error(e) -> Error(e)
+  }
+}
+
+/// Set a preference (upsert)
+pub fn set(
+  exec: Executor,
+  did: String,
+  label_val: String,
+  visibility: String,
+) -> Result(LabelPreference, DbError) {
+  let p1 = executor.placeholder(exec, 1)
+  let p2 = executor.placeholder(exec, 2)
+  let p3 = executor.placeholder(exec, 3)
+
+  let sql = case executor.dialect(exec) {
+    executor.SQLite ->
+      "INSERT INTO actor_label_preference (did, label_val, visibility) VALUES ("
+      <> p1
+      <> ", "
+      <> p2
+      <> ", "
+      <> p3
+      <> ") ON CONFLICT(did, label_val) DO UPDATE SET visibility = excluded.visibility RETURNING did, label_val, visibility, created_at"
+    executor.PostgreSQL ->
+      "INSERT INTO actor_label_preference (did, label_val, visibility) VALUES ("
+      <> p1
+      <> ", "
+      <> p2
+      <> ", "
+      <> p3
+      <> ") ON CONFLICT(did, label_val) DO UPDATE SET visibility = excluded.visibility RETURNING did, label_val, visibility, created_at::text"
+  }
+
+  case
+    executor.query(
+      exec,
+      sql,
+      [Text(did), Text(label_val), Text(visibility)],
+      preference_decoder(),
+    )
+  {
+    Ok([pref]) -> Ok(pref)
+    Ok(_) -> Error(executor.QueryError("Set did not return preference"))
+    Error(e) -> Error(e)
+  }
+}
+
+/// Delete a preference (reset to default)
+pub fn delete(
+  exec: Executor,
+  did: String,
+  label_val: String,
+) -> Result(Nil, DbError) {
+  let p1 = executor.placeholder(exec, 1)
+  let p2 = executor.placeholder(exec, 2)
+  let sql =
+    "DELETE FROM actor_label_preference WHERE did = "
+    <> p1
+    <> " AND label_val = "
+    <> p2
+
+  executor.exec(exec, sql, [Text(did), Text(label_val)])
+}
+
+/// Decoder for LabelPreference
+fn preference_decoder() -> decode.Decoder(LabelPreference) {
+  use did <- decode.field(0, decode.string)
+  use label_val <- decode.field(1, decode.string)
+  use visibility <- decode.field(2, decode.string)
+  use created_at <- decode.field(3, decode.string)
+  decode.success(LabelPreference(did:, label_val:, visibility:, created_at:))
+}

server/src/database/repositories/labels.gleam

···
+/// Repository for labels
+import database/executor.{
+  type DbError, type Executor, type Value, Int, Null, Text,
+}
+import gleam/dynamic/decode
+import gleam/list
+import gleam/option.{type Option, None, Some}
+import gleam/string
+
+/// Validate that a URI is a valid AT Protocol subject URI
+/// Valid formats:
+/// - at://did:xxx/collection/rkey (record URI)
+/// - did:plc:xxx or did:web:xxx (account DID)
+pub fn is_valid_subject_uri(uri: String) -> Bool {
+  case string.starts_with(uri, "at://") {
+    True -> {
+      // AT URI format: at://did/collection/rkey
+      let without_prefix = string.drop_start(uri, 5)
+      case string.split(without_prefix, "/") {
+        [did, _collection, _rkey] -> string.starts_with(did, "did:")
+        [did, _collection] -> string.starts_with(did, "did:")
+        _ -> False
+      }
+    }
+    False -> {
+      // Allow bare DIDs for account labels
+      string.starts_with(uri, "did:plc:") || string.starts_with(uri, "did:web:")
+    }
+  }
+}
+
+/// Label domain type
+pub type Label {
+  Label(
+    id: Int,
+    src: String,
+    uri: String,
+    cid: Option(String),
+    val: String,
+    neg: Bool,
+    cts: String,
+    exp: Option(String),
+  )
+}
+
+/// Insert a new label
+pub fn insert(
+  exec: Executor,
+  src: String,
+  uri: String,
+  cid: Option(String),
+  val: String,
+  exp: Option(String),
+) -> Result(Label, DbError) {
+  let p1 = executor.placeholder(exec, 1)
+  let p2 = executor.placeholder(exec, 2)
+  let p3 = executor.placeholder(exec, 3)
+  let p4 = executor.placeholder(exec, 4)
+  let p5 = executor.placeholder(exec, 5)
+
+  let cid_value = case cid {
+    Some(c) -> Text(c)
+    None -> Null
+  }
+  let exp_value = case exp {
+    Some(e) -> Text(e)
+    None -> Null
+  }
+
+  let sql = case executor.dialect(exec) {
+    executor.SQLite ->
+      "INSERT INTO label (src, uri, cid, val, exp) VALUES ("
+      <> p1
+      <> ", "
+      <> p2
+      <> ", "
+      <> p3
+      <> ", "
+      <> p4
+      <> ", "
+      <> p5
+      <> ") RETURNING id, src, uri, cid, val, neg, cts, exp"
+    executor.PostgreSQL ->
+      "INSERT INTO label (src, uri, cid, val, exp) VALUES ("
+      <> p1
+      <> ", "
+      <> p2
+      <> ", "
+      <> p3
+      <> ", "
+      <> p4
+      <> ", "
+      <> p5
+      <> ") RETURNING id, src, uri, cid, val, neg::int, cts::text, exp::text"
+  }
+
+  case
+    executor.query(
+      exec,
+      sql,
+      [Text(src), Text(uri), cid_value, Text(val), exp_value],
+      label_decoder(),
+    )
+  {
+    Ok([label]) -> Ok(label)
+    Ok(_) -> Error(executor.QueryError("Insert did not return label"))
+    Error(e) -> Error(e)
+  }
+}
+
+/// Insert a negation label (retraction)
+pub fn insert_negation(
+  exec: Executor,
+  src: String,
+  uri: String,
+  val: String,
+) -> Result(Label, DbError) {
+  let p1 = executor.placeholder(exec, 1)
+  let p2 = executor.placeholder(exec, 2)
+  let p3 = executor.placeholder(exec, 3)
+
+  let sql = case executor.dialect(exec) {
+    executor.SQLite ->
+      "INSERT INTO label (src, uri, val, neg) VALUES ("
+      <> p1
+      <> ", "
+      <> p2
+      <> ", "
+      <> p3
+      <> ", 1) RETURNING id, src, uri, cid, val, neg, cts, exp"
+    executor.PostgreSQL ->
+      "INSERT INTO label (src, uri, val, neg) VALUES ("
+      <> p1
+      <> ", "
+      <> p2
+      <> ", "
+      <> p3
+      <> ", TRUE) RETURNING id, src, uri, cid, val, neg::int, cts::text, exp::text"
+  }
+
+  case
+    executor.query(
+      exec,
+      sql,
+      [Text(src), Text(uri), Text(val)],
+      label_decoder(),
+    )
+  {
+    Ok([label]) -> Ok(label)
+    Ok(_) -> Error(executor.QueryError("Insert did not return label"))
+    Error(e) -> Error(e)
+  }
+}
+
+/// Get labels for a list of URIs (batch fetch for GraphQL)
+/// Returns only active labels (non-negated, non-expired, and not retracted by a later negation)
+pub fn get_by_uris(
+  exec: Executor,
+  uris: List(String),
+) -> Result(List(Label), DbError) {
+  case uris {
+    [] -> Ok([])
+    _ -> {
+      let placeholders = executor.placeholders(exec, list.length(uris), 1)
+      // Exclude labels that have been retracted by a subsequent negation label
+      // Use (cts, id) for ordering to handle same-timestamp inserts
+      let sql = case executor.dialect(exec) {
+        executor.SQLite ->
+          "SELECT l.id, l.src, l.uri, l.cid, l.val, l.neg, l.cts, l.exp FROM label l WHERE l.uri IN ("
+          <> placeholders
+          <> ") AND l.neg = 0 AND (l.exp IS NULL OR l.exp > datetime('now'))"
+          <> " AND NOT EXISTS (SELECT 1 FROM label n WHERE n.uri = l.uri AND n.val = l.val AND n.neg = 1 AND (n.cts > l.cts OR (n.cts = l.cts AND n.id > l.id)))"
+          <> " ORDER BY l.cts DESC"
+        executor.PostgreSQL ->
+          "SELECT l.id, l.src, l.uri, l.cid, l.val, l.neg::int, l.cts::text, l.exp::text FROM label l WHERE l.uri IN ("
+          <> placeholders
+          <> ") AND l.neg = FALSE AND (l.exp IS NULL OR l.exp > NOW())"
+          <> " AND NOT EXISTS (SELECT 1 FROM label n WHERE n.uri = l.uri AND n.val = l.val AND n.neg = TRUE AND (n.cts > l.cts OR (n.cts = l.cts AND n.id > l.id)))"
+          <> " ORDER BY l.cts DESC"
+      }
+      executor.query(exec, sql, list.map(uris, Text), label_decoder())
+    }
+  }
+}
+
+/// Get all labels (admin query with optional filters)
+pub fn get_all(
+  exec: Executor,
+  uri_filter: Option(String),
+  val_filter: Option(String),
+  limit: Int,
+  cursor: Option(Int),
+) -> Result(List(Label), DbError) {
+  let mut_where_parts: List(String) = []
+  let mut_params: List(Value) = []
+  let mut_param_count = 0
+
+  // Add URI filter if provided
+  let #(where_parts, params, param_count) = case uri_filter {
+    Some(uri) -> {
+      let p = executor.placeholder(exec, mut_param_count + 1)
+      #(
+        ["uri = " <> p, ..mut_where_parts],
+        [Text(uri), ..mut_params],
+        mut_param_count + 1,
+      )
+    }
+    None -> #(mut_where_parts, mut_params, mut_param_count)
+  }
+
+  // Add val filter if provided
+  let #(where_parts2, params2, param_count2) = case val_filter {
+    Some(v) -> {
+      let p = executor.placeholder(exec, param_count + 1)
+      #(["val = " <> p, ..where_parts], [Text(v), ..params], param_count + 1)
+    }
+    None -> #(where_parts, params, param_count)
+  }
+
+  // Add cursor filter if provided
+  let #(where_parts3, params3, param_count3) = case cursor {
+    Some(c) -> {
+      let p = executor.placeholder(exec, param_count2 + 1)
+      #(["id < " <> p, ..where_parts2], [Int(c), ..params2], param_count2 + 1)
+    }
+    None -> #(where_parts2, params2, param_count2)
+  }
+
+  let where_clause = case where_parts3 {
+    [] -> ""
+    parts -> " WHERE " <> string.join(list.reverse(parts), " AND ")
+  }
+
+  let limit_p = executor.placeholder(exec, param_count3 + 1)
+  let sql = case executor.dialect(exec) {
+    executor.SQLite ->
+      "SELECT id, src, uri, cid, val, neg, cts, exp FROM label"
+      <> where_clause
+      <> " ORDER BY id DESC LIMIT "
+      <> limit_p
+    executor.PostgreSQL ->
+      "SELECT id, src, uri, cid, val, neg::int, cts::text, exp::text FROM label"
+      <> where_clause
+      <> " ORDER BY id DESC LIMIT "
+      <> limit_p
+  }
+
+  executor.query(
+    exec,
+    sql,
+    list.append(list.reverse(params3), [Int(limit)]),
+    label_decoder(),
+  )
+}
+
+/// Result type for paginated label queries
+pub type PaginatedLabels {
+  PaginatedLabels(labels: List(Label), has_next_page: Bool, total_count: Int)
+}
+
+/// Get labels with connection-style pagination
+/// Returns labels, whether there's a next page, and total count
+pub fn get_paginated(
+  exec: Executor,
+  uri_filter: Option(String),
+  val_filter: Option(String),
+  first: Int,
+  after_id: Option(Int),
+) -> Result(PaginatedLabels, DbError) {
+  // Fetch first + 1 to detect hasNextPage
+  let fetch_limit = first + 1
+
+  let mut_where_parts: List(String) = []
+  let mut_params: List(Value) = []
+  let mut_param_count = 0
+
+  // Add URI filter if provided
+  let #(where_parts, params, param_count) = case uri_filter {
+    Some(uri) -> {
+      let p = executor.placeholder(exec, mut_param_count + 1)
+      #(
+        ["uri = " <> p, ..mut_where_parts],
+        [Text(uri), ..mut_params],
+        mut_param_count + 1,
+      )
+    }
+    None -> #(mut_where_parts, mut_params, mut_param_count)
+  }
+
+  // Add val filter if provided
+  let #(where_parts2, params2, param_count2) = case val_filter {
+    Some(v) -> {
+      let p = executor.placeholder(exec, param_count + 1)
+      #(["val = " <> p, ..where_parts], [Text(v), ..params], param_count + 1)
+    }
+    None -> #(where_parts, params, param_count)
+  }
+
+  // Add cursor filter if provided (only for main query, not for count)
+  let #(where_parts_with_cursor, params_with_cursor, param_count3) = case
+    after_id
+  {
+    Some(c) -> {
+      let p = executor.placeholder(exec, param_count2 + 1)
+      #(["id < " <> p, ..where_parts2], [Int(c), ..params2], param_count2 + 1)
+    }
+    None -> #(where_parts2, params2, param_count2)
+  }
+
+  // Build WHERE clause for main query (with cursor)
+  let where_clause = case where_parts_with_cursor {
+    [] -> ""
+    parts -> " WHERE " <> string.join(list.reverse(parts), " AND ")
+  }
+
+  // Build WHERE clause for count query (without cursor)
+  let count_where_clause = case where_parts2 {
+    [] -> ""
+    parts -> " WHERE " <> string.join(list.reverse(parts), " AND ")
+  }
+
+  let limit_p = executor.placeholder(exec, param_count3 + 1)
+  let main_sql = case executor.dialect(exec) {
+    executor.SQLite ->
+      "SELECT id, src, uri, cid, val, neg, cts, exp FROM label"
+      <> where_clause
+      <> " ORDER BY id DESC LIMIT "
+      <> limit_p
+    executor.PostgreSQL ->
+      "SELECT id, src, uri, cid, val, neg::int, cts::text, exp::text FROM label"
+      <> where_clause
+      <> " ORDER BY id DESC LIMIT "
+      <> limit_p
+  }
+
+  let count_sql = "SELECT COUNT(*) FROM label" <> count_where_clause
+
+  // Execute main query
+  let main_params =
+    list.append(list.reverse(params_with_cursor), [Int(fetch_limit)])
+  case executor.query(exec, main_sql, main_params, label_decoder()) {
+    Ok(labels_result) -> {
+      // Execute count query (uses params without cursor)
+      let count_params = list.reverse(params2)
+      let count_decoder = {
+        use count <- decode.field(0, decode.int)
+        decode.success(count)
+      }
+
+      case executor.query(exec, count_sql, count_params, count_decoder) {
+        Ok([total_count]) -> {
+          // Determine if there's a next page
+          let has_next = list.length(labels_result) > first
+          let labels = case has_next {
+            True -> list.take(labels_result, first)
+            False -> labels_result
+          }
+          Ok(PaginatedLabels(labels:, has_next_page: has_next, total_count:))
+        }
+        Ok(_) ->
+          Ok(PaginatedLabels(labels: [], has_next_page: False, total_count: 0))
+        Error(e) -> Error(e)
+      }
+    }
+    Error(e) -> Error(e)
+  }
+}
+
+/// Check if a URI has an active takedown label (not retracted by negation)
+pub fn has_takedown(exec: Executor, uri: String) -> Result(Bool, DbError) {
+  let p1 = executor.placeholder(exec, 1)
+  let p2 = executor.placeholder(exec, 2)
+  // Use (cts, id) for ordering to handle same-timestamp inserts
+  let sql = case executor.dialect(exec) {
+    executor.SQLite ->
+      "SELECT 1 FROM label l WHERE l.uri = "
+      <> p1
+      <> " AND l.val IN ('!takedown', '!suspend') AND l.neg = 0 AND (l.exp IS NULL OR l.exp > datetime('now'))"
+      <> " AND NOT EXISTS (SELECT 1 FROM label n WHERE n.uri = "
+      <> p2
+      <> " AND n.val = l.val AND n.neg = 1 AND (n.cts > l.cts OR (n.cts = l.cts AND n.id > l.id)))"
+      <> " LIMIT 1"
+    executor.PostgreSQL ->
+      "SELECT 1 FROM label l WHERE l.uri = "
+      <> p1
+      <> " AND l.val IN ('!takedown', '!suspend') AND l.neg = FALSE AND (l.exp IS NULL OR l.exp > NOW())"
+      <> " AND NOT EXISTS (SELECT 1 FROM label n WHERE n.uri = "
+      <> p2
+      <> " AND n.val = l.val AND n.neg = TRUE AND (n.cts > l.cts OR (n.cts = l.cts AND n.id > l.id)))"
+      <> " LIMIT 1"
+  }
+
+  case executor.query(exec, sql, [Text(uri), Text(uri)], decode.dynamic) {
+    Ok([_]) -> Ok(True)
+    Ok([]) -> Ok(False)
+    Ok(_) -> Ok(True)
+    Error(e) -> Error(e)
+  }
+}
+
+/// Batch check for takedown labels on multiple URIs
+/// Returns list of URIs that have active takedown labels (not retracted by negation)
+pub fn get_takedown_uris(
+  exec: Executor,
+  uris: List(String),
+) -> Result(List(String), DbError) {
+  case uris {
+    [] -> Ok([])
+    _ -> {
+      let placeholders = executor.placeholders(exec, list.length(uris), 1)
+      // Exclude takedown labels that have been retracted by a subsequent negation
+      // Use (cts, id) for ordering to handle same-timestamp inserts
+      let sql = case executor.dialect(exec) {
+        executor.SQLite ->
+          "SELECT DISTINCT l.uri FROM label l WHERE l.uri IN ("
+          <> placeholders
+          <> ") AND l.val IN ('!takedown', '!suspend') AND l.neg = 0 AND (l.exp IS NULL OR l.exp > datetime('now'))"
+          <> " AND NOT EXISTS (SELECT 1 FROM label n WHERE n.uri = l.uri AND n.val = l.val AND n.neg = 1 AND (n.cts > l.cts OR (n.cts = l.cts AND n.id > l.id)))"
+        executor.PostgreSQL ->
+          "SELECT DISTINCT l.uri FROM label l WHERE l.uri IN ("
+          <> placeholders
+          <> ") AND l.val IN ('!takedown', '!suspend') AND l.neg = FALSE AND (l.exp IS NULL OR l.exp > NOW())"
+          <> " AND NOT EXISTS (SELECT 1 FROM label n WHERE n.uri = l.uri AND n.val = l.val AND n.neg = TRUE AND (n.cts > l.cts OR (n.cts = l.cts AND n.id > l.id)))"
+      }
+
+      let uri_decoder = {
+        use uri <- decode.field(0, decode.string)
+        decode.success(uri)
+      }
+
+      executor.query(exec, sql, list.map(uris, Text), uri_decoder)
+    }
+  }
+}
+
+/// Count active takedown labels for a collection (for accurate pagination counts)
+/// This counts records with !takedown or !suspend that haven't been retracted
+pub fn count_takedowns_for_collection(
+  exec: Executor,
+  collection: String,
+) -> Result(Int, DbError) {
+  let p1 = executor.placeholder(exec, 1)
+  // Count distinct URIs with active takedown labels for records in this collection
+  // Uses LIKE pattern matching on URI: at://did/collection/rkey
+  // Use (cts, id) for ordering to handle same-timestamp inserts
+  let sql = case executor.dialect(exec) {
+    executor.SQLite ->
+      "SELECT COUNT(DISTINCT l.uri) FROM label l "
+      <> "WHERE l.uri LIKE '%/' || "
+      <> p1
+      <> " || '/%' "
+      <> "AND l.val IN ('!takedown', '!suspend') AND l.neg = 0 "
+      <> "AND (l.exp IS NULL OR l.exp > datetime('now')) "
+      <> "AND NOT EXISTS (SELECT 1 FROM label n WHERE n.uri = l.uri AND n.val = l.val AND n.neg = 1 AND (n.cts > l.cts OR (n.cts = l.cts AND n.id > l.id)))"
+    executor.PostgreSQL ->
+      "SELECT COUNT(DISTINCT l.uri) FROM label l "
+      <> "WHERE l.uri LIKE '%/' || "
+      <> p1
+      <> " || '/%' "
+      <> "AND l.val IN ('!takedown', '!suspend') AND l.neg = FALSE "
+      <> "AND (l.exp IS NULL OR l.exp > NOW()) "
+      <> "AND NOT EXISTS (SELECT 1 FROM label n WHERE n.uri = l.uri AND n.val = l.val AND n.neg = TRUE AND (n.cts > l.cts OR (n.cts = l.cts AND n.id > l.id)))"
+  }
+
+  let count_decoder = {
+    use count <- decode.field(0, decode.int)
+    decode.success(count)
+  }
+
+  case executor.query(exec, sql, [Text(collection)], count_decoder) {
+    Ok([count]) -> Ok(count)
+    Ok(_) -> Ok(0)
+    Error(e) -> Error(e)
+  }
+}
+
+/// Decoder for Label
+fn label_decoder() -> decode.Decoder(Label) {
+  use id <- decode.field(0, decode.int)
+  use src <- decode.field(1, decode.string)
+  use uri <- decode.field(2, decode.string)
+  use cid <- decode.field(3, decode.optional(decode.string))
+  use val <- decode.field(4, decode.string)
+  use neg_int <- decode.field(5, decode.int)
+  use cts <- decode.field(6, decode.string)
+  use exp <- decode.field(7, decode.optional(decode.string))
+  let neg = neg_int == 1
+  decode.success(Label(id:, src:, uri:, cid:, val:, neg:, cts:, exp:))
+}

server/src/database/repositories/reports.gleam

···
+/// Repository for moderation reports
+import database/executor.{
+  type DbError, type Executor, type Value, Int, Null, Text,
+}
+import gleam/dynamic/decode
+import gleam/list
+import gleam/option.{type Option, None, Some}
+import gleam/string
+
+/// Report domain type
+pub type Report {
+  Report(
+    id: Int,
+    reporter_did: String,
+    subject_uri: String,
+    reason_type: String,
+    reason: Option(String),
+    status: String,
+    resolved_by: Option(String),
+    resolved_at: Option(String),
+    created_at: String,
+  )
+}
+
+/// Insert a new report
+pub fn insert(
+  exec: Executor,
+  reporter_did: String,
+  subject_uri: String,
+  reason_type: String,
+  reason: Option(String),
+) -> Result(Report, DbError) {
+  let p1 = executor.placeholder(exec, 1)
+  let p2 = executor.placeholder(exec, 2)
+  let p3 = executor.placeholder(exec, 3)
+  let p4 = executor.placeholder(exec, 4)
+
+  let reason_value = case reason {
+    Some(r) -> Text(r)
+    None -> Null
+  }
+
+  let sql = case executor.dialect(exec) {
+    executor.SQLite ->
+      "INSERT INTO report (reporter_did, subject_uri, reason_type, reason) VALUES ("
+      <> p1
+      <> ", "
+      <> p2
+      <> ", "
+      <> p3
+      <> ", "
+      <> p4
+      <> ") RETURNING id, reporter_did, subject_uri, reason_type, reason, status, resolved_by, resolved_at, created_at"
+    executor.PostgreSQL ->
+      "INSERT INTO report (reporter_did, subject_uri, reason_type, reason) VALUES ("
+      <> p1
+      <> ", "
+      <> p2
+      <> ", "
+      <> p3
+      <> ", "
+      <> p4
+      <> ") RETURNING id, reporter_did, subject_uri, reason_type, reason, status, resolved_by, resolved_at::text, created_at::text"
+  }
+
+  case
+    executor.query(
+      exec,
+      sql,
+      [Text(reporter_did), Text(subject_uri), Text(reason_type), reason_value],
+      report_decoder(),
+    )
+  {
+    Ok([report]) -> Ok(report)
+    Ok(_) -> Error(executor.QueryError("Insert did not return report"))
+    Error(e) -> Error(e)
+  }
+}
+
+/// Get a report by ID
+pub fn get(exec: Executor, id: Int) -> Result(Option(Report), DbError) {
+  let sql = case executor.dialect(exec) {
+    executor.SQLite ->
+      "SELECT id, reporter_did, subject_uri, reason_type, reason, status, resolved_by, resolved_at, created_at FROM report WHERE id = "
+      <> executor.placeholder(exec, 1)
+    executor.PostgreSQL ->
+      "SELECT id, reporter_did, subject_uri, reason_type, reason, status, resolved_by, resolved_at::text, created_at::text FROM report WHERE id = "
+      <> executor.placeholder(exec, 1)
+  }
+  case executor.query(exec, sql, [Int(id)], report_decoder()) {
+    Ok([report]) -> Ok(Some(report))
+    Ok(_) -> Ok(None)
+    Error(e) -> Error(e)
+  }
+}
+
+/// Get reports with optional status filter and pagination
+pub fn get_all(
+  exec: Executor,
+  status_filter: Option(String),
+  limit: Int,
+  cursor: Option(Int),
+) -> Result(List(Report), DbError) {
+  let mut_where_parts: List(String) = []
+  let mut_params: List(Value) = []
+  let mut_param_count = 0
+
+  // Add status filter if provided
+  let #(where_parts, params, param_count) = case status_filter {
+    Some(s) -> {
+      let p = executor.placeholder(exec, mut_param_count + 1)
+      #(["status = " <> p], [Text(s)], mut_param_count + 1)
+    }
+    None -> #(mut_where_parts, mut_params, mut_param_count)
+  }
+
+  // Add cursor filter if provided
+  let #(where_parts2, params2, param_count2) = case cursor {
+    Some(c) -> {
+      let p = executor.placeholder(exec, param_count + 1)
+      #(["id < " <> p, ..where_parts], [Int(c), ..params], param_count + 1)
+    }
+    None -> #(where_parts, params, param_count)
+  }
+
+  let where_clause = case where_parts2 {
+    [] -> ""
+    parts -> " WHERE " <> string.join(list.reverse(parts), " AND ")
+  }
+
+  let limit_p = executor.placeholder(exec, param_count2 + 1)
+  let sql = case executor.dialect(exec) {
+    executor.SQLite ->
+      "SELECT id, reporter_did, subject_uri, reason_type, reason, status, resolved_by, resolved_at, created_at FROM report"
+      <> where_clause
+      <> " ORDER BY id DESC LIMIT "
+      <> limit_p
+    executor.PostgreSQL ->
+      "SELECT id, reporter_did, subject_uri, reason_type, reason, status, resolved_by, resolved_at::text, created_at::text FROM report"
+      <> where_clause
+      <> " ORDER BY id DESC LIMIT "
+      <> limit_p
+  }
+
+  executor.query(
+    exec,
+    sql,
+    list.append(list.reverse(params2), [Int(limit)]),
+    report_decoder(),
+  )
+}
+
+/// Result type for paginated report queries
+pub type PaginatedReports {
+  PaginatedReports(reports: List(Report), has_next_page: Bool, total_count: Int)
+}
+
+/// Get reports with connection-style pagination
+/// Returns reports, whether there's a next page, and total count
+pub fn get_paginated(
+  exec: Executor,
+  status_filter: Option(String),
+  first: Int,
+  after_id: Option(Int),
+) -> Result(PaginatedReports, DbError) {
+  // Fetch first + 1 to detect hasNextPage
+  let fetch_limit = first + 1
+
+  let mut_where_parts: List(String) = []
+  let mut_params: List(Value) = []
+  let mut_param_count = 0
+
+  // Add status filter if provided
+  let #(where_parts, params, param_count) = case status_filter {
+    Some(s) -> {
+      let p = executor.placeholder(exec, mut_param_count + 1)
+      #(["status = " <> p], [Text(s)], mut_param_count + 1)
+    }
+    None -> #(mut_where_parts, mut_params, mut_param_count)
+  }
+
+  // Add cursor filter if provided (only for main query, not for count)
+  let #(where_parts_with_cursor, params_with_cursor, param_count2) = case
+    after_id
+  {
+    Some(c) -> {
+      let p = executor.placeholder(exec, param_count + 1)
+      #(["id < " <> p, ..where_parts], [Int(c), ..params], param_count + 1)
+    }
+    None -> #(where_parts, params, param_count)
+  }
+
+  // Build WHERE clause for main query (with cursor)
+  let where_clause = case where_parts_with_cursor {
+    [] -> ""
+    parts -> " WHERE " <> string.join(list.reverse(parts), " AND ")
+  }
+
+  // Build WHERE clause for count query (without cursor)
+  let count_where_clause = case where_parts {
+    [] -> ""
+    parts -> " WHERE " <> string.join(list.reverse(parts), " AND ")
+  }
+
+  let limit_p = executor.placeholder(exec, param_count2 + 1)
+  let main_sql = case executor.dialect(exec) {
+    executor.SQLite ->
+      "SELECT id, reporter_did, subject_uri, reason_type, reason, status, resolved_by, resolved_at, created_at FROM report"
+      <> where_clause
+      <> " ORDER BY id DESC LIMIT "
+      <> limit_p
+    executor.PostgreSQL ->
+      "SELECT id, reporter_did, subject_uri, reason_type, reason, status, resolved_by, resolved_at::text, created_at::text FROM report"
+      <> where_clause
+      <> " ORDER BY id DESC LIMIT "
+      <> limit_p
+  }
+
+  let count_sql = "SELECT COUNT(*) FROM report" <> count_where_clause
+
+  // Execute main query
+  let main_params =
+    list.append(list.reverse(params_with_cursor), [Int(fetch_limit)])
+  case executor.query(exec, main_sql, main_params, report_decoder()) {
+    Ok(reports_result) -> {
+      // Execute count query (uses params without cursor)
+      let count_params = list.reverse(params)
+      let count_decoder = {
+        use count <- decode.field(0, decode.int)
+        decode.success(count)
+      }
+
+      case executor.query(exec, count_sql, count_params, count_decoder) {
+        Ok([total_count]) -> {
+          // Determine if there's a next page
+          let has_next = list.length(reports_result) > first
+          let reports = case has_next {
+            True -> list.take(reports_result, first)
+            False -> reports_result
+          }
+          Ok(PaginatedReports(reports:, has_next_page: has_next, total_count:))
+        }
+        Ok(_) ->
+          Ok(PaginatedReports(reports: [], has_next_page: False, total_count: 0))
+        Error(e) -> Error(e)
+      }
+    }
+    Error(e) -> Error(e)
+  }
+}
+
+/// Resolve a report (apply label or dismiss)
+pub fn resolve(
+  exec: Executor,
+  id: Int,
+  status: String,
+  resolved_by: String,
+) -> Result(Report, DbError) {
+  let p1 = executor.placeholder(exec, 1)
+  let p2 = executor.placeholder(exec, 2)
+  let p3 = executor.placeholder(exec, 3)
+
+  let sql = case executor.dialect(exec) {
+    executor.SQLite ->
+      "UPDATE report SET status = "
+      <> p1
+      <> ", resolved_by = "
+      <> p2
+      <> ", resolved_at = datetime('now') WHERE id = "
+      <> p3
+      <> " RETURNING id, reporter_did, subject_uri, reason_type, reason, status, resolved_by, resolved_at, created_at"
+    executor.PostgreSQL ->
+      "UPDATE report SET status = "
+      <> p1
+      <> ", resolved_by = "
+      <> p2
+      <> ", resolved_at = NOW() WHERE id = "
+      <> p3
+      <> " RETURNING id, reporter_did, subject_uri, reason_type, reason, status, resolved_by, resolved_at::text, created_at::text"
+  }
+
+  case
+    executor.query(
+      exec,
+      sql,
+      [Text(status), Text(resolved_by), Int(id)],
+      report_decoder(),
+    )
+  {
+    Ok([report]) -> Ok(report)
+    Ok(_) -> Error(executor.QueryError("Update did not return report"))
+    Error(e) -> Error(e)
+  }
+}
+
+/// Decoder for Report
+fn report_decoder() -> decode.Decoder(Report) {
+  use id <- decode.field(0, decode.int)
+  use reporter_did <- decode.field(1, decode.string)
+  use subject_uri <- decode.field(2, decode.string)
+  use reason_type <- decode.field(3, decode.string)
+  use reason <- decode.field(4, decode.optional(decode.string))
+  use status <- decode.field(5, decode.string)
+  use resolved_by <- decode.field(6, decode.optional(decode.string))
+  use resolved_at <- decode.field(7, decode.optional(decode.string))
+  use created_at <- decode.field(8, decode.string)
+  decode.success(Report(
+    id:,
+    reporter_did:,
+    subject_uri:,
+    reason_type:,
+    reason:,
+    status:,
+    resolved_by:,
+    resolved_at:,
+    created_at:,
+  ))
+}

server/src/graphql/admin/converters.gleam

···
 /// Value converters for admin GraphQL API
 ///
 /// Transform domain types to GraphQL value.Value objects
+import database/repositories/label_definitions
+import database/repositories/labels
+import database/repositories/reports
 import database/types.{
   type ActivityBucket, type ActivityEntry, type Lexicon, type OAuthClient,
   client_type_to_string,
 }
 import gleam/list
 import gleam/option.{None, Some}
+import gleam/string
 import swell/value
 
 /// Convert CurrentSession data to GraphQL value
···
     #("createdAt", value.String(lexicon.created_at)),
   ])
 }
+
+// =============================================================================
+// Label and Report Converters
+// =============================================================================
+
+/// Convert LabelDefinition to GraphQL value
+pub fn label_definition_to_value(
+  def: label_definitions.LabelDefinition,
+) -> value.Value {
+  value.Object([
+    #("val", value.String(def.val)),
+    #("description", value.String(def.description)),
+    #("severity", value.Enum(string.uppercase(def.severity))),
+    #("defaultVisibility", value.Enum(string.uppercase(def.default_visibility))),
+    #("createdAt", value.String(def.created_at)),
+  ])
+}
+
+/// Convert Label to GraphQL value
+pub fn label_to_value(label: labels.Label) -> value.Value {
+  let cid_value = case label.cid {
+    Some(c) -> value.String(c)
+    None -> value.Null
+  }
+  let exp_value = case label.exp {
+    Some(e) -> value.String(e)
+    None -> value.Null
+  }
+  value.Object([
+    #("id", value.Int(label.id)),
+    #("src", value.String(label.src)),
+    #("uri", value.String(label.uri)),
+    #("cid", cid_value),
+    #("val", value.String(label.val)),
+    #("neg", value.Boolean(label.neg)),
+    #("cts", value.String(label.cts)),
+    #("exp", exp_value),
+  ])
+}
+
+/// Convert Report to GraphQL value
+pub fn report_to_value(report: reports.Report) -> value.Value {
+  let reason_value = case report.reason {
+    Some(r) -> value.String(r)
+    None -> value.Null
+  }
+  let resolved_by_value = case report.resolved_by {
+    Some(r) -> value.String(r)
+    None -> value.Null
+  }
+  let resolved_at_value = case report.resolved_at {
+    Some(r) -> value.String(r)
+    None -> value.Null
+  }
+  value.Object([
+    #("id", value.Int(report.id)),
+    #("reporterDid", value.String(report.reporter_did)),
+    #("subjectUri", value.String(report.subject_uri)),
+    #("reasonType", value.Enum(string.uppercase(report.reason_type))),
+    #("reason", reason_value),
+    #("status", value.Enum(string.uppercase(report.status))),
+    #("resolvedBy", resolved_by_value),
+    #("resolvedAt", resolved_at_value),
+    #("createdAt", value.String(report.created_at)),
+  ])
+}

server/src/graphql/admin/cursor.gleam

···
+/// Cursor encoding/decoding for admin GraphQL connections
+///
+/// Cursors are opaque base64-encoded strings in format "Type:ID"
+/// Example: "Label:42" -> "TGFiZWw6NDI="
+import gleam/bit_array
+import gleam/int
+import gleam/result
+import gleam/string
+
+/// Encode a cursor from prefix and ID
+/// "Label", 42 -> "TGFiZWw6NDI="
+pub fn encode(prefix: String, id: Int) -> String {
+  let raw = prefix <> ":" <> int.to_string(id)
+  bit_array.from_string(raw)
+  |> bit_array.base64_encode(True)
+}
+
+/// Decode a cursor to prefix and ID
+/// "TGFiZWw6NDI=" -> Ok(#("Label", 42))
+pub fn decode(cursor: String) -> Result(#(String, Int), Nil) {
+  use decoded <- result.try(
+    bit_array.base64_decode(cursor)
+    |> result.try(fn(bits) { bit_array.to_string(bits) })
+    |> result.replace_error(Nil),
+  )
+
+  case string.split(decoded, ":") {
+    [prefix, id_str] -> {
+      case int.parse(id_str) {
+        Ok(id) -> Ok(#(prefix, id))
+        Error(_) -> Error(Nil)
+      }
+    }
+    _ -> Error(Nil)
+  }
+}

server/src/graphql/admin/mutations.gleam

···
 import database/repositories/actors
 import database/repositories/config as config_repo
 import database/repositories/jetstream_activity
+import database/repositories/label_definitions
+import database/repositories/labels
 import database/repositories/lexicons
 import database/repositories/oauth_clients
 import database/repositories/records
+import database/repositories/reports
 import database/types
 import gleam/erlang/process.{type Subject}
 import gleam/list
···
                     }
                   }
                   _ -> Error("Invalid clientId argument")
+                }
+              }
+              False -> Error("Admin privileges required")
+            }
+          }
+          Error(_) -> Error("Authentication required")
+        }
+      },
+    ),
+    // createLabel mutation (admin only)
+    schema.field_with_args(
+      "createLabel",
+      schema.non_null(admin_types.label_type()),
+      "Create a label on a record or account (admin only)",
+      [
+        schema.argument(
+          "uri",
+          schema.non_null(schema.string_type()),
+          "Subject URI (at:// or did:)",
+          None,
+        ),
+        schema.argument(
+          "val",
+          schema.non_null(schema.string_type()),
+          "Label value",
+          None,
+        ),
+        schema.argument(
+          "cid",
+          schema.string_type(),
+          "Optional CID for version-specific label",
+          None,
+        ),
+        schema.argument(
+          "exp",
+          schema.string_type(),
+          "Optional expiration datetime",
+          None,
+        ),
+      ],
+      fn(ctx) {
+        case session.get_current_session(req, conn, did_cache) {
+          Ok(sess) -> {
+            case config_repo.is_admin(conn, sess.did) {
+              True -> {
+                case
+                  schema.get_argument(ctx, "uri"),
+                  schema.get_argument(ctx, "val")
+                {
+                  Some(value.String(uri)), Some(value.String(val)) -> {
+                    // Validate URI format
+                    case labels.is_valid_subject_uri(uri) {
+                      False ->
+                        Error(
+                          "Invalid URI format. Must be at://did/collection/rkey or a DID",
+                        )
+                      True -> {
+                        // Validate label value exists
+                        case label_definitions.exists(conn, val) {
+                          Ok(True) -> {
+                            let cid = case schema.get_argument(ctx, "cid") {
+                              Some(value.String(c)) -> Some(c)
+                              _ -> None
+                            }
+                            let exp = case schema.get_argument(ctx, "exp") {
+                              Some(value.String(e)) -> Some(e)
+                              _ -> None
+                            }
+                            case
+                              labels.insert(conn, sess.did, uri, cid, val, exp)
+                            {
+                              Ok(label) -> Ok(converters.label_to_value(label))
+                              Error(_) -> Error("Failed to create label")
+                            }
+                          }
+                          Ok(False) -> Error("Unknown label value: " <> val)
+                          Error(_) -> Error("Failed to validate label value")
+                        }
+                      }
+                    }
+                  }
+                  _, _ -> Error("uri and val are required")
+                }
+              }
+              False -> Error("Admin privileges required")
+            }
+          }
+          Error(_) -> Error("Authentication required")
+        }
+      },
+    ),
+    // negateLabel mutation (admin only)
+    schema.field_with_args(
+      "negateLabel",
+      schema.non_null(admin_types.label_type()),
+      "Negate (retract) a label on a record or account (admin only)",
+      [
+        schema.argument(
+          "uri",
+          schema.non_null(schema.string_type()),
+          "Subject URI",
+          None,
+        ),
+        schema.argument(
+          "val",
+          schema.non_null(schema.string_type()),
+          "Label value to negate",
+          None,
+        ),
+      ],
+      fn(ctx) {
+        case session.get_current_session(req, conn, did_cache) {
+          Ok(sess) -> {
+            case config_repo.is_admin(conn, sess.did) {
+              True -> {
+                case
+                  schema.get_argument(ctx, "uri"),
+                  schema.get_argument(ctx, "val")
+                {
+                  Some(value.String(uri)), Some(value.String(val)) -> {
+                    // Validate URI format
+                    case labels.is_valid_subject_uri(uri) {
+                      False ->
+                        Error(
+                          "Invalid URI format. Must be at://did/collection/rkey or a DID",
+                        )
+                      True -> {
+                        case labels.insert_negation(conn, sess.did, uri, val) {
+                          Ok(label) -> Ok(converters.label_to_value(label))
+                          Error(_) -> Error("Failed to negate label")
+                        }
+                      }
+                    }
+                  }
+                  _, _ -> Error("uri and val are required")
+                }
+              }
+              False -> Error("Admin privileges required")
+            }
+          }
+          Error(_) -> Error("Authentication required")
+        }
+      },
+    ),
+    // createLabelDefinition mutation (admin only)
+    schema.field_with_args(
+      "createLabelDefinition",
+      schema.non_null(admin_types.label_definition_type()),
+      "Create a custom label definition (admin only)",
+      [
+        schema.argument(
+          "val",
+          schema.non_null(schema.string_type()),
+          "Label value",
+          None,
+        ),
+        schema.argument(
+          "description",
+          schema.non_null(schema.string_type()),
+          "Description",
+          None,
+        ),
+        schema.argument(
+          "severity",
+          schema.non_null(admin_types.label_severity_enum()),
+          "Severity level",
+          None,
+        ),
+        schema.argument(
+          "defaultVisibility",
+          schema.string_type(),
+          "Default visibility setting (ignore, show, warn, hide). Defaults to warn.",
+          None,
+        ),
+      ],
+      fn(ctx) {
+        case session.get_current_session(req, conn, did_cache) {
+          Ok(sess) -> {
+            case config_repo.is_admin(conn, sess.did) {
+              True -> {
+                // Extract severity as string from either Enum or String
+                let severity_opt = case schema.get_argument(ctx, "severity") {
+                  Some(value.Enum(s)) -> Some(string.lowercase(s))
+                  Some(value.String(s)) -> Some(string.lowercase(s))
+                  _ -> None
+                }
+                // Extract defaultVisibility (defaults to "warn")
+                let default_visibility = case
+                  schema.get_argument(ctx, "defaultVisibility")
+                {
+                  Some(value.Enum(v)) -> string.lowercase(v)
+                  Some(value.String(v)) -> string.lowercase(v)
+                  _ -> "warn"
+                }
+                // Validate defaultVisibility
+                case label_definitions.validate_visibility(default_visibility) {
+                  Error(e) -> Error(e)
+                  Ok(_) -> {
+                    case
+                      schema.get_argument(ctx, "val"),
+                      schema.get_argument(ctx, "description"),
+                      severity_opt
+                    {
+                      Some(value.String(val)),
+                        Some(value.String(desc)),
+                        Some(severity)
+                      -> {
+                        case
+                          label_definitions.insert(
+                            conn,
+                            val,
+                            desc,
+                            severity,
+                            default_visibility,
+                          )
+                        {
+                          Ok(_) -> {
+                            case label_definitions.get(conn, val) {
+                              Ok(Some(def)) ->
+                                Ok(converters.label_definition_to_value(def))
+                              _ -> Error("Failed to fetch created definition")
+                            }
+                          }
+                          Error(_) -> Error("Failed to create label definition")
+                        }
+                      }
+                      _, _, _ ->
+                        Error("val, description, and severity are required")
+                    }
+                  }
+                }
+              }
+              False -> Error("Admin privileges required")
+            }
+          }
+          Error(_) -> Error("Authentication required")
+        }
+      },
+    ),
+    // resolveReport mutation (admin only)
+    schema.field_with_args(
+      "resolveReport",
+      schema.non_null(admin_types.report_type()),
+      "Resolve a moderation report (admin only)",
+      [
+        schema.argument(
+          "id",
+          schema.non_null(schema.int_type()),
+          "Report ID",
+          None,
+        ),
+        schema.argument(
+          "action",
+          schema.non_null(admin_types.report_action_enum()),
+          "Action to take",
+          None,
+        ),
+        schema.argument(
+          "labelVal",
+          schema.string_type(),
+          "Label value to apply (required if action is APPLY_LABEL)",
+          None,
+        ),
+      ],
+      fn(ctx) {
+        case session.get_current_session(req, conn, did_cache) {
+          Ok(sess) -> {
+            case config_repo.is_admin(conn, sess.did) {
+              True -> {
+                // Extract action as string from either Enum or String
+                let action_opt = case schema.get_argument(ctx, "action") {
+                  Some(value.Enum(a)) -> Some(a)
+                  Some(value.String(a)) -> Some(a)
+                  _ -> None
+                }
+                case schema.get_argument(ctx, "id"), action_opt {
+                  Some(value.Int(id)), Some(action) -> {
+                    // Get the report first
+                    case reports.get(conn, id) {
+                      Ok(Some(report)) -> {
+                        case action {
+                          "APPLY_LABEL" -> {
+                            case schema.get_argument(ctx, "labelVal") {
+                              Some(value.String(label_val)) -> {
+                                // Validate label value exists
+                                case label_definitions.exists(conn, label_val) {
+                                  Ok(True) -> {
+                                    // Create the label
+                                    case
+                                      labels.insert(
+                                        conn,
+                                        sess.did,
+                                        report.subject_uri,
+                                        None,
+                                        label_val,
+                                        None,
+                                      )
+                                    {
+                                      Ok(_) -> {
+                                        // Mark report as resolved
+                                        case
+                                          reports.resolve(
+                                            conn,
+                                            id,
+                                            "resolved",
+                                            sess.did,
+                                          )
+                                        {
+                                          Ok(resolved) ->
+                                            Ok(converters.report_to_value(
+                                              resolved,
+                                            ))
+                                          Error(_) ->
+                                            Error("Failed to resolve report")
+                                        }
+                                      }
+                                      Error(_) -> Error("Failed to apply label")
+                                    }
+                                  }
+                                  Ok(False) ->
+                                    Error("Unknown label value: " <> label_val)
+                                  Error(_) ->
+                                    Error("Failed to validate label value")
+                                }
+                              }
+                              _ ->
+                                Error(
+                                  "labelVal is required when action is APPLY_LABEL",
+                                )
+                            }
+                          }
+                          "DISMISS" -> {
+                            case
+                              reports.resolve(conn, id, "dismissed", sess.did)
+                            {
+                              Ok(resolved) ->
+                                Ok(converters.report_to_value(resolved))
+                              Error(_) -> Error("Failed to dismiss report")
+                            }
+                          }
+                          _ -> Error("Invalid action")
+                        }
+                      }
+                      Ok(None) -> Error("Report not found")
+                      Error(_) -> Error("Failed to fetch report")
+                    }
+                  }
+                  _, _ -> Error("id and action are required")
                 }
               }
               False -> Error("Admin privileges required")

server/src/graphql/admin/queries.gleam

···
 import database/repositories/actors
 import database/repositories/config as config_repo
 import database/repositories/jetstream_activity
+import database/repositories/label_definitions
+import database/repositories/label_preferences
+import database/repositories/labels
 import database/repositories/lexicons
 import database/repositories/oauth_clients
 import database/repositories/records
+import database/repositories/reports
 import gleam/erlang/process.{type Subject}
 import gleam/list
 import gleam/option.{None, Some}
 import gleam/otp/actor
+import gleam/string
 import graphql/admin/converters
+import graphql/admin/cursor
 import graphql/admin/types as admin_types
+import graphql/lexicon/converters as lexicon_converters
 import lib/oauth/did_cache
+import swell/connection
 import swell/schema
 import swell/value
 import wisp
···
             }
           }
           _ -> Error("Invalid or missing hours argument")
+        }
+      },
+    ),
+    // labelDefinitions query
+    schema.field(
+      "labelDefinitions",
+      schema.non_null(
+        schema.list_type(schema.non_null(admin_types.label_definition_type())),
+      ),
+      "Get all label definitions",
+      fn(_ctx) {
+        case label_definitions.get_all(conn) {
+          Ok(defs) ->
+            Ok(value.List(list.map(defs, converters.label_definition_to_value)))
+          Error(_) -> Error("Failed to fetch label definitions")
+        }
+      },
+    ),
+    // viewerLabelPreferences query (authenticated users)
+    schema.field(
+      "viewerLabelPreferences",
+      schema.non_null(
+        schema.list_type(schema.non_null(admin_types.label_preference_type())),
+      ),
+      "Get label preferences for the current user (non-system labels only)",
+      fn(_ctx) {
+        case session.get_current_session(req, conn, did_cache) {
+          Ok(sess) -> {
+            // Get non-system label definitions
+            case label_definitions.get_non_system(conn) {
+              Ok(defs) -> {
+                // Get user's preferences
+                case label_preferences.get_by_did(conn, sess.did) {
+                  Ok(prefs) -> {
+                    // Build a map of label_val -> visibility
+                    let pref_map =
+                      list.fold(prefs, [], fn(acc, pref) {
+                        [#(pref.label_val, pref.visibility), ..acc]
+                      })
+
+                    // Map each definition to a preference, using user's setting or default
+                    let result =
+                      list.map(defs, fn(def) {
+                        let visibility = case list.key_find(pref_map, def.val) {
+                          Ok(v) -> v
+                          Error(_) -> def.default_visibility
+                        }
+                        lexicon_converters.label_preference_to_value(
+                          def,
+                          visibility,
+                        )
+                      })
+
+                    Ok(value.List(result))
+                  }
+                  Error(_) -> Error("Failed to fetch label preferences")
+                }
+              }
+              Error(_) -> Error("Failed to fetch label definitions")
+            }
+          }
+          Error(_) -> Error("Authentication required")
+        }
+      },
+    ),
+    // labels query (admin only) - Connection type
+    schema.field_with_args(
+      "labels",
+      schema.non_null(admin_types.label_connection_type()),
+      "Get labels with optional filters (admin only)",
+      [
+        schema.argument(
+          "uri",
+          schema.string_type(),
+          "Filter by subject URI",
+          None,
+        ),
+        schema.argument(
+          "val",
+          schema.string_type(),
+          "Filter by label value",
+          None,
+        ),
+        schema.argument(
+          "first",
+          schema.int_type(),
+          "Number of items to fetch (default 50)",
+          None,
+        ),
+        schema.argument(
+          "after",
+          schema.string_type(),
+          "Cursor for pagination",
+          None,
+        ),
+      ],
+      fn(ctx) {
+        case session.get_current_session(req, conn, did_cache) {
+          Ok(sess) -> {
+            case config_repo.is_admin(conn, sess.did) {
+              True -> {
+                let uri_filter = case schema.get_argument(ctx, "uri") {
+                  Some(value.String(u)) -> Some(u)
+                  _ -> None
+                }
+                let val_filter = case schema.get_argument(ctx, "val") {
+                  Some(value.String(v)) -> Some(v)
+                  _ -> None
+                }
+                let first = case schema.get_argument(ctx, "first") {
+                  Some(value.Int(f)) -> f
+                  _ -> 50
+                }
+                let after_id = case schema.get_argument(ctx, "after") {
+                  Some(value.String(c)) -> {
+                    case cursor.decode(c) {
+                      Ok(#("Label", id)) -> Some(id)
+                      _ -> None
+                    }
+                  }
+                  _ -> None
+                }
+
+                case
+                  labels.get_paginated(
+                    conn,
+                    uri_filter,
+                    val_filter,
+                    first,
+                    after_id,
+                  )
+                {
+                  Ok(paginated) -> {
+                    // Build edges with cursors
+                    let edges =
+                      list.map(paginated.labels, fn(label) {
+                        connection.Edge(
+                          node: converters.label_to_value(label),
+                          cursor: cursor.encode("Label", label.id),
+                        )
+                      })
+
+                    // Build page info
+                    let start_cursor = case list.first(paginated.labels) {
+                      Ok(first_label) ->
+                        Some(cursor.encode("Label", first_label.id))
+                      Error(_) -> None
+                    }
+                    let end_cursor = case list.last(paginated.labels) {
+                      Ok(last_label) ->
+                        Some(cursor.encode("Label", last_label.id))
+                      Error(_) -> None
+                    }
+
+                    let page_info =
+                      connection.PageInfo(
+                        has_next_page: paginated.has_next_page,
+                        has_previous_page: option.is_some(after_id),
+                        start_cursor: start_cursor,
+                        end_cursor: end_cursor,
+                      )
+
+                    let conn_value =
+                      connection.Connection(
+                        edges: edges,
+                        page_info: page_info,
+                        total_count: Some(paginated.total_count),
+                      )
+
+                    Ok(connection.connection_to_value(conn_value))
+                  }
+                  Error(_) -> Error("Failed to fetch labels")
+                }
+              }
+              False -> Error("Admin privileges required")
+            }
+          }
+          Error(_) -> Error("Authentication required")
+        }
+      },
+    ),
+    // reports query (admin only) - Connection type
+    schema.field_with_args(
+      "reports",
+      schema.non_null(admin_types.report_connection_type()),
+      "Get moderation reports with optional status filter (admin only)",
+      [
+        schema.argument(
+          "status",
+          admin_types.report_status_enum(),
+          "Filter by status",
+          None,
+        ),
+        schema.argument(
+          "first",
+          schema.int_type(),
+          "Number of items to fetch (default 50)",
+          None,
+        ),
+        schema.argument(
+          "after",
+          schema.string_type(),
+          "Cursor for pagination",
+          None,
+        ),
+      ],
+      fn(ctx) {
+        case session.get_current_session(req, conn, did_cache) {
+          Ok(sess) -> {
+            case config_repo.is_admin(conn, sess.did) {
+              True -> {
+                let status_filter = case schema.get_argument(ctx, "status") {
+                  Some(value.Enum(s)) -> Some(string.lowercase(s))
+                  _ -> None
+                }
+                let first = case schema.get_argument(ctx, "first") {
+                  Some(value.Int(f)) -> f
+                  _ -> 50
+                }
+                let after_id = case schema.get_argument(ctx, "after") {
+                  Some(value.String(c)) -> {
+                    case cursor.decode(c) {
+                      Ok(#("Report", id)) -> Some(id)
+                      _ -> None
+                    }
+                  }
+                  _ -> None
+                }
+
+                case
+                  reports.get_paginated(conn, status_filter, first, after_id)
+                {
+                  Ok(paginated) -> {
+                    // Build edges with cursors
+                    let edges =
+                      list.map(paginated.reports, fn(report) {
+                        connection.Edge(
+                          node: converters.report_to_value(report),
+                          cursor: cursor.encode("Report", report.id),
+                        )
+                      })
+
+                    // Build page info
+                    let start_cursor = case list.first(paginated.reports) {
+                      Ok(first_report) ->
+                        Some(cursor.encode("Report", first_report.id))
+                      Error(_) -> None
+                    }
+                    let end_cursor = case list.last(paginated.reports) {
+                      Ok(last_report) ->
+                        Some(cursor.encode("Report", last_report.id))
+                      Error(_) -> None
+                    }
+
+                    let page_info =
+                      connection.PageInfo(
+                        has_next_page: paginated.has_next_page,
+                        has_previous_page: option.is_some(after_id),
+                        start_cursor: start_cursor,
+                        end_cursor: end_cursor,
+                      )
+
+                    let conn_value =
+                      connection.Connection(
+                        edges: edges,
+                        page_info: page_info,
+                        total_count: Some(paginated.total_count),
+                      )
+
+                    Ok(connection.connection_to_value(conn_value))
+                  }
+                  Error(_) -> Error("Failed to fetch reports")
+                }
+              }
+              False -> Error("Admin privileges required")
+            }
+          }
+          Error(_) -> Error("Authentication required")
         }
       },
     ),

server/src/graphql/admin/types.gleam

···
 /// Contains all object types, enum types, and the get_field helper
 import gleam/list
 import gleam/option.{Some}
+import swell/connection
 import swell/schema
 import swell/value
 
···
     }),
   ])
 }
+
+// =============================================================================
+// Label and Report Types
+// =============================================================================
+
+/// LabelSeverity enum for label definitions
+pub fn label_severity_enum() -> schema.Type {
+  schema.enum_type("LabelSeverity", "Severity level of a label", [
+    schema.enum_value("INFORM", "Informational, client can show indicator"),
+    schema.enum_value("ALERT", "Client should warn/blur"),
+    schema.enum_value("TAKEDOWN", "Server filters, content not returned"),
+  ])
+}
+
+/// LabelVisibility enum for user preferences
+pub fn label_visibility_enum() -> schema.Type {
+  schema.enum_type("LabelVisibility", "How to display labeled content", [
+    schema.enum_value("IGNORE", "Show content normally, no indicator"),
+    schema.enum_value("SHOW", "Explicitly show (for adult content)"),
+    schema.enum_value("WARN", "Blur with click-through warning"),
+    schema.enum_value("HIDE", "Do not show content"),
+  ])
+}
+
+/// LabelDefinition type
+pub fn label_definition_type() -> schema.Type {
+  schema.object_type("LabelDefinition", "Label value definition", [
+    schema.field(
+      "val",
+      schema.non_null(schema.string_type()),
+      "Label value (e.g., 'porn', '!takedown')",
+      fn(ctx) { Ok(get_field(ctx, "val")) },
+    ),
+    schema.field(
+      "description",
+      schema.non_null(schema.string_type()),
+      "Human-readable description",
+      fn(ctx) { Ok(get_field(ctx, "description")) },
+    ),
+    schema.field(
+      "severity",
+      schema.non_null(label_severity_enum()),
+      "Severity level",
+      fn(ctx) { Ok(get_field(ctx, "severity")) },
+    ),
+    schema.field(
+      "defaultVisibility",
+      schema.non_null(label_visibility_enum()),
+      "Default visibility setting for this label",
+      fn(ctx) { Ok(get_field(ctx, "defaultVisibility")) },
+    ),
+    schema.field(
+      "createdAt",
+      schema.non_null(schema.string_type()),
+      "Creation timestamp",
+      fn(ctx) { Ok(get_field(ctx, "createdAt")) },
+    ),
+  ])
+}
+
+/// LabelPreference type for viewerLabelPreferences query
+pub fn label_preference_type() -> schema.Type {
+  schema.object_type("LabelPreference", "User preference for a label type", [
+    schema.field(
+      "val",
+      schema.non_null(schema.string_type()),
+      "Label value",
+      fn(ctx) { Ok(get_field(ctx, "val")) },
+    ),
+    schema.field(
+      "description",
+      schema.non_null(schema.string_type()),
+      "Label description",
+      fn(ctx) { Ok(get_field(ctx, "description")) },
+    ),
+    schema.field(
+      "severity",
+      schema.non_null(label_severity_enum()),
+      "Label severity (inform, alert, takedown)",
+      fn(ctx) { Ok(get_field(ctx, "severity")) },
+    ),
+    schema.field(
+      "defaultVisibility",
+      schema.non_null(label_visibility_enum()),
+      "Default visibility setting",
+      fn(ctx) { Ok(get_field(ctx, "defaultVisibility")) },
+    ),
+    schema.field(
+      "visibility",
+      schema.non_null(label_visibility_enum()),
+      "User's effective visibility setting",
+      fn(ctx) { Ok(get_field(ctx, "visibility")) },
+    ),
+  ])
+}
+
+/// Label type
+pub fn label_type() -> schema.Type {
+  schema.object_type("Label", "Applied label on a record or account", [
+    schema.field("id", schema.non_null(schema.int_type()), "Label ID", fn(ctx) {
+      Ok(get_field(ctx, "id"))
+    }),
+    schema.field(
+      "src",
+      schema.non_null(schema.string_type()),
+      "DID of admin who applied the label",
+      fn(ctx) { Ok(get_field(ctx, "src")) },
+    ),
+    schema.field(
+      "uri",
+      schema.non_null(schema.string_type()),
+      "Subject URI (at:// or did:)",
+      fn(ctx) { Ok(get_field(ctx, "uri")) },
+    ),
+    schema.field(
+      "cid",
+      schema.string_type(),
+      "Optional CID for version-specific label",
+      fn(ctx) { Ok(get_field(ctx, "cid")) },
+    ),
+    schema.field(
+      "val",
+      schema.non_null(schema.string_type()),
+      "Label value",
+      fn(ctx) { Ok(get_field(ctx, "val")) },
+    ),
+    schema.field(
+      "neg",
+      schema.non_null(schema.boolean_type()),
+      "True if this is a negation (retraction)",
+      fn(ctx) { Ok(get_field(ctx, "neg")) },
+    ),
+    schema.field(
+      "cts",
+      schema.non_null(schema.string_type()),
+      "Creation timestamp",
+      fn(ctx) { Ok(get_field(ctx, "cts")) },
+    ),
+    schema.field(
+      "exp",
+      schema.string_type(),
+      "Optional expiration timestamp",
+      fn(ctx) { Ok(get_field(ctx, "exp")) },
+    ),
+  ])
+}
+
+/// Edge type for Label connection
+pub fn label_edge_type() -> schema.Type {
+  connection.edge_type("Label", label_type())
+}
+
+/// Connection type for paginated Label results
+pub fn label_connection_type() -> schema.Type {
+  connection.connection_type("Label", label_edge_type())
+}
+
+/// ReportReasonType enum
+pub fn report_reason_type_enum() -> schema.Type {
+  schema.enum_type("ReportReasonType", "Reason for submitting a report", [
+    schema.enum_value("SPAM", "Spam or unwanted content"),
+    schema.enum_value("VIOLATION", "Violates terms of service"),
+    schema.enum_value("MISLEADING", "Misleading or false information"),
+    schema.enum_value("SEXUAL", "Inappropriate sexual content"),
+    schema.enum_value("RUDE", "Rude or abusive behavior"),
+    schema.enum_value("OTHER", "Other reason"),
+  ])
+}
+
+/// ReportStatus enum
+pub fn report_status_enum() -> schema.Type {
+  schema.enum_type("ReportStatus", "Status of a moderation report", [
+    schema.enum_value("PENDING", "Awaiting review"),
+    schema.enum_value("RESOLVED", "Resolved with action"),
+    schema.enum_value("DISMISSED", "Dismissed without action"),
+  ])
+}
+
+/// ReportAction enum for resolving reports
+pub fn report_action_enum() -> schema.Type {
+  schema.enum_type("ReportAction", "Action to take when resolving a report", [
+    schema.enum_value("APPLY_LABEL", "Apply a label to the subject"),
+    schema.enum_value("DISMISS", "Dismiss the report without action"),
+  ])
+}
+
+/// Report type
+pub fn report_type() -> schema.Type {
+  schema.object_type("Report", "User-submitted moderation report", [
+    schema.field("id", schema.non_null(schema.int_type()), "Report ID", fn(ctx) {
+      Ok(get_field(ctx, "id"))
+    }),
+    schema.field(
+      "reporterDid",
+      schema.non_null(schema.string_type()),
+      "DID of reporter",
+      fn(ctx) { Ok(get_field(ctx, "reporterDid")) },
+    ),
+    schema.field(
+      "subjectUri",
+      schema.non_null(schema.string_type()),
+      "Subject URI (at:// or did:)",
+      fn(ctx) { Ok(get_field(ctx, "subjectUri")) },
+    ),
+    schema.field(
+      "reasonType",
+      schema.non_null(report_reason_type_enum()),
+      "Reason type",
+      fn(ctx) { Ok(get_field(ctx, "reasonType")) },
+    ),
+    schema.field(
+      "reason",
+      schema.string_type(),
+      "Optional free-text explanation",
+      fn(ctx) { Ok(get_field(ctx, "reason")) },
+    ),
+    schema.field(
+      "status",
+      schema.non_null(report_status_enum()),
+      "Report status",
+      fn(ctx) { Ok(get_field(ctx, "status")) },
+    ),
+    schema.field(
+      "resolvedBy",
+      schema.string_type(),
+      "DID of admin who resolved",
+      fn(ctx) { Ok(get_field(ctx, "resolvedBy")) },
+    ),
+    schema.field(
+      "resolvedAt",
+      schema.string_type(),
+      "Resolution timestamp",
+      fn(ctx) { Ok(get_field(ctx, "resolvedAt")) },
+    ),
+    schema.field(
+      "createdAt",
+      schema.non_null(schema.string_type()),
+      "Creation timestamp",
+      fn(ctx) { Ok(get_field(ctx, "createdAt")) },
+    ),
+  ])
+}
+
+/// Edge type for Report connection
+pub fn report_edge_type() -> schema.Type {
+  connection.edge_type("Report", report_type())
+}
+
+/// Connection type for paginated Report results
+pub fn report_connection_type() -> schema.Type {
+  connection.connection_type("Report", report_edge_type())
+}

server/src/graphql/lexicon/converters.gleam

···
 /// Transform database records and dynamic values to GraphQL value.Value objects
 import database/executor.{type Executor}
 import database/repositories/actors
+import database/repositories/label_definitions
 import database/types
 import gleam/dict
 import gleam/dynamic
 import gleam/dynamic/decode
 import gleam/json
 import gleam/list
+import gleam/string
 import swell/value
 
 /// Convert a database Record to a GraphQL value.Value
···
     _ -> Error(Nil)
   }
 }
+
+/// Convert a LabelPreference to GraphQL value
+/// Takes a label definition and the user's effective visibility setting
+pub fn label_preference_to_value(
+  def: label_definitions.LabelDefinition,
+  visibility: String,
+) -> value.Value {
+  value.Object([
+    #("val", value.String(def.val)),
+    #("description", value.String(def.description)),
+    #("severity", value.Enum(string.uppercase(def.severity))),
+    #("defaultVisibility", value.Enum(string.uppercase(def.default_visibility))),
+    #("visibility", value.Enum(string.uppercase(visibility))),
+  ])
+}

server/src/graphql/lexicon/fetchers.gleam

···
 import database/queries/aggregates
 import database/queries/pagination
 import database/repositories/actors
+import database/repositories/labels
 import database/repositories/records
 import database/types
 import gleam/dict
+import gleam/dynamic/decode
+import gleam/int
+import gleam/json
 import gleam/list
 import gleam/option
 import gleam/result
···
 import lexicon_graphql/schema/database
 import swell/value
 
+/// Filter out records with active takedown labels
+fn filter_takedowns(
+  db: Executor,
+  record_list: List(types.Record),
+) -> List(types.Record) {
+  let record_uris = list.map(record_list, fn(r) { r.uri })
+  let takedown_uris = case labels.get_takedown_uris(db, record_uris) {
+    Ok(uris) -> uris
+    Error(_) -> []
+  }
+  list.filter(record_list, fn(record) {
+    !list.contains(takedown_uris, record.uri)
+  })
+}
+
+/// Parse self-labels from a record's JSON if present
+/// Self-labels have format: {"$type": "com.atproto.label.defs#selfLabels", "values": [{"val": "..."}]}
+fn parse_self_labels_from_json(
+  json_str: String,
+  uri: String,
+) -> List(value.Value) {
+  // Decoder for self-labels structure
+  let self_labels_decoder = {
+    use type_field <- decode.field("$type", decode.string)
+    use values <- decode.field(
+      "values",
+      decode.list({
+        use val <- decode.field("val", decode.string)
+        decode.success(val)
+      }),
+    )
+    decode.success(#(type_field, values))
+  }
+
+  let labels_field_decoder = {
+    use labels <- decode.field("labels", self_labels_decoder)
+    decode.success(labels)
+  }
+
+  case json.parse(json_str, labels_field_decoder) {
+    Error(_) -> []
+    Ok(#(type_field, vals)) -> {
+      case type_field == "com.atproto.label.defs#selfLabels" {
+        False -> []
+        True -> {
+          // Extract DID from URI (at://did:plc:xxx/...)
+          let src = case string.split(uri, "/") {
+            ["at:", "", did, ..] -> did
+            _ -> ""
+          }
+          list.map(vals, fn(val) {
+            value.Object([
+              #("val", value.String(val)),
+              #("src", value.String(src)),
+              #("uri", value.String(uri)),
+              #("neg", value.Boolean(False)),
+              #("cts", value.Null),
+              #("exp", value.Null),
+              #("cid", value.Null),
+              #("id", value.Null),
+            ])
+          })
+        }
+      }
+    }
+  }
+}
+
 /// Create a record fetcher for paginated collection queries
 pub fn record_fetcher(db: Executor) {
   fn(collection_nsid: String, pagination_params: dataloader.PaginationParams) -> Result(
···
     }
 
     // Get total count for this collection (with where filter if present)
-    let total_count =
+    // Subtract takedown count for accurate pagination
+    let raw_count =
       records.get_collection_count_with_where(db, collection_nsid, where_clause)
-      |> result.map(option.Some)
-      |> result.unwrap(option.None)
+      |> result.unwrap(0)
+    let takedown_count =
+      labels.count_takedowns_for_collection(db, collection_nsid)
+      |> result.unwrap(0)
+    let total_count = option.Some(int.max(0, raw_count - takedown_count))
 
     // Fetch records from database for this collection with pagination
     case
···
       Error(_) -> Ok(#([], option.None, False, False, option.None))
       // Return empty result on error
       Ok(#(record_list, next_cursor, has_next_page, has_previous_page)) -> {
+        // Filter out records with takedown labels
+        let filtered_records = filter_takedowns(db, record_list)
+
         // Convert database records to GraphQL values with cursors
         let graphql_records_with_cursors =
-          list.map(record_list, fn(record) {
+          list.map(filtered_records, fn(record) {
             let graphql_value = converters.record_to_graphql_value(record, db)
             // Generate cursor for this record
             let record_cursor =
···
                 // DID join: fetch records by DID and collection
                 case records.get_by_dids_and_collection(db, uris, collection) {
                   Ok(record_list) -> {
+                    // Filter out records with takedown labels
+                    let filtered_records = filter_takedowns(db, record_list)
+
                     // Group records by DID
                     let grouped =
-                      list.fold(record_list, dict.new(), fn(acc, record) {
+                      list.fold(filtered_records, dict.new(), fn(acc, record) {
                         let graphql_value =
                           converters.record_to_graphql_value(record, db)
                         let existing =
···
                 // Forward join: fetch records by their URIs
                 case records.get_by_uris(db, uris) {
                   Ok(record_list) -> {
+                    // Filter out records with takedown labels
+                    let filtered_records = filter_takedowns(db, record_list)
+
                     // Group records by URI
                     let grouped =
-                      list.fold(record_list, dict.new(), fn(acc, record) {
+                      list.fold(filtered_records, dict.new(), fn(acc, record) {
                         let graphql_value =
                           converters.record_to_graphql_value(record, db)
                         // For forward joins, return single record per URI
···
           records.get_by_reference_field(db, collection, reference_field, uris)
         {
           Ok(record_list) -> {
+            // Filter out records with takedown labels
+            let filtered_records = filter_takedowns(db, record_list)
+
             // Group records by the parent URI they reference
             // Parse each record's JSON to extract the reference field value
             let grouped =
-              list.fold(record_list, dict.new(), fn(acc, record) {
+              list.fold(filtered_records, dict.new(), fn(acc, record) {
                 let graphql_value =
                   converters.record_to_graphql_value(record, db)
                 // Extract the reference field from the record JSON to find parent URI
···
             has_previous_page,
             total_count,
           )) -> {
+            // Filter out records with takedown labels
+            let filtered_records = filter_takedowns(db, record_list)
+
             // Convert records to GraphQL values with cursors
             let edges =
-              list.map(record_list, fn(record) {
+              list.map(filtered_records, fn(record) {
                 let graphql_value =
                   converters.record_to_graphql_value(record, db)
                 let cursor =
···
             has_previous_page,
             total_count,
           )) -> {
+            // Filter out records with takedown labels
+            let filtered_records = filter_takedowns(db, record_list)
+
             // Convert records to GraphQL values with cursors
             let edges =
-              list.map(record_list, fn(record) {
+              list.map(filtered_records, fn(record) {
                 let graphql_value =
                   converters.record_to_graphql_value(record, db)
                 let cursor =
···
     Ok(#(converted, end_cursor, has_next, has_prev))
   }
 }
+
+/// Create a labels fetcher for batch loading labels by URI
+/// Now accepts tuples of (uri, optional_record_json) to support self-labels
+pub fn labels_fetcher(db: Executor) {
+  fn(uris_with_json: List(#(String, option.Option(String)))) -> Result(
+    dict.Dict(String, List(value.Value)),
+    String,
+  ) {
+    let uris = list.map(uris_with_json, fn(pair) { pair.0 })
+
+    case labels.get_by_uris(db, uris) {
+      Ok(label_list) -> {
+        // Group moderator labels by URI
+        let mod_labels =
+          list.fold(label_list, dict.new(), fn(acc, label) {
+            let label_value =
+              value.Object([
+                #("id", value.Int(label.id)),
+                #("src", value.String(label.src)),
+                #("uri", value.String(label.uri)),
+                #("cid", case label.cid {
+                  option.Some(c) -> value.String(c)
+                  option.None -> value.Null
+                }),
+                #("val", value.String(label.val)),
+                #("neg", value.Boolean(label.neg)),
+                #("cts", value.String(label.cts)),
+                #("exp", case label.exp {
+                  option.Some(e) -> value.String(e)
+                  option.None -> value.Null
+                }),
+              ])
+            let existing = dict.get(acc, label.uri) |> result.unwrap([])
+            dict.insert(acc, label.uri, [label_value, ..existing])
+          })
+
+        // Merge with self-labels from record JSON
+        let merged =
+          list.fold(uris_with_json, mod_labels, fn(acc, pair) {
+            let #(uri, json_opt) = pair
+            case json_opt {
+              option.None -> acc
+              option.Some(json_str) -> {
+                let self_labels = parse_self_labels_from_json(json_str, uri)
+                case self_labels {
+                  [] -> acc
+                  _ -> {
+                    let existing = dict.get(acc, uri) |> result.unwrap([])
+                    dict.insert(acc, uri, list.append(self_labels, existing))
+                  }
+                }
+              }
+            }
+          })
+
+        Ok(merged)
+      }
+      Error(_) -> Error("Failed to fetch labels")
+    }
+  }
+}

server/src/graphql/lexicon/mutations.gleam

···
 import atproto_auth
 import backfill
 import database/executor.{type Executor}
+import database/repositories/label_definitions
+import database/repositories/label_preferences
 import database/repositories/lexicons
 import database/repositories/records
+import database/repositories/reports
 import dpop
 import gleam/dict
 import gleam/dynamic
···
 import gleam/list
 import gleam/option
 import gleam/result
+import gleam/string
 import honk
 import honk/errors
+import lexicon_graphql/input/union as union_input
 import lib/oauth/did_cache
 import pubsub
 import swell/schema
···
   )
 }
 
-// ─── Private Auth Helper ───────────────────────────────────────────
+// ─── Private Auth Helpers ───────────────────────────────────────────
 
 /// Authenticated session info returned by auth helper
 type AuthenticatedSession {
···
     user_info: atproto_auth.UserInfo,
     session: atproto_auth.AtprotoSession,
   )
+}
+
+/// Lightweight auth that only verifies the token
+/// Use this for mutations that don't need ATP session (e.g., label preferences)
+fn get_viewer_auth(
+  resolver_ctx: schema.Context,
+  db: executor.Executor,
+) -> Result(atproto_auth.UserInfo, String) {
+  // Extract auth token from context data
+  let token = case resolver_ctx.data {
+    option.Some(value.Object(fields)) -> {
+      case list.key_find(fields, "auth_token") {
+        Ok(value.String(t)) -> Ok(t)
+        Ok(_) -> Error("auth_token must be a string")
+        Error(_) ->
+          Error("Authentication required. Please provide Authorization header.")
+      }
+    }
+    _ -> Error("Authentication required. Please provide Authorization header.")
+  }
+
+  use token <- result.try(token)
+
+  // Verify OAuth token
+  atproto_auth.verify_token(db, token)
+  |> result.map_error(fn(err) {
+    case err {
+      atproto_auth.UnauthorizedToken -> "Unauthorized"
+      atproto_auth.TokenExpired -> "Token expired"
+      atproto_auth.MissingAuthHeader -> "Missing authentication"
+      atproto_auth.InvalidAuthHeader -> "Invalid authentication header"
+      _ -> "Authentication error"
+    }
+  })
 }
 
 /// Extract token, verify auth, ensure actor exists, get ATP session
···
   }
 }
 
+// ─── Private Union Helpers ────────────────────────────────────────
+
+/// Union field info: path to field and list of possible type refs
+type UnionFieldInfo {
+  UnionFieldInfo(path: List(String), refs: List(String))
+}
+
+/// Get union field info from a lexicon for a given collection
+fn get_union_fields(
+  collection: String,
+  lexicons: List(json.Json),
+) -> List(UnionFieldInfo) {
+  let lexicon =
+    list.find(lexicons, fn(lex) {
+      case json.parse(json.to_string(lex), decode.at(["id"], decode.string)) {
+        Ok(id) -> id == collection
+        Error(_) -> False
+      }
+    })
+
+  case lexicon {
+    Ok(lex) -> {
+      let properties_decoder =
+        decode.at(
+          ["defs", "main", "record", "properties"],
+          decode.dict(decode.string, decode.dynamic),
+        )
+      case json.parse(json.to_string(lex), properties_decoder) {
+        Ok(properties) -> extract_union_fields_from_properties(properties, [])
+        Error(_) -> []
+      }
+    }
+    Error(_) -> []
+  }
+}
+
+/// Recursively extract union fields from lexicon properties
+fn extract_union_fields_from_properties(
+  properties: dict.Dict(String, dynamic.Dynamic),
+  current_path: List(String),
+) -> List(UnionFieldInfo) {
+  dict.fold(properties, [], fn(acc, field_name, field_def) {
+    let field_path = list.append(current_path, [field_name])
+    let type_result = decode.run(field_def, decode.at(["type"], decode.string))
+
+    case type_result {
+      Ok("union") -> {
+        // Extract refs from the union definition
+        let refs_result =
+          decode.run(field_def, decode.at(["refs"], decode.list(decode.string)))
+        case refs_result {
+          Ok(refs) -> [UnionFieldInfo(path: field_path, refs: refs), ..acc]
+          Error(_) -> acc
+        }
+      }
+      Ok("object") -> {
+        let nested_props_result =
+          decode.run(
+            field_def,
+            decode.at(
+              ["properties"],
+              decode.dict(decode.string, decode.dynamic),
+            ),
+          )
+        case nested_props_result {
+          Ok(nested_props) -> {
+            let nested_fields =
+              extract_union_fields_from_properties(nested_props, field_path)
+            list.append(nested_fields, acc)
+          }
+          Error(_) -> acc
+        }
+      }
+      Ok("array") -> {
+        let items_type_result =
+          decode.run(field_def, decode.at(["items", "type"], decode.string))
+        case items_type_result {
+          Ok("union") -> {
+            let refs_result =
+              decode.run(
+                field_def,
+                decode.at(["items", "refs"], decode.list(decode.string)),
+              )
+            case refs_result {
+              Ok(refs) -> [UnionFieldInfo(path: field_path, refs: refs), ..acc]
+              Error(_) -> acc
+            }
+          }
+          Ok("object") -> {
+            let item_props_result =
+              decode.run(
+                field_def,
+                decode.at(
+                  ["items", "properties"],
+                  decode.dict(decode.string, decode.dynamic),
+                ),
+              )
+            case item_props_result {
+              Ok(item_props) -> {
+                let nested_fields =
+                  extract_union_fields_from_properties(item_props, field_path)
+                list.append(nested_fields, acc)
+              }
+              Error(_) -> acc
+            }
+          }
+          _ -> acc
+        }
+      }
+      _ -> acc
+    }
+  })
+}
+
+/// Transform union inputs by adding $type based on the discriminator
+fn transform_union_inputs(
+  input: value.Value,
+  union_fields: List(UnionFieldInfo),
+) -> value.Value {
+  transform_unions_at_paths(input, union_fields, [])
+}
+
+/// Recursively transform union values at specified paths
+fn transform_unions_at_paths(
+  val: value.Value,
+  union_fields: List(UnionFieldInfo),
+  current_path: List(String),
+) -> value.Value {
+  case val {
+    value.Object(fields) -> {
+      // Check if current path matches a union field
+      let matching_union =
+        list.find(union_fields, fn(uf) { uf.path == current_path })
+
+      case matching_union {
+        Ok(union_info) -> transform_union_object(fields, union_info.refs)
+        Error(_) -> {
+          // Recurse into object fields
+          value.Object(
+            list.map(fields, fn(field) {
+              let #(key, field_val) = field
+              let new_path = list.append(current_path, [key])
+              #(
+                key,
+                transform_unions_at_paths(field_val, union_fields, new_path),
+              )
+            }),
+          )
+        }
+      }
+    }
+    value.List(items) -> {
+      // Check if current path is a union array
+      let matching_union =
+        list.find(union_fields, fn(uf) { uf.path == current_path })
+
+      case matching_union {
+        Ok(union_info) -> {
+          // Transform each item in the array
+          value.List(
+            list.map(items, fn(item) {
+              case item {
+                value.Object(item_fields) ->
+                  transform_union_object(item_fields, union_info.refs)
+                _ -> item
+              }
+            }),
+          )
+        }
+        Error(_) -> {
+          // Recurse into list items
+          value.List(
+            list.map(items, fn(item) {
+              transform_unions_at_paths(item, union_fields, current_path)
+            }),
+          )
+        }
+      }
+    }
+    _ -> val
+  }
+}
+
+/// Transform a union object from GraphQL discriminated format to AT Protocol format
+/// GraphQL input: { type: "SELF_LABELS", selfLabels: { values: [...] } }
+/// AT Protocol output: { $type: "com.atproto.label.defs#selfLabels", values: [...] }
+fn transform_union_object(
+  fields: List(#(String, value.Value)),
+  refs: List(String),
+) -> value.Value {
+  // Find the "type" discriminator field
+  let type_field = list.key_find(fields, "type")
+
+  case type_field {
+    Ok(value.Enum(enum_value)) -> {
+      // Convert enum value back to ref
+      let matching_ref = find_ref_for_enum_value(enum_value, refs)
+      case matching_ref {
+        Ok(ref) -> {
+          // Find the variant field (same name as the short ref name)
+          let short_name = enum_value_to_short_name(enum_value)
+          case list.key_find(fields, short_name) {
+            Ok(value.Object(variant_fields)) -> {
+              // Build AT Protocol format: variant fields + $type
+              value.Object([#("$type", value.String(ref)), ..variant_fields])
+            }
+            _ -> {
+              // No variant data, just return $type
+              value.Object([#("$type", value.String(ref))])
+            }
+          }
+        }
+        Error(_) -> value.Object(fields)
+      }
+    }
+    Ok(value.String(str_value)) -> {
+      // Handle string type discriminator (fallback)
+      let matching_ref = find_ref_for_enum_value(str_value, refs)
+      case matching_ref {
+        Ok(ref) -> {
+          let short_name = enum_value_to_short_name(str_value)
+          case list.key_find(fields, short_name) {
+            Ok(value.Object(variant_fields)) -> {
+              value.Object([#("$type", value.String(ref)), ..variant_fields])
+            }
+            _ -> value.Object([#("$type", value.String(ref))])
+          }
+        }
+        Error(_) -> value.Object(fields)
+      }
+    }
+    _ -> value.Object(fields)
+  }
+}
+
+/// Find the ref that matches an enum value
+/// "SELF_LABELS" matches "com.atproto.label.defs#selfLabels"
+fn find_ref_for_enum_value(
+  enum_value: String,
+  refs: List(String),
+) -> Result(String, Nil) {
+  list.find(refs, fn(ref) { union_input.ref_to_enum_value(ref) == enum_value })
+}
+
+/// Convert SCREAMING_SNAKE_CASE to camelCase for field lookup
+/// "SELF_LABELS" -> "selfLabels"
+fn enum_value_to_short_name(enum_value: String) -> String {
+  union_input.screaming_snake_to_camel(enum_value)
+}
+
 /// Decode base64 string to bit array
 fn decode_base64(base64_str: String) -> Result(BitArray, Nil) {
   Ok(do_erlang_base64_decode(base64_str))
···
 
     // Transform blob inputs from GraphQL format to AT Protocol format
     let blob_paths = get_blob_paths(collection, all_lex_jsons)
-    let transformed_input = transform_blob_inputs(input, blob_paths)
+    let blob_transformed = transform_blob_inputs(input, blob_paths)
+
+    // Transform union inputs from GraphQL discriminated format to AT Protocol format
+    let union_fields = get_union_fields(collection, all_lex_jsons)
+    let transformed_input =
+      transform_union_inputs(blob_transformed, union_fields)
+
     let record_json_value = graphql_value_to_json_value(transformed_input)
     let record_json_string = json.to_string(record_json_value)
 
···
 
     // Transform blob inputs from GraphQL format to AT Protocol format
     let blob_paths = get_blob_paths(collection, all_lex_jsons)
-    let transformed_input = transform_blob_inputs(input, blob_paths)
+    let blob_transformed = transform_blob_inputs(input, blob_paths)
+
+    // Transform union inputs from GraphQL discriminated format to AT Protocol format
+    let union_fields = get_union_fields(collection, all_lex_jsons)
+    let transformed_input =
+      transform_union_inputs(blob_transformed, union_fields)
+
     let record_json_value = graphql_value_to_json_value(transformed_input)
     let record_json_string = json.to_string(record_json_value)
 
···
     Ok(blob_ref)
   }
 }
+
+/// Create a resolver for createReport mutation
+/// Allows authenticated users to submit moderation reports
+pub fn create_report_resolver_factory(ctx: MutationContext) -> schema.Resolver {
+  fn(resolver_ctx: schema.Context) -> Result(value.Value, String) {
+    // Get authenticated session using helper
+    use auth <- result.try(get_authenticated_session(resolver_ctx, ctx))
+
+    // Get subjectUri (required) and reasonType (required) from arguments
+    let subject_uri_result = case
+      schema.get_argument(resolver_ctx, "subjectUri")
+    {
+      option.Some(value.String(u)) -> Ok(u)
+      option.Some(_) -> Error("subjectUri must be a string")
+      option.None -> Error("Missing required argument: subjectUri")
+    }
+
+    use subject_uri <- result.try(subject_uri_result)
+
+    let reason_type_result = case
+      schema.get_argument(resolver_ctx, "reasonType")
+    {
+      option.Some(value.Enum(r)) -> Ok(string.lowercase(r))
+      option.Some(value.String(r)) -> Ok(string.lowercase(r))
+      option.Some(_) -> Error("reasonType must be a string")
+      option.None -> Error("Missing required argument: reasonType")
+    }
+
+    use reason_type <- result.try(reason_type_result)
+
+    // Validate reason_type
+    let valid_reasons = [
+      "spam",
+      "violation",
+      "misleading",
+      "sexual",
+      "rude",
+      "other",
+    ]
+    use _ <- result.try(case list.contains(valid_reasons, reason_type) {
+      True -> Ok(Nil)
+      False ->
+        Error(
+          "Invalid reasonType. Must be one of: "
+          <> string.join(valid_reasons, ", "),
+        )
+    })
+
+    // Get optional reason text
+    let reason = case schema.get_argument(resolver_ctx, "reason") {
+      option.Some(value.String(r)) -> option.Some(r)
+      _ -> option.None
+    }
+
+    // Insert the report
+    use report <- result.try(
+      reports.insert(
+        ctx.db,
+        auth.user_info.did,
+        subject_uri,
+        reason_type,
+        reason,
+      )
+      |> result.map_error(fn(_) { "Failed to create report" }),
+    )
+
+    // Return the created report
+    let reason_value = case report.reason {
+      option.Some(r) -> value.String(r)
+      option.None -> value.Null
+    }
+
+    Ok(
+      value.Object([
+        #("id", value.Int(report.id)),
+        #("reporterDid", value.String(report.reporter_did)),
+        #("subjectUri", value.String(report.subject_uri)),
+        #("reasonType", value.Enum(string.uppercase(report.reason_type))),
+        #("reason", reason_value),
+        #("status", value.Enum("PENDING")),
+        #("createdAt", value.String(report.created_at)),
+      ]),
+    )
+  }
+}
+
+// ─── Label Preference Mutation ────────────────────────────────────────────
+
+/// Resolver factory for setLabelPreference mutation
+pub fn set_label_preference_resolver_factory(
+  ctx: MutationContext,
+) -> schema.Resolver {
+  fn(resolver_ctx: schema.Context) -> Result(value.Value, String) {
+    // Get viewer auth (lightweight - no ATP session needed)
+    use user_info <- result.try(get_viewer_auth(resolver_ctx, ctx.db))
+
+    // Get val (required) argument
+    let val_result = case schema.get_argument(resolver_ctx, "val") {
+      option.Some(value.String(v)) -> Ok(v)
+      option.Some(_) -> Error("val must be a string")
+      option.None -> Error("Missing required argument: val")
+    }
+
+    use val <- result.try(val_result)
+
+    // Get visibility (required) argument
+    let visibility_result = case
+      schema.get_argument(resolver_ctx, "visibility")
+    {
+      option.Some(value.Enum(v)) -> Ok(string.lowercase(v))
+      option.Some(value.String(v)) -> Ok(string.lowercase(v))
+      option.Some(_) -> Error("visibility must be a valid enum value")
+      option.None -> Error("Missing required argument: visibility")
+    }
+
+    use visibility <- result.try(visibility_result)
+
+    // Validate not a system label (starts with !)
+    use _ <- result.try(case string.starts_with(val, "!") {
+      True -> Error("Cannot set preference for system labels")
+      False -> Ok(Nil)
+    })
+
+    // Validate visibility is a valid value
+    use _ <- result.try(label_definitions.validate_visibility(visibility))
+
+    // Validate label exists
+    use def <- result.try(case label_definitions.get(ctx.db, val) {
+      Ok(option.None) -> Error("Unknown label: " <> val)
+      Error(_) -> Error("Failed to validate label")
+      Ok(option.Some(d)) -> Ok(d)
+    })
+
+    // Set the preference
+    use _ <- result.try(
+      label_preferences.set(ctx.db, user_info.did, val, visibility)
+      |> result.map_error(fn(_) { "Failed to set label preference" }),
+    )
+
+    // Return the updated preference
+    Ok(
+      value.Object([
+        #("val", value.String(def.val)),
+        #("description", value.String(def.description)),
+        #("severity", value.Enum(string.uppercase(def.severity))),
+        #(
+          "defaultVisibility",
+          value.Enum(string.uppercase(def.default_visibility)),
+        ),
+        #("visibility", value.Enum(string.uppercase(visibility))),
+      ]),
+    )
+  }
+}

server/src/graphql/lexicon/schema.gleam

···
 import backfill
 import database/executor.{type Executor}
 import database/repositories/config as config_repo
+import database/repositories/label_definitions
+import database/repositories/label_preferences
 import database/repositories/lexicons
 import gleam/dict
 import gleam/dynamic/decode
···
 import gleam/option
 import gleam/result
 import gleam/string
+import graphql/admin/types as admin_types
 import graphql/lexicon/converters
 import graphql/lexicon/fetchers
 import graphql/lexicon/mutations
···
       // Step 7: Create viewer state fetcher
       let viewer_state_fetcher = fetchers.viewer_state_fetcher(db)
 
-      // Step 8: Build schema with database-backed resolvers, mutations, and subscriptions
+      // Step 8: Create labels fetcher
+      let labels_fetch = fetchers.labels_fetcher(db)
+
+      // Step 9: Build createReport mutation field
+      let create_report_field =
+        schema.field_with_args(
+          "createReport",
+          schema.non_null(admin_types.report_type()),
+          "Submit a moderation report for content",
+          [
+            schema.argument(
+              "subjectUri",
+              schema.non_null(schema.string_type()),
+              "URI of the content to report (at:// or did:)",
+              option.None,
+            ),
+            schema.argument(
+              "reasonType",
+              schema.non_null(admin_types.report_reason_type_enum()),
+              "Type of report",
+              option.None,
+            ),
+            schema.argument(
+              "reason",
+              schema.string_type(),
+              "Optional additional details",
+              option.None,
+            ),
+          ],
+          mutations.create_report_resolver_factory(mutation_ctx),
+        )
+
+      // Step 9b: Build setLabelPreference mutation field
+      let set_label_pref_field =
+        schema.field_with_args(
+          "setLabelPreference",
+          schema.non_null(admin_types.label_preference_type()),
+          "Set visibility preference for a label type",
+          [
+            schema.argument(
+              "val",
+              schema.non_null(schema.string_type()),
+              "Label value",
+              option.None,
+            ),
+            schema.argument(
+              "visibility",
+              schema.non_null(admin_types.label_visibility_enum()),
+              "Visibility setting",
+              option.None,
+            ),
+          ],
+          mutations.set_label_preference_resolver_factory(mutation_ctx),
+        )
+
+      // Step 10: Build viewerLabelPreferences query field
+      let viewer_label_prefs_field =
+        schema.field(
+          "viewerLabelPreferences",
+          schema.non_null(
+            schema.list_type(
+              schema.non_null(admin_types.label_preference_type()),
+            ),
+          ),
+          "Get label preferences for the current user (non-system labels only)",
+          fn(ctx) {
+            // Get viewer_did from context variables (set by auth middleware)
+            case schema.get_variable(ctx, "viewer_did") {
+              option.Some(value.String(viewer_did)) -> {
+                // Get non-system label definitions
+                case label_definitions.get_non_system(mutation_ctx.db) {
+                  Ok(defs) -> {
+                    // Get user's preferences
+                    case
+                      label_preferences.get_by_did(mutation_ctx.db, viewer_did)
+                    {
+                      Ok(prefs) -> {
+                        // Build a map of label_val -> visibility
+                        let pref_map =
+                          list.fold(prefs, [], fn(acc, pref) {
+                            [#(pref.label_val, pref.visibility), ..acc]
+                          })
+
+                        // Map each definition to a preference
+                        let result =
+                          list.map(defs, fn(def) {
+                            let visibility = case
+                              list.key_find(pref_map, def.val)
+                            {
+                              Ok(v) -> v
+                              Error(_) -> def.default_visibility
+                            }
+                            converters.label_preference_to_value(
+                              def,
+                              visibility,
+                            )
+                          })
+
+                        Ok(value.List(result))
+                      }
+                      Error(_) -> Error("Failed to fetch label preferences")
+                    }
+                  }
+                  Error(_) -> Error("Failed to fetch label definitions")
+                }
+              }
+              _ -> Error("Authentication required")
+            }
+          },
+        )
+
+      // Step 11: Build schema with database-backed resolvers, mutations, and subscriptions
       database.build_schema_with_subscriptions(
         parsed_lexicons,
         record_fetcher,
···
         option.Some(viewer_fetcher),
         option.Some(notification_fetcher),
         option.Some(viewer_state_fetcher),
+        option.Some(labels_fetch),
+        option.Some([create_report_field, set_label_pref_field]),
+        option.Some([viewer_label_prefs_field]),
       )
     }
   }

server/src/handlers/graphiql.gleam

···
   |> wisp.set_header("content-type", "text/html; charset=utf-8")
   |> wisp.set_body(wisp.Text(graphiql_html))
 }
+
+pub fn handle_admin_graphiql_request(
+  req: wisp.Request,
+  db: Executor,
+  did_cache: Subject(did_cache.Message),
+) -> wisp.Response {
+  // Get token from session if logged in
+  let oauth_token = case session.get_current_user(req, db, did_cache) {
+    Ok(#(_did, _handle, access_token)) -> access_token
+    Error(_) -> ""
+  }
+  let graphiql_html = "<!doctype html>
+<html lang=\"en\">
+  <head>
+    <meta charset=\"UTF-8\" />
+    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />
+    <title>quickslice Admin GraphiQL</title>
+    <style>
+      body {
+        margin: 0;
+      }
+
+      #graphiql {
+        height: 100dvh;
+      }
+
+      .loading {
+        height: 100%;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        font-size: 4rem;
+      }
+    </style>
+    <link rel=\"stylesheet\" href=\"https://esm.sh/graphiql/dist/style.css\" />
+    <link
+      rel=\"stylesheet\"
+      href=\"https://esm.sh/@graphiql/plugin-explorer/dist/style.css\"
+    />
+    <script type=\"importmap\">
+      {
+        \"imports\": {
+          \"react\": \"https://esm.sh/react@19.1.0\",
+          \"react/\": \"https://esm.sh/react@19.1.0/\",
+
+          \"react-dom\": \"https://esm.sh/react-dom@19.1.0\",
+          \"react-dom/\": \"https://esm.sh/react-dom@19.1.0/\",
+
+          \"graphiql\": \"https://esm.sh/graphiql?standalone&external=react,react-dom,@graphiql/react,graphql\",
+          \"graphiql/\": \"https://esm.sh/graphiql/\",
+          \"@graphiql/plugin-explorer\": \"https://esm.sh/@graphiql/plugin-explorer?standalone&external=react,@graphiql/react,graphql\",
+          \"@graphiql/react\": \"https://esm.sh/@graphiql/react?standalone&external=react,react-dom,graphql,@graphiql/toolkit,@emotion/is-prop-valid\",
+
+          \"@graphiql/toolkit\": \"https://esm.sh/@graphiql/toolkit?standalone&external=graphql\",
+          \"graphql\": \"https://esm.sh/graphql@16.11.0\",
+          \"@emotion/is-prop-valid\": \"data:text/javascript,\"
+        }
+      }
+    </script>
+    <script type=\"module\">
+      import React from 'react';
+      import ReactDOM from 'react-dom/client';
+      import { GraphiQL, HISTORY_PLUGIN } from 'graphiql';
+      import { createGraphiQLFetcher } from '@graphiql/toolkit';
+      import { explorerPlugin } from '@graphiql/plugin-explorer';
+      import 'graphiql/setup-workers/esm.sh';
+
+      const token = '" <> oauth_token <> "';
+      const fetcher = createGraphiQLFetcher({
+        url: '/admin/graphql',
+        headers: token ? {
+          'Authorization': token
+        } : {}
+      });
+      const plugins = [HISTORY_PLUGIN, explorerPlugin()];
+
+      function App() {
+        return React.createElement(GraphiQL, {
+          fetcher,
+          plugins,
+          defaultEditorToolsVisibility: true,
+        });
+      }
+
+      const container = document.getElementById('graphiql');
+      const root = ReactDOM.createRoot(container);
+      root.render(React.createElement(App));
+    </script>
+  </head>
+  <body>
+    <div id=\"graphiql\">
+      <div class=\"loading\">Loading…</div>
+    </div>
+  </body>
+</html>"
+
+  wisp.response(200)
+  |> wisp.set_header("content-type", "text/html; charset=utf-8")
+  |> wisp.set_body(wisp.Text(graphiql_html))
+}

server/src/server.gleam

···
       )
     ["graphiql"] ->
       graphiql_handler.handle_graphiql_request(req, ctx.db, ctx.did_cache)
+    ["graphiql", "admin"] ->
+      graphiql_handler.handle_admin_graphiql_request(req, ctx.db, ctx.did_cache)
     // MCP endpoint for AI assistant introspection
     ["mcp"] -> {
       let mcp_ctx =

server/test/graphql/admin/connection_test.gleam

···
+/// Integration tests for admin connection pagination
+///
+/// Tests that labels and reports return proper connection structure
+/// with edges, pageInfo, and totalCount
+import database/repositories/labels
+import database/repositories/reports
+import gleam/list
+import gleam/option
+import gleeunit/should
+import test_helpers
+
+// =============================================================================
+// Labels Connection Pagination Tests
+// =============================================================================
+
+pub fn labels_get_paginated_returns_correct_structure_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let src = "did:plc:admin123"
+
+  // Insert 5 labels
+  let assert Ok(_) =
+    labels.insert(
+      db,
+      src,
+      "at://did:plc:user1/app.bsky.feed.post/1",
+      option.None,
+      "spam",
+      option.None,
+    )
+  let assert Ok(_) =
+    labels.insert(
+      db,
+      src,
+      "at://did:plc:user2/app.bsky.feed.post/2",
+      option.None,
+      "spam",
+      option.None,
+    )
+  let assert Ok(_) =
+    labels.insert(
+      db,
+      src,
+      "at://did:plc:user3/app.bsky.feed.post/3",
+      option.None,
+      "spam",
+      option.None,
+    )
+  let assert Ok(_) =
+    labels.insert(
+      db,
+      src,
+      "at://did:plc:user4/app.bsky.feed.post/4",
+      option.None,
+      "!warn",
+      option.None,
+    )
+  let assert Ok(_) =
+    labels.insert(
+      db,
+      src,
+      "at://did:plc:user5/app.bsky.feed.post/5",
+      option.None,
+      "spam",
+      option.None,
+    )
+
+  // Get first 2 labels
+  let assert Ok(paginated) =
+    labels.get_paginated(db, option.None, option.None, 2, option.None)
+
+  // Should return 2 labels
+  paginated.labels |> list.length() |> should.equal(2)
+  // Should have next page (3 more labels)
+  paginated.has_next_page |> should.equal(True)
+  // Total count should be 5
+  paginated.total_count |> should.equal(5)
+}
+
+pub fn labels_get_paginated_with_filter_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let src = "did:plc:admin123"
+
+  // Insert labels with different vals
+  let assert Ok(_) =
+    labels.insert(
+      db,
+      src,
+      "at://did:plc:user1/app.bsky.feed.post/1",
+      option.None,
+      "spam",
+      option.None,
+    )
+  let assert Ok(_) =
+    labels.insert(
+      db,
+      src,
+      "at://did:plc:user2/app.bsky.feed.post/2",
+      option.None,
+      "!warn",
+      option.None,
+    )
+  let assert Ok(_) =
+    labels.insert(
+      db,
+      src,
+      "at://did:plc:user3/app.bsky.feed.post/3",
+      option.None,
+      "spam",
+      option.None,
+    )
+
+  // Filter by val = "spam"
+  let assert Ok(paginated) =
+    labels.get_paginated(db, option.None, option.Some("spam"), 10, option.None)
+
+  // Should return 2 spam labels
+  paginated.labels |> list.length() |> should.equal(2)
+  // No next page
+  paginated.has_next_page |> should.equal(False)
+  // Total count of spam labels is 2
+  paginated.total_count |> should.equal(2)
+}
+
+pub fn labels_get_paginated_with_cursor_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let src = "did:plc:admin123"
+
+  // Insert 4 labels
+  let assert Ok(_) =
+    labels.insert(
+      db,
+      src,
+      "at://did:plc:user1/app.bsky.feed.post/1",
+      option.None,
+      "spam",
+      option.None,
+    )
+  let assert Ok(_) =
+    labels.insert(
+      db,
+      src,
+      "at://did:plc:user2/app.bsky.feed.post/2",
+      option.None,
+      "spam",
+      option.None,
+    )
+  let assert Ok(_) =
+    labels.insert(
+      db,
+      src,
+      "at://did:plc:user3/app.bsky.feed.post/3",
+      option.None,
+      "spam",
+      option.None,
+    )
+  let assert Ok(_) =
+    labels.insert(
+      db,
+      src,
+      "at://did:plc:user4/app.bsky.feed.post/4",
+      option.None,
+      "spam",
+      option.None,
+    )
+
+  // Get first page (2 items)
+  let assert Ok(page1) =
+    labels.get_paginated(db, option.None, option.None, 2, option.None)
+
+  page1.labels |> list.length() |> should.equal(2)
+  page1.has_next_page |> should.equal(True)
+  page1.total_count |> should.equal(4)
+
+  // Get last item from first page to use as cursor
+  let assert Ok(last_label) = list.last(page1.labels)
+
+  // Get second page using cursor
+  let assert Ok(page2) =
+    labels.get_paginated(
+      db,
+      option.None,
+      option.None,
+      2,
+      option.Some(last_label.id),
+    )
+
+  page2.labels |> list.length() |> should.equal(2)
+  page2.has_next_page |> should.equal(False)
+  // Total count is still 4 (cursor doesn't affect total)
+  page2.total_count |> should.equal(4)
+
+  // Verify second page has different labels (lower IDs)
+  let assert Ok(first_label_page2) = list.first(page2.labels)
+  { first_label_page2.id < last_label.id } |> should.equal(True)
+}
+
+pub fn labels_get_paginated_empty_result_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  // Get paginated with no labels
+  let assert Ok(paginated) =
+    labels.get_paginated(db, option.None, option.None, 10, option.None)
+
+  paginated.labels |> list.length() |> should.equal(0)
+  paginated.has_next_page |> should.equal(False)
+  paginated.total_count |> should.equal(0)
+}
+
+// =============================================================================
+// Reports Connection Pagination Tests
+// =============================================================================
+
+pub fn reports_get_paginated_returns_correct_structure_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let reporter = "did:plc:reporter123"
+
+  // Insert 4 reports
+  let assert Ok(_) =
+    reports.insert(db, reporter, "at://did/post/1", "spam", option.None)
+  let assert Ok(_) =
+    reports.insert(db, reporter, "at://did/post/2", "violation", option.None)
+  let assert Ok(_) =
+    reports.insert(db, reporter, "at://did/post/3", "rude", option.None)
+  let assert Ok(_) =
+    reports.insert(db, reporter, "at://did/post/4", "spam", option.None)
+
+  // Get first 2 reports
+  let assert Ok(paginated) =
+    reports.get_paginated(db, option.None, 2, option.None)
+
+  paginated.reports |> list.length() |> should.equal(2)
+  paginated.has_next_page |> should.equal(True)
+  paginated.total_count |> should.equal(4)
+}
+
+pub fn reports_get_paginated_with_status_filter_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let reporter = "did:plc:reporter123"
+  let admin = "did:plc:admin123"
+
+  // Insert reports
+  let assert Ok(report1) =
+    reports.insert(db, reporter, "at://did/post/1", "spam", option.None)
+  let assert Ok(_) =
+    reports.insert(db, reporter, "at://did/post/2", "violation", option.None)
+  let assert Ok(_) =
+    reports.insert(db, reporter, "at://did/post/3", "rude", option.None)
+
+  // Resolve first report
+  let assert Ok(_) = reports.resolve(db, report1.id, "resolved", admin)
+
+  // Filter by status = "pending"
+  let assert Ok(paginated) =
+    reports.get_paginated(db, option.Some("pending"), 10, option.None)
+
+  paginated.reports |> list.length() |> should.equal(2)
+  paginated.has_next_page |> should.equal(False)
+  paginated.total_count |> should.equal(2)
+}
+
+pub fn reports_get_paginated_with_cursor_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let reporter = "did:plc:reporter123"
+
+  // Insert 4 reports
+  let assert Ok(_) =
+    reports.insert(db, reporter, "at://did/post/1", "spam", option.None)
+  let assert Ok(_) =
+    reports.insert(db, reporter, "at://did/post/2", "spam", option.None)
+  let assert Ok(_) =
+    reports.insert(db, reporter, "at://did/post/3", "spam", option.None)
+  let assert Ok(_) =
+    reports.insert(db, reporter, "at://did/post/4", "spam", option.None)
+
+  // Get first page
+  let assert Ok(page1) = reports.get_paginated(db, option.None, 2, option.None)
+
+  page1.reports |> list.length() |> should.equal(2)
+  page1.has_next_page |> should.equal(True)
+
+  // Get last item from first page
+  let assert Ok(last_report) = list.last(page1.reports)
+
+  // Get second page using cursor
+  let assert Ok(page2) =
+    reports.get_paginated(db, option.None, 2, option.Some(last_report.id))
+
+  page2.reports |> list.length() |> should.equal(2)
+  page2.has_next_page |> should.equal(False)
+  page2.total_count |> should.equal(4)
+}

server/test/graphql/admin/cursor_test.gleam

···
+import gleeunit/should
+import graphql/admin/cursor
+
+pub fn encode_cursor_test() {
+  cursor.encode("Label", 42)
+  |> should.equal("TGFiZWw6NDI=")
+}
+
+pub fn encode_cursor_with_large_id_test() {
+  cursor.encode("Report", 12_345)
+  |> should.equal("UmVwb3J0OjEyMzQ1")
+}
+
+pub fn decode_cursor_test() {
+  cursor.decode("TGFiZWw6NDI=")
+  |> should.equal(Ok(#("Label", 42)))
+}
+
+pub fn decode_cursor_with_large_id_test() {
+  cursor.decode("UmVwb3J0OjEyMzQ1")
+  |> should.equal(Ok(#("Report", 12_345)))
+}
+
+pub fn decode_invalid_cursor_test() {
+  cursor.decode("not-valid-base64!!!")
+  |> should.be_error()
+}
+
+pub fn decode_malformed_cursor_test() {
+  // Valid base64 but wrong format (no colon)
+  cursor.decode("bm9jb2xvbg==")
+  |> should.be_error()
+}

server/test/groupby_enum_validation_test.gleam

···
       option.None,
       option.None,
       option.None,
+      option.None,
+      option.None,
+      option.None,
     )
 
   // Introspection query to check if AppBskyFeedPostGroupByField enum exists
···
       option.None,
       option.None,
       option.Some(stub_aggregate_fetcher),
+      option.None,
+      option.None,
+      option.None,
       option.None,
       option.None,
       option.None,

server/test/label_preferences_integration_test.gleam

···
+/// Integration tests for viewer label preferences
+///
+/// Tests the viewerLabelPreferences query and setLabelPreference mutation
+/// via the GraphQL API endpoint
+import database/repositories/lexicons
+import gleam/http
+import gleam/json
+import gleam/option.{None}
+import gleam/string
+import gleeunit/should
+import handlers/graphql as graphql_handler
+import lib/oauth/did_cache
+import test_helpers
+import wisp
+import wisp/simulate
+
+/// Create a minimal lexicon for schema building
+fn create_minimal_lexicon() -> String {
+  json.object([
+    #("lexicon", json.int(1)),
+    #("id", json.string("test.minimal.record")),
+    #(
+      "defs",
+      json.object([
+        #(
+          "main",
+          json.object([
+            #("type", json.string("record")),
+            #("key", json.string("tid")),
+            #(
+              "record",
+              json.object([
+                #("type", json.string("object")),
+                #(
+                  "required",
+                  json.array([json.string("name")], of: fn(x) { x }),
+                ),
+                #(
+                  "properties",
+                  json.object([
+                    #("name", json.object([#("type", json.string("string"))])),
+                  ]),
+                ),
+              ]),
+            ),
+          ]),
+        ),
+      ]),
+    ),
+  ])
+  |> json.to_string
+}
+
+/// Test: viewerLabelPreferences returns non-system labels with default visibility
+pub fn viewer_label_preferences_returns_defaults_test() {
+  // Setup database with moderation tables
+  let assert Ok(exec) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_core_tables(exec)
+  let assert Ok(_) = test_helpers.create_oauth_tables(exec)
+  let assert Ok(_) = test_helpers.create_moderation_tables(exec)
+  let assert Ok(_) =
+    test_helpers.insert_test_token(exec, "test-viewer-token", "did:plc:viewer")
+  // Insert a minimal lexicon so schema can build
+  let assert Ok(_) =
+    lexicons.insert(exec, "test.minimal.record", create_minimal_lexicon())
+
+  // Query for viewer label preferences
+  let query =
+    json.object([
+      #(
+        "query",
+        json.string(
+          "{ viewerLabelPreferences { val description defaultVisibility visibility } }",
+        ),
+      ),
+    ])
+    |> json.to_string
+
+  let request =
+    simulate.request(http.Post, "/graphql")
+    |> simulate.string_body(query)
+    |> simulate.header("content-type", "application/json")
+    |> simulate.header("authorization", "Bearer test-viewer-token")
+
+  let assert Ok(cache) = did_cache.start()
+  let response =
+    graphql_handler.handle_graphql_request(request, exec, cache, None, "", "")
+
+  let assert wisp.Text(body) = response.body
+
+  // Query should succeed
+  response.status |> should.equal(200)
+
+  // Should contain non-system labels (porn, spam, sexual, nudity)
+  string.contains(body, "porn") |> should.be_true
+  string.contains(body, "spam") |> should.be_true
+  string.contains(body, "sexual") |> should.be_true
+  string.contains(body, "nudity") |> should.be_true
+
+  // Should NOT contain system labels (starting with !)
+  string.contains(body, "!takedown") |> should.be_false
+  string.contains(body, "!suspend") |> should.be_false
+  string.contains(body, "!warn") |> should.be_false
+  string.contains(body, "!hide") |> should.be_false
+
+  // Should have visibility field with default values
+  string.contains(body, "visibility") |> should.be_true
+}
+
+/// Test: viewerLabelPreferences requires authentication
+pub fn viewer_label_preferences_requires_auth_test() {
+  // Setup database
+  let assert Ok(exec) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_core_tables(exec)
+  let assert Ok(_) = test_helpers.create_oauth_tables(exec)
+  let assert Ok(_) = test_helpers.create_moderation_tables(exec)
+  // Insert a minimal lexicon so schema can build
+  let assert Ok(_) =
+    lexicons.insert(exec, "test.minimal.record", create_minimal_lexicon())
+
+  // Query WITHOUT auth token
+  let query =
+    json.object([
+      #("query", json.string("{ viewerLabelPreferences { val visibility } }")),
+    ])
+    |> json.to_string
+
+  let request =
+    simulate.request(http.Post, "/graphql")
+    |> simulate.string_body(query)
+    |> simulate.header("content-type", "application/json")
+
+  let assert Ok(cache) = did_cache.start()
+  let response =
+    graphql_handler.handle_graphql_request(request, exec, cache, None, "", "")
+
+  let assert wisp.Text(body) = response.body
+
+  // Should return error about authentication
+  string.contains(body, "error") |> should.be_true
+  string.contains(body, "Authentication") |> should.be_true
+}
+
+/// Test: setLabelPreference updates visibility for non-system label
+pub fn set_label_preference_updates_visibility_test() {
+  // Setup database
+  let assert Ok(exec) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_core_tables(exec)
+  let assert Ok(_) = test_helpers.create_oauth_tables(exec)
+  let assert Ok(_) = test_helpers.create_moderation_tables(exec)
+  let assert Ok(_) =
+    test_helpers.insert_test_token(exec, "test-viewer-token", "did:plc:viewer")
+  // Insert a minimal lexicon so schema can build
+  let assert Ok(_) =
+    lexicons.insert(exec, "test.minimal.record", create_minimal_lexicon())
+
+  // Set preference for 'spam' label to 'hide'
+  let mutation =
+    json.object([
+      #(
+        "query",
+        json.string(
+          "mutation { setLabelPreference(val: \"spam\", visibility: HIDE) { val visibility } }",
+        ),
+      ),
+    ])
+    |> json.to_string
+
+  let request =
+    simulate.request(http.Post, "/graphql")
+    |> simulate.string_body(mutation)
+    |> simulate.header("content-type", "application/json")
+    |> simulate.header("authorization", "Bearer test-viewer-token")
+
+  let assert Ok(cache) = did_cache.start()
+  let response =
+    graphql_handler.handle_graphql_request(request, exec, cache, None, "", "")
+
+  let assert wisp.Text(body) = response.body
+
+  // Mutation should succeed
+  response.status |> should.equal(200)
+
+  // Should return the updated preference
+  string.contains(body, "spam") |> should.be_true
+  string.contains(body, "HIDE") |> should.be_true
+
+  // Verify the preference persisted by querying again
+  let query =
+    json.object([
+      #("query", json.string("{ viewerLabelPreferences { val visibility } }")),
+    ])
+    |> json.to_string
+
+  let verify_request =
+    simulate.request(http.Post, "/graphql")
+    |> simulate.string_body(query)
+    |> simulate.header("content-type", "application/json")
+    |> simulate.header("authorization", "Bearer test-viewer-token")
+
+  let verify_response =
+    graphql_handler.handle_graphql_request(
+      verify_request,
+      exec,
+      cache,
+      None,
+      "",
+      "",
+    )
+
+  let assert wisp.Text(verify_body) = verify_response.body
+
+  // Should show the updated visibility for spam
+  string.contains(verify_body, "HIDE") |> should.be_true
+}
+
+/// Test: setLabelPreference rejects system labels (starting with !)
+pub fn set_label_preference_rejects_system_labels_test() {
+  // Setup database
+  let assert Ok(exec) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_core_tables(exec)
+  let assert Ok(_) = test_helpers.create_oauth_tables(exec)
+  let assert Ok(_) = test_helpers.create_moderation_tables(exec)
+  let assert Ok(_) =
+    test_helpers.insert_test_token(exec, "test-viewer-token", "did:plc:viewer")
+  // Insert a minimal lexicon so schema can build
+  let assert Ok(_) =
+    lexicons.insert(exec, "test.minimal.record", create_minimal_lexicon())
+
+  // Try to set preference for system label '!takedown'
+  let mutation =
+    json.object([
+      #(
+        "query",
+        json.string(
+          "mutation { setLabelPreference(val: \"!takedown\", visibility: IGNORE) { val visibility } }",
+        ),
+      ),
+    ])
+    |> json.to_string
+
+  let request =
+    simulate.request(http.Post, "/graphql")
+    |> simulate.string_body(mutation)
+    |> simulate.header("content-type", "application/json")
+    |> simulate.header("authorization", "Bearer test-viewer-token")
+
+  let assert Ok(cache) = did_cache.start()
+  let response =
+    graphql_handler.handle_graphql_request(request, exec, cache, None, "", "")
+
+  let assert wisp.Text(body) = response.body
+
+  // Should return error about system labels
+  string.contains(body, "error") |> should.be_true
+  string.contains(body, "system") |> should.be_true
+}
+
+/// Test: setLabelPreference requires authentication
+pub fn set_label_preference_requires_auth_test() {
+  // Setup database
+  let assert Ok(exec) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_core_tables(exec)
+  let assert Ok(_) = test_helpers.create_oauth_tables(exec)
+  let assert Ok(_) = test_helpers.create_moderation_tables(exec)
+  // Insert a minimal lexicon so schema can build
+  let assert Ok(_) =
+    lexicons.insert(exec, "test.minimal.record", create_minimal_lexicon())
+
+  // Try to set preference WITHOUT auth token
+  let mutation =
+    json.object([
+      #(
+        "query",
+        json.string(
+          "mutation { setLabelPreference(val: \"spam\", visibility: HIDE) { val visibility } }",
+        ),
+      ),
+    ])
+    |> json.to_string
+
+  let request =
+    simulate.request(http.Post, "/graphql")
+    |> simulate.string_body(mutation)
+    |> simulate.header("content-type", "application/json")
+
+  let assert Ok(cache) = did_cache.start()
+  let response =
+    graphql_handler.handle_graphql_request(request, exec, cache, None, "", "")
+
+  let assert wisp.Text(body) = response.body
+
+  // Should return error about authentication
+  string.contains(body, "error") |> should.be_true
+  string.contains(body, "Authentication") |> should.be_true
+}
+
+/// Test: setLabelPreference validates visibility value
+pub fn set_label_preference_validates_visibility_test() {
+  // Setup database
+  let assert Ok(exec) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_core_tables(exec)
+  let assert Ok(_) = test_helpers.create_oauth_tables(exec)
+  let assert Ok(_) = test_helpers.create_moderation_tables(exec)
+  let assert Ok(_) =
+    test_helpers.insert_test_token(exec, "test-viewer-token", "did:plc:viewer")
+  // Insert a minimal lexicon so schema can build
+  let assert Ok(_) =
+    lexicons.insert(exec, "test.minimal.record", create_minimal_lexicon())
+
+  // Try to set invalid visibility (GraphQL enum validation should catch this)
+  let mutation =
+    json.object([
+      #(
+        "query",
+        json.string(
+          "mutation { setLabelPreference(val: \"spam\", visibility: INVALID) { val visibility } }",
+        ),
+      ),
+    ])
+    |> json.to_string
+
+  let request =
+    simulate.request(http.Post, "/graphql")
+    |> simulate.string_body(mutation)
+    |> simulate.header("content-type", "application/json")
+    |> simulate.header("authorization", "Bearer test-viewer-token")
+
+  let assert Ok(cache) = did_cache.start()
+  let response =
+    graphql_handler.handle_graphql_request(request, exec, cache, None, "", "")
+
+  let assert wisp.Text(body) = response.body
+
+  // Should return error about invalid enum value
+  string.contains(body, "error") |> should.be_true
+}
+
+/// Test: setLabelPreference rejects non-existent label
+pub fn set_label_preference_rejects_unknown_label_test() {
+  // Setup database
+  let assert Ok(exec) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_core_tables(exec)
+  let assert Ok(_) = test_helpers.create_oauth_tables(exec)
+  let assert Ok(_) = test_helpers.create_moderation_tables(exec)
+  let assert Ok(_) =
+    test_helpers.insert_test_token(exec, "test-viewer-token", "did:plc:viewer")
+  // Insert a minimal lexicon so schema can build
+  let assert Ok(_) =
+    lexicons.insert(exec, "test.minimal.record", create_minimal_lexicon())
+
+  // Try to set preference for non-existent label
+  let mutation =
+    json.object([
+      #(
+        "query",
+        json.string(
+          "mutation { setLabelPreference(val: \"nonexistent\", visibility: HIDE) { val visibility } }",
+        ),
+      ),
+    ])
+    |> json.to_string
+
+  let request =
+    simulate.request(http.Post, "/graphql")
+    |> simulate.string_body(mutation)
+    |> simulate.header("content-type", "application/json")
+    |> simulate.header("authorization", "Bearer test-viewer-token")
+
+  let assert Ok(cache) = did_cache.start()
+  let response =
+    graphql_handler.handle_graphql_request(request, exec, cache, None, "", "")
+
+  let assert wisp.Text(body) = response.body
+
+  // Should return error about label not found
+  string.contains(body, "error") |> should.be_true
+}

server/test/label_preferences_test.gleam

···
+/// Integration tests for label preferences
+///
+/// Tests the label preference system including:
+/// - Setting label preferences
+/// - Getting label preferences for a user
+/// - Non-system label filtering
+/// - Validation of visibility values
+import database/repositories/label_definitions
+import database/repositories/label_preferences
+import gleam/list
+import gleam/option
+import gleam/string
+import gleeunit/should
+import test_helpers
+
+// =============================================================================
+// Label Definitions Repository Tests (with default_visibility)
+// =============================================================================
+
+pub fn label_definitions_get_includes_default_visibility_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  // Get a label definition
+  let assert Ok(option.Some(def)) = label_definitions.get(db, "spam")
+
+  // Should have default_visibility field
+  def.val |> should.equal("spam")
+  def.default_visibility |> should.equal("warn")
+}
+
+pub fn label_definitions_get_non_system_excludes_system_labels_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  // Get non-system labels
+  let assert Ok(defs) = label_definitions.get_non_system(db)
+
+  // Should have at least some labels
+  list.length(defs) |> should.not_equal(0)
+
+  // None should start with !
+  list.all(defs, fn(def) { !string.starts_with(def.val, "!") })
+  |> should.be_true()
+}
+
+pub fn label_definitions_get_non_system_includes_content_labels_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  // Get non-system labels
+  let assert Ok(defs) = label_definitions.get_non_system(db)
+
+  // Should include porn, spam, etc.
+  let vals = list.map(defs, fn(d) { d.val })
+
+  vals |> list.contains("porn") |> should.be_true()
+  vals |> list.contains("spam") |> should.be_true()
+  vals |> list.contains("sexual") |> should.be_true()
+  vals |> list.contains("nudity") |> should.be_true()
+}
+
+// =============================================================================
+// Label Preferences Repository Tests
+// =============================================================================
+
+pub fn label_preferences_set_and_get_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let did = "did:plc:user123"
+  let label_val = "spam"
+  let visibility = "hide"
+
+  // Set a preference
+  let assert Ok(pref) = label_preferences.set(db, did, label_val, visibility)
+
+  pref.did |> should.equal(did)
+  pref.label_val |> should.equal(label_val)
+  pref.visibility |> should.equal(visibility)
+
+  // Get the preference
+  let assert Ok(option.Some(found)) = label_preferences.get(db, did, label_val)
+
+  found.visibility |> should.equal(visibility)
+}
+
+pub fn label_preferences_get_by_did_returns_all_user_prefs_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let did = "did:plc:user123"
+
+  // Set multiple preferences
+  let assert Ok(_) = label_preferences.set(db, did, "spam", "hide")
+  let assert Ok(_) = label_preferences.set(db, did, "porn", "warn")
+  let assert Ok(_) = label_preferences.set(db, did, "nudity", "ignore")
+
+  // Get all preferences for user
+  let assert Ok(prefs) = label_preferences.get_by_did(db, did)
+
+  prefs |> list.length() |> should.equal(3)
+
+  // Verify each preference exists
+  let vals = list.map(prefs, fn(p) { p.label_val })
+  vals |> list.contains("spam") |> should.be_true()
+  vals |> list.contains("porn") |> should.be_true()
+  vals |> list.contains("nudity") |> should.be_true()
+}
+
+pub fn label_preferences_set_updates_existing_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let did = "did:plc:user123"
+  let label_val = "spam"
+
+  // Set initial preference
+  let assert Ok(_) = label_preferences.set(db, did, label_val, "warn")
+
+  // Update preference
+  let assert Ok(updated) = label_preferences.set(db, did, label_val, "hide")
+
+  updated.visibility |> should.equal("hide")
+
+  // Verify only one preference exists
+  let assert Ok(prefs) = label_preferences.get_by_did(db, did)
+  prefs |> list.length() |> should.equal(1)
+}
+
+pub fn label_preferences_delete_removes_preference_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let did = "did:plc:user123"
+  let label_val = "spam"
+
+  // Set a preference
+  let assert Ok(_) = label_preferences.set(db, did, label_val, "hide")
+
+  // Delete the preference
+  let assert Ok(_) = label_preferences.delete(db, did, label_val)
+
+  // Should no longer exist
+  let assert Ok(option.None) = label_preferences.get(db, did, label_val)
+}
+
+pub fn label_preferences_different_users_have_separate_prefs_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let user1 = "did:plc:user1"
+  let user2 = "did:plc:user2"
+
+  // Set different preferences for different users
+  let assert Ok(_) = label_preferences.set(db, user1, "spam", "hide")
+  let assert Ok(_) = label_preferences.set(db, user2, "spam", "warn")
+
+  // Get user1's preference
+  let assert Ok(option.Some(pref1)) = label_preferences.get(db, user1, "spam")
+  pref1.visibility |> should.equal("hide")
+
+  // Get user2's preference
+  let assert Ok(option.Some(pref2)) = label_preferences.get(db, user2, "spam")
+  pref2.visibility |> should.equal("warn")
+}
+
+pub fn label_preferences_get_returns_none_when_not_set_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  // Get a preference that doesn't exist
+  let assert Ok(option.None) =
+    label_preferences.get(db, "did:plc:user123", "spam")
+}
+
+pub fn label_preferences_get_by_did_returns_empty_for_new_user_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  // Get preferences for a user with no preferences
+  let assert Ok(prefs) = label_preferences.get_by_did(db, "did:plc:newuser")
+
+  prefs |> list.length() |> should.equal(0)
+}

server/test/labels_test.gleam

···
+/// Integration tests for labels and reports
+///
+/// Tests the moderation system including:
+/// - Label creation and retrieval
+/// - Report creation and retrieval
+/// - Takedown filtering in record queries
+/// - Self-labels parsing and merging
+import database/repositories/labels
+import database/repositories/reports
+import gleam/dict
+import gleam/list
+import gleam/option
+import gleeunit/should
+import graphql/lexicon/fetchers
+import swell/value
+import test_helpers
+
+// =============================================================================
+// Label Repository Tests
+// =============================================================================
+
+pub fn label_insert_and_get_by_uri_test() {
+  // Setup test database
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let src = "did:plc:admin123"
+  let uri = "at://did:plc:user1/app.bsky.feed.post/abc123"
+  let val = "spam"
+
+  // Insert a label
+  let assert Ok(label) =
+    labels.insert(db, src, uri, option.None, val, option.None)
+
+  // Verify label fields
+  label.src |> should.equal(src)
+  label.uri |> should.equal(uri)
+  label.val |> should.equal(val)
+  label.neg |> should.equal(False)
+
+  // Get by URI should return the label
+  let assert Ok(found_labels) = labels.get_by_uris(db, [uri])
+  found_labels |> list.length() |> should.equal(1)
+
+  let assert [found] = found_labels
+  found.val |> should.equal(val)
+}
+
+pub fn label_negation_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let src = "did:plc:admin123"
+  let uri = "at://did:plc:user1/app.bsky.feed.post/abc123"
+
+  // Insert a label
+  let assert Ok(_) =
+    labels.insert(db, src, uri, option.None, "spam", option.None)
+
+  // Insert negation
+  let assert Ok(neg_label) = labels.insert_negation(db, src, uri, "spam")
+  neg_label.neg |> should.equal(True)
+
+  // get_by_uris should only return active (non-negated) labels
+  let assert Ok(found_labels) = labels.get_by_uris(db, [uri])
+  // The negation retracts the original label, so get_by_uris should return 0
+  // (The original is excluded because a later negation exists for it)
+  found_labels |> list.length() |> should.equal(0)
+}
+
+pub fn label_get_all_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let src = "did:plc:admin123"
+
+  // Insert multiple labels
+  let assert Ok(_) =
+    labels.insert(
+      db,
+      src,
+      "at://did:plc:user1/app.bsky.feed.post/1",
+      option.None,
+      "spam",
+      option.None,
+    )
+  let assert Ok(_) =
+    labels.insert(
+      db,
+      src,
+      "at://did:plc:user2/app.bsky.feed.post/2",
+      option.None,
+      "!warn",
+      option.None,
+    )
+  let assert Ok(_) =
+    labels.insert(
+      db,
+      src,
+      "at://did:plc:user3/app.bsky.feed.post/3",
+      option.None,
+      "spam",
+      option.None,
+    )
+
+  // Get all with no filters
+  let assert Ok(all_labels) =
+    labels.get_all(db, option.None, option.None, 100, option.None)
+  all_labels |> list.length() |> should.equal(3)
+
+  // Filter by val
+  let assert Ok(spam_labels) =
+    labels.get_all(db, option.None, option.Some("spam"), 100, option.None)
+  spam_labels |> list.length() |> should.equal(2)
+}
+
+// =============================================================================
+// Takedown Filtering Tests
+// =============================================================================
+
+pub fn takedown_uris_returns_takedown_labels_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let src = "did:plc:admin123"
+  let takedown_uri = "at://did:plc:user1/app.bsky.feed.post/takedown"
+  let normal_uri = "at://did:plc:user2/app.bsky.feed.post/normal"
+  let suspend_uri = "at://did:plc:user3/app.bsky.feed.post/suspend"
+
+  // Insert labels - takedown, normal, and suspend
+  let assert Ok(_) =
+    labels.insert(db, src, takedown_uri, option.None, "!takedown", option.None)
+  let assert Ok(_) =
+    labels.insert(db, src, normal_uri, option.None, "spam", option.None)
+  let assert Ok(_) =
+    labels.insert(db, src, suspend_uri, option.None, "!suspend", option.None)
+
+  // get_takedown_uris should return only !takedown and !suspend URIs
+  let assert Ok(takedown_list) =
+    labels.get_takedown_uris(db, [takedown_uri, normal_uri, suspend_uri])
+
+  takedown_list |> list.length() |> should.equal(2)
+  takedown_list |> list.contains(takedown_uri) |> should.equal(True)
+  takedown_list |> list.contains(suspend_uri) |> should.equal(True)
+  takedown_list |> list.contains(normal_uri) |> should.equal(False)
+}
+
+// =============================================================================
+// Report Repository Tests
+// =============================================================================
+
+pub fn report_insert_and_get_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let reporter_did = "did:plc:reporter123"
+  let subject_uri = "at://did:plc:user1/app.bsky.feed.post/abc123"
+
+  // Insert a report
+  let assert Ok(report) =
+    reports.insert(
+      db,
+      reporter_did,
+      subject_uri,
+      "spam",
+      option.Some("This is spam content"),
+    )
+
+  report.reporter_did |> should.equal(reporter_did)
+  report.subject_uri |> should.equal(subject_uri)
+  report.reason_type |> should.equal("spam")
+  report.status |> should.equal("pending")
+
+  // Get by ID
+  let assert Ok(option.Some(found)) = reports.get(db, report.id)
+  found.id |> should.equal(report.id)
+}
+
+pub fn report_get_all_by_status_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let reporter = "did:plc:reporter123"
+
+  // Create multiple reports
+  let assert Ok(_) =
+    reports.insert(db, reporter, "at://did/post/1", "spam", option.None)
+  let assert Ok(_) =
+    reports.insert(db, reporter, "at://did/post/2", "violation", option.None)
+  let assert Ok(_) =
+    reports.insert(db, reporter, "at://did/post/3", "rude", option.None)
+
+  // Get all pending reports
+  let assert Ok(pending) =
+    reports.get_all(db, option.Some("pending"), 100, option.None)
+  pending |> list.length() |> should.equal(3)
+}
+
+pub fn report_resolve_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let admin = "did:plc:admin123"
+  let reporter = "did:plc:reporter123"
+
+  // Create reports
+  let assert Ok(report1) =
+    reports.insert(db, reporter, "at://did/post/1", "spam", option.None)
+  let assert Ok(report2) =
+    reports.insert(db, reporter, "at://did/post/2", "violation", option.None)
+
+  // Resolve first report
+  let assert Ok(resolved) = reports.resolve(db, report1.id, "resolved", admin)
+  resolved.status |> should.equal("resolved")
+  resolved.resolved_by |> should.equal(option.Some(admin))
+
+  // Dismiss second report (status = "dismissed")
+  let assert Ok(dismissed) = reports.resolve(db, report2.id, "dismissed", admin)
+  dismissed.status |> should.equal("dismissed")
+
+  // Get pending should return 0
+  let assert Ok(pending) =
+    reports.get_all(db, option.Some("pending"), 100, option.None)
+  pending |> list.length() |> should.equal(0)
+
+  // Get resolved should return 1
+  let assert Ok(resolved_list) =
+    reports.get_all(db, option.Some("resolved"), 100, option.None)
+  resolved_list |> list.length() |> should.equal(1)
+}
+
+// =============================================================================
+// Integration with Records (Takedown Filtering)
+// =============================================================================
+
+pub fn takedown_label_identified_for_filtering_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_core_tables(db)
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let uri1 = "at://did:plc:user1/app.bsky.feed.post/abc123"
+  let uri2 = "at://did:plc:user2/app.bsky.feed.post/def456"
+
+  // Apply takedown label to first record
+  let assert Ok(_) =
+    labels.insert(
+      db,
+      "did:plc:admin",
+      uri1,
+      option.None,
+      "!takedown",
+      option.None,
+    )
+
+  // Check that get_takedown_uris returns the takedown URI
+  let assert Ok(takedown_uris) = labels.get_takedown_uris(db, [uri1, uri2])
+  takedown_uris |> list.length() |> should.equal(1)
+  takedown_uris |> list.contains(uri1) |> should.equal(True)
+  takedown_uris |> list.contains(uri2) |> should.equal(False)
+}
+
+// =============================================================================
+// Self-Labels Parsing Tests
+// =============================================================================
+
+pub fn self_labels_parsing_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let uri = "at://did:plc:user1/app.bsky.feed.post/abc123"
+  let json_with_self_labels =
+    "{\"text\": \"hello\", \"labels\": {\"$type\": \"com.atproto.label.defs#selfLabels\", \"values\": [{\"val\": \"porn\"}]}}"
+
+  // Create labels fetcher
+  let fetcher = fetchers.labels_fetcher(db)
+
+  // Call fetcher with JSON containing self-labels
+  let assert Ok(results) = fetcher([#(uri, option.Some(json_with_self_labels))])
+
+  // Should have self-label
+  let assert Ok(labels_list) = dict.get(results, uri)
+  labels_list |> list.length() |> should.equal(1)
+
+  // Check the label has correct val and src (author DID)
+  let assert [label] = labels_list
+  case label {
+    value.Object(fields) -> {
+      let assert Ok(value.String(val)) = list.key_find(fields, "val")
+      val |> should.equal("porn")
+
+      let assert Ok(value.String(src)) = list.key_find(fields, "src")
+      src |> should.equal("did:plc:user1")
+    }
+    _ -> should.fail()
+  }
+}
+
+pub fn self_labels_without_labels_field_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let uri = "at://did:plc:user1/app.bsky.feed.post/abc123"
+  let json_without_labels = "{\"text\": \"hello world\"}"
+
+  // Create labels fetcher
+  let fetcher = fetchers.labels_fetcher(db)
+
+  // Call fetcher with JSON without labels
+  let assert Ok(results) = fetcher([#(uri, option.Some(json_without_labels))])
+
+  // Should have no labels
+  case dict.get(results, uri) {
+    Ok(labels_list) -> labels_list |> list.length() |> should.equal(0)
+    Error(_) -> Nil
+    // Also acceptable - no entry means no labels
+  }
+}
+
+pub fn merged_labels_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let uri = "at://did:plc:user1/app.bsky.feed.post/abc123"
+  let json_with_self_labels =
+    "{\"text\": \"hello\", \"labels\": {\"$type\": \"com.atproto.label.defs#selfLabels\", \"values\": [{\"val\": \"porn\"}]}}"
+
+  // Add moderator label
+  let assert Ok(_) =
+    labels.insert(db, "did:plc:admin", uri, option.None, "spam", option.None)
+
+  // Create labels fetcher
+  let fetcher = fetchers.labels_fetcher(db)
+
+  // Call fetcher with JSON containing self-labels
+  let assert Ok(results) = fetcher([#(uri, option.Some(json_with_self_labels))])
+
+  // Should have both labels (1 self + 1 moderator)
+  let assert Ok(labels_list) = dict.get(results, uri)
+  labels_list |> list.length() |> should.equal(2)
+
+  // Check we have both "porn" (self) and "spam" (moderator)
+  let vals =
+    list.filter_map(labels_list, fn(label) {
+      case label {
+        value.Object(fields) -> {
+          case list.key_find(fields, "val") {
+            Ok(value.String(v)) -> Ok(v)
+            _ -> Error(Nil)
+          }
+        }
+        _ -> Error(Nil)
+      }
+    })
+  vals |> list.contains("porn") |> should.equal(True)
+  vals |> list.contains("spam") |> should.equal(True)
+}
+
+pub fn multiple_self_labels_test() {
+  let assert Ok(db) = test_helpers.create_test_db()
+  let assert Ok(_) = test_helpers.create_moderation_tables(db)
+
+  let uri = "at://did:plc:user1/app.bsky.feed.post/abc123"
+  let json_with_multiple_labels =
+    "{\"text\": \"adult content\", \"labels\": {\"$type\": \"com.atproto.label.defs#selfLabels\", \"values\": [{\"val\": \"porn\"}, {\"val\": \"sexual\"}]}}"
+
+  // Create labels fetcher
+  let fetcher = fetchers.labels_fetcher(db)
+
+  // Call fetcher with JSON containing multiple self-labels
+  let assert Ok(results) =
+    fetcher([#(uri, option.Some(json_with_multiple_labels))])
+
+  // Should have both self-labels
+  let assert Ok(labels_list) = dict.get(results, uri)
+  labels_list |> list.length() |> should.equal(2)
+}

server/test/test_helpers.gleam

···
   create_admin_session_table(exec)
 }
 
+/// Create label_definition table for tests
+pub fn create_label_definition_table(exec: Executor) -> Result(Nil, DbError) {
+  use _ <- result.try(
+    executor.exec(
+      exec,
+      "CREATE TABLE IF NOT EXISTS label_definition (
+      val TEXT PRIMARY KEY NOT NULL,
+      description TEXT NOT NULL,
+      severity TEXT NOT NULL CHECK (severity IN ('inform', 'alert', 'takedown')),
+      default_visibility TEXT NOT NULL DEFAULT 'warn',
+      created_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )",
+      [],
+    ),
+  )
+
+  // Seed default label definitions
+  executor.exec(
+    exec,
+    "INSERT INTO label_definition (val, description, severity, default_visibility) VALUES
+      ('!takedown', 'Content removed by moderators', 'takedown', 'hide'),
+      ('!suspend', 'Account suspended', 'takedown', 'hide'),
+      ('!warn', 'Show warning before displaying', 'alert', 'warn'),
+      ('!hide', 'Hide from feeds', 'alert', 'hide'),
+      ('porn', 'Pornographic content', 'alert', 'hide'),
+      ('spam', 'Spam or unwanted content', 'inform', 'warn'),
+      ('sexual', 'Sexually suggestive content', 'alert', 'warn'),
+      ('nudity', 'Non-sexual nudity', 'alert', 'warn')",
+    [],
+  )
+}
+
+/// Create actor_label_preference table for tests
+pub fn create_label_preference_table(exec: Executor) -> Result(Nil, DbError) {
+  executor.exec(
+    exec,
+    "CREATE TABLE IF NOT EXISTS actor_label_preference (
+      did TEXT NOT NULL,
+      label_val TEXT NOT NULL,
+      visibility TEXT NOT NULL,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      PRIMARY KEY (did, label_val)
+    )",
+    [],
+  )
+}
+
+/// Create label table for tests
+pub fn create_label_table(exec: Executor) -> Result(Nil, DbError) {
+  executor.exec(
+    exec,
+    "CREATE TABLE IF NOT EXISTS label (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      src TEXT NOT NULL,
+      uri TEXT NOT NULL,
+      cid TEXT,
+      val TEXT NOT NULL,
+      neg INTEGER NOT NULL DEFAULT 0,
+      cts TEXT NOT NULL DEFAULT (datetime('now')),
+      exp TEXT,
+      FOREIGN KEY (val) REFERENCES label_definition(val)
+    )",
+    [],
+  )
+}
+
+/// Create report table for tests
+pub fn create_report_table(exec: Executor) -> Result(Nil, DbError) {
+  executor.exec(
+    exec,
+    "CREATE TABLE IF NOT EXISTS report (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      reporter_did TEXT NOT NULL,
+      subject_uri TEXT NOT NULL,
+      reason_type TEXT NOT NULL CHECK (reason_type IN ('spam', 'violation', 'misleading', 'sexual', 'rude', 'other')),
+      reason TEXT,
+      status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'resolved', 'dismissed')),
+      resolved_by TEXT,
+      resolved_at TEXT,
+      created_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )",
+    [],
+  )
+}
+
+/// Create labels and reports tables for tests
+pub fn create_moderation_tables(exec: Executor) -> Result(Nil, DbError) {
+  use _ <- result.try(create_label_definition_table(exec))
+  use _ <- result.try(create_label_table(exec))
+  use _ <- result.try(create_report_table(exec))
+  create_label_preference_table(exec)
+}
+
 /// Insert a test token that maps to a DID for testing viewer authentication
 pub fn insert_test_token(
   exec: Executor,