diff --git a/API_DOCS.md b/API_DOCS.md
index a7969b9..65d6018 100644
--- a/API_DOCS.md
+++ b/API_DOCS.md
@@ -1,5 +1,45 @@
 # WaveBox API
 
+## OpenSubsonic API
+
+In addition to the custom API documented below, WaveBox exposes an
+[OpenSubsonic](https://opensubsonic.netlify.app/)-compatible API under `/rest/`, so any
+Subsonic client (Symfonium, DSub, play:Sub, substreamer, …) can browse, search, and stream
+from a WaveBox server.  Both response formats are supported: XML (the Subsonic default) and
+JSON (`f=json`), plus JSONP (`f=jsonp&callback=...`).
+
+**Authentication** — passwords are stored PBKDF2-hashed, so classic Subsonic *token* auth
+(`t`/`s`, an MD5 over the plaintext password) cannot be supported and returns error code 42.
+Clients must use one of:
+
+* **API key** (recommended, OpenSubsonic `apiKeyAuthentication` extension): `?apiKey=...`.
+  Generate a key with the custom API: `/api/users/{userId}?action=generateApiKey`
+  (self-service, or any user when admin); revoke with `action=revokeApiKey`.
+* **Password auth**: `?u=user&p=password` or `?u=user&p=enc:HEX` — enable
+  "legacy/plaintext authentication" in clients that default to token auth.  Successful
+  verifications are cached in memory for ten minutes so PBKDF2 doesn't run per request.
+
+**Supported endpoints** — ping, getLicense, getOpenSubsonicExtensions, tokenInfo,
+getScanStatus, getMusicFolders, getIndexes, getMusicDirectory, getArtists, getArtist,
+getAlbum, getSong, getGenres, getVideos, getArtistInfo(2) (empty), getLyrics, getCoverArt,
+stream (with `maxBitRate`/`format` transcoding via ffmpeg), download, getAlbumList(2)
+(random, newest, recent, frequent, alphabetical*, byYear, byGenre, starred), getRandomSongs,
+getSongsByGenre, getNowPlaying, getStarred(2), search2, search3, getPlaylists, getPlaylist,
+createPlaylist, updatePlaylist, deletePlaylist, star, unstar, scrobble (also forwards to
+Last.fm when linked), getUser, getUsers, changePassword, createUser, updateUser, deleteUser.
+
+Everything else (podcasts, ratings, jukebox, shares, internet radio, bookmarks, play queue,
+chat) returns Subsonic error code 0 with a "not supported" message.
+
+**Folder vs tag browsing** — the two Subsonic browse modes are kept separate, as clients
+expect: the folder-based endpoints (getIndexes, getMusicDirectory, getAlbumList, search2,
+getStarred) operate on the real directory tree — getAlbumList hands out the folder that
+holds each album's songs, and search2 matches folder names — while the ID3 endpoints
+(getArtists/getArtist/getAlbum, getAlbumList2, search3, getStarred2) use tag organization
+with WaveBox's AlbumArtist as the ID3 artist.  All ids are WaveBox's global item ids;
+`getMusicDirectory` primarily takes folder ids but also resolves album/artist ids as a
+fallback for clients that mix modes.
+
 ## The basics:
 Every call to the WaveBox API requires authentication data, whether it is the "s"
 session key parameter sent in GET or POST parameters, or the wavebox_session cookie
diff --git a/Scripts/smoke-test.sh b/Scripts/smoke-test.sh
index 60d15e1..274e0c5 100755
--- a/Scripts/smoke-test.sh
+++ b/Scripts/smoke-test.sh
@@ -121,6 +121,94 @@ else
     check "range request returns 206" 1 "(no song id)"
 fi
 
+# --- OpenSubsonic API (/rest) ---
+REST="http://localhost:$PORT/rest"
+SUB="u=test&p=test&f=json"
+
+# 7. ping: XML is the default response format
+curl -s "$REST/ping.view?u=test&p=test" | grep -q 'xmlns="http://subsonic.org/restapi"'
+check "subsonic ping returns XML envelope" $?
+curl -s "$REST/ping.view?u=test&p=test" | grep -q 'status="ok"'
+check "subsonic ping XML status ok" $?
+
+# 8. ping: JSON envelope on f=json
+curl -s "$REST/ping?$SUB" | python3 -c "import json,sys; d=json.load(sys.stdin)['subsonic-response']; assert d['status']=='ok' and d['openSubsonic'] is True, d"
+check "subsonic ping JSON envelope" $?
+
+# 9. Auth errors: wrong password -> 40, token auth -> 42
+curl -s "$REST/ping?u=test&p=wrong&f=json" | python3 -c "import json,sys; assert json.load(sys.stdin)['subsonic-response']['error']['code']==40"
+check "subsonic wrong password returns error 40" $?
+curl -s "$REST/ping?u=test&t=deadbeef&s=salt&f=json" | python3 -c "import json,sys; assert json.load(sys.stdin)['subsonic-response']['error']['code']==42"
+check "subsonic token auth returns error 42" $?
+
+# 10. ID3 browsing: getArtists -> getArtist -> getAlbum with the fixture song
+SUB_ARTIST_ID=$(curl -s "$REST/getArtists?$SUB" | python3 -c "import json,sys; d=json.load(sys.stdin)['subsonic-response']['artists']; print(d['index'][0]['artist'][0]['id'] if d.get('index') else '')")
+[ -n "$SUB_ARTIST_ID" ]; check "subsonic getArtists finds fixture artist" $?
+SUB_ALBUM_ID=$(curl -s "$REST/getArtist?$SUB&id=$SUB_ARTIST_ID" | python3 -c "import json,sys; d=json.load(sys.stdin)['subsonic-response']['artist']; print(d['album'][0]['id'] if d.get('album') else '')")
+[ -n "$SUB_ALBUM_ID" ]; check "subsonic getArtist lists fixture album" $?
+curl -s "$REST/getAlbum?$SUB&id=$SUB_ALBUM_ID" | python3 -c "import json,sys; d=json.load(sys.stdin)['subsonic-response']['album']; s=d['song'][0]; assert s['title']=='Test Song' and s['duration']>0 and isinstance(s['id'],str), s"
+check "subsonic getAlbum returns fixture song" $?
+
+# 11. search3 finds the fixture
+curl -s "$REST/search3?$SUB&query=Test" | python3 -c "import json,sys; d=json.load(sys.stdin)['subsonic-response']['searchResult3']; assert d.get('song') and d.get('album') and d.get('artist'), d"
+check "subsonic search3 finds fixture" $?
+
+# 12. getAlbumList2 newest
+curl -s "$REST/getAlbumList2?$SUB&type=newest" | python3 -c "import json,sys; d=json.load(sys.stdin)['subsonic-response']['albumList2']; assert len(d['album'])>0, d"
+check "subsonic getAlbumList2 newest" $?
+
+# 12b. getAlbumList (folder flavor) entries must be traversable directories in the folder tree
+LIST_DIR_ID=$(curl -s "$REST/getAlbumList?$SUB&type=newest" | python3 -c "import json,sys; d=json.load(sys.stdin)['subsonic-response']['albumList']; print(d['album'][0]['id'] if d.get('album') else '')")
+curl -s "$REST/getMusicDirectory?$SUB&id=$LIST_DIR_ID" | python3 -c "import json,sys; d=json.load(sys.stdin)['subsonic-response']['directory']; assert any(c['title']=='Test Song' for c in d['child']), d"
+check "subsonic getAlbumList entries browse as folders" $?
+
+# 13. Raw stream with Range -> 206
+STATUS=$(curl -s -o /dev/null -w "%{http_code}" -H "Range: bytes=100-199" "$REST/stream?u=test&p=test&id=$SONG_ID&format=raw")
+[ "$STATUS" = "206" ]; check "subsonic stream range returns 206" $? "(got $STATUS)"
+
+# 14. Transcoded stream (only when ffmpeg is available)
+if command -v ffmpeg >/dev/null 2>&1; then
+    SIZE=$(curl -s -o /dev/null -w "%{size_download}" "$REST/stream?u=test&p=test&id=$SONG_ID&maxBitRate=32&format=mp3")
+    [ "$SIZE" -gt 0 ]; check "subsonic transcoded stream returns audio" $? "(got $SIZE bytes)"
+else
+    echo "SKIP: subsonic transcoded stream (no ffmpeg)"
+fi
+
+# 15. Playlists: duplicate songId keys must both apply; update remove/add keeps counts right
+curl -s "$REST/createPlaylist?$SUB&name=SmokeList&songId=$SONG_ID&songId=$SONG_ID" | python3 -c "import json,sys; d=json.load(sys.stdin)['subsonic-response']['playlist']; assert d['songCount']==2 and len(d['entry'])==2, d"
+check "subsonic createPlaylist with duplicate ids" $?
+SUB_PL_ID=$(curl -s "$REST/getPlaylists?$SUB" | python3 -c "import json,sys; pl=[p for p in json.load(sys.stdin)['subsonic-response']['playlists']['playlist'] if p['name']=='SmokeList']; print(pl[0]['id'] if pl else '')")
+curl -s "$REST/updatePlaylist?$SUB&playlistId=$SUB_PL_ID&songIndexToRemove=0&songIdToAdd=$SONG_ID" > /dev/null
+curl -s "$REST/getPlaylist?$SUB&id=$SUB_PL_ID" | python3 -c "import json,sys; d=json.load(sys.stdin)['subsonic-response']['playlist']; assert d['songCount']==2 and len(d['entry'])==2, d"
+check "subsonic updatePlaylist remove+add" $?
+curl -s "$REST/deletePlaylist?$SUB&id=$SUB_PL_ID" | python3 -c "import json,sys; assert json.load(sys.stdin)['subsonic-response']['status']=='ok'"
+check "subsonic deletePlaylist" $?
+
+# 16. Star / getStarred2 round-trip
+curl -s "$REST/star?$SUB&id=$SONG_ID" > /dev/null
+curl -s "$REST/getStarred2?$SUB" | python3 -c "import json,sys; d=json.load(sys.stdin)['subsonic-response']['starred2']; assert len(d.get('song',[]))==1 and d['song'][0]['starred'], d"
+check "subsonic star/getStarred2 round-trip" $?
+curl -s "$REST/unstar?$SUB&id=$SONG_ID" > /dev/null
+
+# 17. Scrobble -> getNowPlaying + recent album list
+curl -s "$REST/scrobble?$SUB&id=$SONG_ID&time=$(($(date +%s) * 1000))" > /dev/null
+curl -s "$REST/getNowPlaying?$SUB" | python3 -c "import json,sys; d=json.load(sys.stdin)['subsonic-response']['nowPlaying']; assert d['entry'][0]['username']=='test', d"
+check "subsonic scrobble registers now playing" $?
+curl -s "$REST/getAlbumList2?$SUB&type=recent" | python3 -c "import json,sys; d=json.load(sys.stdin)['subsonic-response']['albumList2']; assert len(d['album'])>0, d"
+check "subsonic getAlbumList2 recent after scrobble" $?
+
+# 18. API key lifecycle: generate via legacy admin API, then apiKey auth + conflict detection
+ADMIN_SESSION=$(curl -s "http://localhost:$PORT/api/login?u=admin&p=admin" | python3 -c "import json,sys; print(json.load(sys.stdin).get('sessionId') or '')")
+ADMIN_ID=$(curl -s "http://localhost:$PORT/api/users?s=$ADMIN_SESSION" | python3 -c "import json,sys; us=json.load(sys.stdin)['users']; print([u for u in us if u['userName']=='admin'][0]['userId'])")
+APIKEY=$(curl -s "http://localhost:$PORT/api/users/$ADMIN_ID?s=$ADMIN_SESSION&action=generateApiKey" | python3 -c "import json,sys; print(json.load(sys.stdin)['users'][0].get('apiKey') or '')")
+[ -n "$APIKEY" ]; check "generateApiKey via legacy API" $?
+curl -s "$REST/ping?apiKey=$APIKEY&f=json" | python3 -c "import json,sys; assert json.load(sys.stdin)['subsonic-response']['status']=='ok'"
+check "subsonic apiKey auth" $?
+curl -s "$REST/tokenInfo?apiKey=$APIKEY&f=json" | python3 -c "import json,sys; assert json.load(sys.stdin)['subsonic-response']['tokenInfo']['username']=='admin'"
+check "subsonic tokenInfo" $?
+curl -s "$REST/ping?apiKey=$APIKEY&u=test&f=json" | python3 -c "import json,sys; assert json.load(sys.stdin)['subsonic-response']['error']['code']==43"
+check "subsonic conflicting auth returns error 43" $?
+
 echo ""
 if [ "$FAILURES" -gt 0 ]; then
     echo "$FAILURES smoke test(s) FAILED"
diff --git a/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicBrowsing.cs b/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicBrowsing.cs
new file mode 100644
index 0000000..59e4cf3
--- /dev/null
+++ b/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicBrowsing.cs
@@ -0,0 +1,175 @@
+using System;
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+namespace WaveBox.Core.ApiResponse.Subsonic {
+    public class SubsonicMusicFolders {
+        [JsonPropertyName("musicFolder"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicMusicFolder> MusicFolder { get; set; }
+    }
+
+    public class SubsonicMusicFolder {
+        [JsonPropertyName("id")]
+        public string Id { get; set; }
+
+        [JsonPropertyName("name"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Name { get; set; }
+    }
+
+    public class SubsonicIndexes {
+        // Milliseconds since epoch (Subsonic quirk: this one field is ms, durations are seconds)
+        [JsonPropertyName("lastModified")]
+        public long LastModified { get; set; }
+
+        [JsonPropertyName("ignoredArticles")]
+        public string IgnoredArticles { get; set; } = "";
+
+        [JsonPropertyName("index"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicIndex> Index { get; set; }
+
+        // Loose media files directly inside a music folder root
+        [JsonPropertyName("child"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicChild> Child { get; set; }
+    }
+
+    public class SubsonicIndex {
+        [JsonPropertyName("name")]
+        public string Name { get; set; }
+
+        [JsonPropertyName("artist"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicIndexArtist> Artist { get; set; }
+    }
+
+    // Folder-style "artist" entry used by getIndexes, search2, and getStarred: just an id
+    // (a folder id in getIndexes) and a display name.
+    public class SubsonicIndexArtist {
+        [JsonPropertyName("id")]
+        public string Id { get; set; }
+
+        [JsonPropertyName("name")]
+        public string Name { get; set; }
+
+        [JsonPropertyName("starred"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Starred { get; set; }
+    }
+
+    public class SubsonicDirectory {
+        [JsonPropertyName("id")]
+        public string Id { get; set; }
+
+        [JsonPropertyName("parent"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Parent { get; set; }
+
+        [JsonPropertyName("name")]
+        public string Name { get; set; }
+
+        [JsonPropertyName("child"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicChild> Child { get; set; }
+    }
+
+    // The shared Subsonic media/directory-entry DTO ("Child" in the Subsonic schema), used by
+    // getMusicDirectory, getSong, album/song lists, search results, playlists, and now playing.
+    public class SubsonicChild {
+        [JsonPropertyName("id")]
+        public string Id { get; set; }
+
+        [JsonPropertyName("parent"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Parent { get; set; }
+
+        [JsonPropertyName("isDir")]
+        public bool IsDir { get; set; }
+
+        [JsonPropertyName("title")]
+        public string Title { get; set; }
+
+        [JsonPropertyName("album"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Album { get; set; }
+
+        [JsonPropertyName("artist"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Artist { get; set; }
+
+        [JsonPropertyName("track"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public int? Track { get; set; }
+
+        [JsonPropertyName("year"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public int? Year { get; set; }
+
+        [JsonPropertyName("genre"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Genre { get; set; }
+
+        [JsonPropertyName("coverArt"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string CoverArt { get; set; }
+
+        [JsonPropertyName("size"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public long? Size { get; set; }
+
+        [JsonPropertyName("contentType"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string ContentType { get; set; }
+
+        [JsonPropertyName("suffix"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Suffix { get; set; }
+
+        [JsonPropertyName("duration"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public int? Duration { get; set; }
+
+        [JsonPropertyName("bitRate"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public int? BitRate { get; set; }
+
+        [JsonPropertyName("path"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Path { get; set; }
+
+        [JsonPropertyName("isVideo"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public bool? IsVideo { get; set; }
+
+        [JsonPropertyName("discNumber"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public int? DiscNumber { get; set; }
+
+        [JsonPropertyName("created"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Created { get; set; }
+
+        [JsonPropertyName("starred"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Starred { get; set; }
+
+        [JsonPropertyName("albumId"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string AlbumId { get; set; }
+
+        [JsonPropertyName("artistId"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string ArtistId { get; set; }
+
+        [JsonPropertyName("type"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Type { get; set; }
+    }
+
+    public class SubsonicGenres {
+        [JsonPropertyName("genre"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicGenre> Genre { get; set; }
+    }
+
+    public class SubsonicGenre {
+        [JsonPropertyName("songCount")]
+        public int SongCount { get; set; }
+
+        [JsonPropertyName("albumCount")]
+        public int AlbumCount { get; set; }
+
+        // The genre name: XML text content, JSON "value" property (Subsonic convention)
+        [JsonPropertyName("value"), SubsonicXmlText]
+        public string Value { get; set; }
+    }
+
+    public class SubsonicVideos {
+        [JsonPropertyName("video"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicChild> Video { get; set; }
+    }
+
+    public class SubsonicLyrics {
+        [JsonPropertyName("artist"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Artist { get; set; }
+
+        [JsonPropertyName("title"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Title { get; set; }
+
+        [JsonPropertyName("value"), SubsonicXmlText, JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Value { get; set; }
+    }
+}
diff --git a/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicDtoRegistry.cs b/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicDtoRegistry.cs
new file mode 100644
index 0000000..c063d3a
--- /dev/null
+++ b/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicDtoRegistry.cs
@@ -0,0 +1,55 @@
+using System;
+using System.Diagnostics.CodeAnalysis;
+
+namespace WaveBox.Core.ApiResponse.Subsonic {
+    // The Subsonic XML serializer walks DTO properties via reflection, which the trimmer/NativeAOT
+    // can't see (same situation as the sqlite-net ORM and ModelTypeRegistry).  Rooting every
+    // Subsonic DTO type here preserves full member metadata.  Add any new Subsonic DTO to
+    // EnsurePreserved or its XML rendering will silently lose properties under NativeAOT.
+    public static class SubsonicDtoRegistry {
+        private static void Root<[DynamicallyAccessedMembers(DynamicallyAccessedMemberTypes.All)] T>() {
+        }
+
+        public static void EnsurePreserved() {
+            Root<SubsonicResponse>();
+            Root<SubsonicResponseBody>();
+            Root<SubsonicError>();
+            Root<SubsonicLicense>();
+            Root<SubsonicExtension>();
+            Root<SubsonicTokenInfo>();
+            Root<SubsonicScanStatus>();
+            Root<SubsonicArtistInfo>();
+            Root<SubsonicMusicFolders>();
+            Root<SubsonicMusicFolder>();
+            Root<SubsonicIndexes>();
+            Root<SubsonicIndex>();
+            Root<SubsonicIndexArtist>();
+            Root<SubsonicDirectory>();
+            Root<SubsonicChild>();
+            Root<SubsonicGenres>();
+            Root<SubsonicGenre>();
+            Root<SubsonicVideos>();
+            Root<SubsonicLyrics>();
+            Root<SubsonicArtistsID3>();
+            Root<SubsonicIndexID3>();
+            Root<SubsonicArtistID3>();
+            Root<SubsonicArtistWithAlbumsID3>();
+            Root<SubsonicAlbumID3>();
+            Root<SubsonicAlbumWithSongsID3>();
+            Root<SubsonicAlbumList>();
+            Root<SubsonicAlbumList2>();
+            Root<SubsonicSongs>();
+            Root<SubsonicNowPlaying>();
+            Root<SubsonicNowPlayingEntry>();
+            Root<SubsonicStarred>();
+            Root<SubsonicStarred2>();
+            Root<SubsonicSearchResult2>();
+            Root<SubsonicSearchResult3>();
+            Root<SubsonicPlaylists>();
+            Root<SubsonicPlaylist>();
+            Root<SubsonicPlaylistWithSongs>();
+            Root<SubsonicUsers>();
+            Root<SubsonicUser>();
+        }
+    }
+}
diff --git a/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicID3.cs b/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicID3.cs
new file mode 100644
index 0000000..b511478
--- /dev/null
+++ b/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicID3.cs
@@ -0,0 +1,86 @@
+using System;
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+namespace WaveBox.Core.ApiResponse.Subsonic {
+    // ID3-flavored browsing DTOs (getArtists/getArtist/getAlbum).  WaveBox maps the Subsonic
+    // "ID3 artist" concept onto AlbumArtist, which matches how tag-based clients expect
+    // compilations to group.
+    public class SubsonicArtistsID3 {
+        [JsonPropertyName("ignoredArticles")]
+        public string IgnoredArticles { get; set; } = "";
+
+        [JsonPropertyName("index"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicIndexID3> Index { get; set; }
+    }
+
+    public class SubsonicIndexID3 {
+        [JsonPropertyName("name")]
+        public string Name { get; set; }
+
+        [JsonPropertyName("artist"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicArtistID3> Artist { get; set; }
+    }
+
+    public class SubsonicArtistID3 {
+        [JsonPropertyName("id")]
+        public string Id { get; set; }
+
+        [JsonPropertyName("name")]
+        public string Name { get; set; }
+
+        [JsonPropertyName("coverArt"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string CoverArt { get; set; }
+
+        [JsonPropertyName("albumCount"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public int? AlbumCount { get; set; }
+
+        [JsonPropertyName("starred"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Starred { get; set; }
+    }
+
+    public class SubsonicArtistWithAlbumsID3 : SubsonicArtistID3 {
+        [JsonPropertyName("album"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicAlbumID3> Album { get; set; }
+    }
+
+    public class SubsonicAlbumID3 {
+        [JsonPropertyName("id")]
+        public string Id { get; set; }
+
+        [JsonPropertyName("name")]
+        public string Name { get; set; }
+
+        [JsonPropertyName("artist"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Artist { get; set; }
+
+        [JsonPropertyName("artistId"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string ArtistId { get; set; }
+
+        [JsonPropertyName("coverArt"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string CoverArt { get; set; }
+
+        [JsonPropertyName("songCount")]
+        public int SongCount { get; set; }
+
+        [JsonPropertyName("duration")]
+        public int Duration { get; set; }
+
+        [JsonPropertyName("created"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Created { get; set; }
+
+        [JsonPropertyName("year"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public int? Year { get; set; }
+
+        [JsonPropertyName("genre"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Genre { get; set; }
+
+        [JsonPropertyName("starred"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Starred { get; set; }
+    }
+
+    public class SubsonicAlbumWithSongsID3 : SubsonicAlbumID3 {
+        [JsonPropertyName("song"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicChild> Song { get; set; }
+    }
+}
diff --git a/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicLists.cs b/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicLists.cs
new file mode 100644
index 0000000..6681a05
--- /dev/null
+++ b/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicLists.cs
@@ -0,0 +1,62 @@
+using System;
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+namespace WaveBox.Core.ApiResponse.Subsonic {
+    public class SubsonicAlbumList {
+        [JsonPropertyName("album"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicChild> Album { get; set; }
+    }
+
+    public class SubsonicAlbumList2 {
+        [JsonPropertyName("album"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicAlbumID3> Album { get; set; }
+    }
+
+    // Shared by getRandomSongs (randomSongs) and getSongsByGenre (songsByGenre)
+    public class SubsonicSongs {
+        [JsonPropertyName("song"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicChild> Song { get; set; }
+    }
+
+    public class SubsonicNowPlaying {
+        [JsonPropertyName("entry"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicNowPlayingEntry> Entry { get; set; }
+    }
+
+    public class SubsonicNowPlayingEntry : SubsonicChild {
+        [JsonPropertyName("username")]
+        public string Username { get; set; }
+
+        [JsonPropertyName("minutesAgo"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public int? MinutesAgo { get; set; }
+
+        [JsonPropertyName("playerId"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public int? PlayerId { get; set; }
+
+        [JsonPropertyName("playerName"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string PlayerName { get; set; }
+    }
+
+    public class SubsonicStarred {
+        [JsonPropertyName("artist"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicIndexArtist> Artist { get; set; }
+
+        [JsonPropertyName("album"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicChild> Album { get; set; }
+
+        [JsonPropertyName("song"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicChild> Song { get; set; }
+    }
+
+    public class SubsonicStarred2 {
+        [JsonPropertyName("artist"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicArtistID3> Artist { get; set; }
+
+        [JsonPropertyName("album"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicAlbumID3> Album { get; set; }
+
+        [JsonPropertyName("song"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicChild> Song { get; set; }
+    }
+}
diff --git a/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicPlaylists.cs b/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicPlaylists.cs
new file mode 100644
index 0000000..f0f4c91
--- /dev/null
+++ b/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicPlaylists.cs
@@ -0,0 +1,43 @@
+using System;
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+namespace WaveBox.Core.ApiResponse.Subsonic {
+    public class SubsonicPlaylists {
+        [JsonPropertyName("playlist"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicPlaylist> Playlist { get; set; }
+    }
+
+    // WaveBox playlists have no owner or visibility columns; owner is synthesized as the
+    // requesting user and playlists are reported as public (every WaveBox user sees them all).
+    public class SubsonicPlaylist {
+        [JsonPropertyName("id")]
+        public string Id { get; set; }
+
+        [JsonPropertyName("name")]
+        public string Name { get; set; }
+
+        [JsonPropertyName("owner"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Owner { get; set; }
+
+        [JsonPropertyName("public")]
+        public bool Public { get; set; } = true;
+
+        [JsonPropertyName("songCount")]
+        public int SongCount { get; set; }
+
+        [JsonPropertyName("duration")]
+        public int Duration { get; set; }
+
+        [JsonPropertyName("created"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Created { get; set; }
+
+        [JsonPropertyName("changed"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Changed { get; set; }
+    }
+
+    public class SubsonicPlaylistWithSongs : SubsonicPlaylist {
+        [JsonPropertyName("entry"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicChild> Entry { get; set; }
+    }
+}
diff --git a/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicResponse.cs b/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicResponse.cs
new file mode 100644
index 0000000..cd05639
--- /dev/null
+++ b/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicResponse.cs
@@ -0,0 +1,160 @@
+using System;
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+namespace WaveBox.Core.ApiResponse.Subsonic {
+    // Marks the DTO property whose value is written as XML element text content
+    // (genre names, lyrics bodies) instead of an XML attribute.  JSON renders it
+    // as a regular "value" property, matching the Subsonic JSON convention.
+    [AttributeUsage(AttributeTargets.Property)]
+    public class SubsonicXmlTextAttribute : Attribute {
+    }
+
+    // The one serialization root for the whole Subsonic surface.  Every response, success or
+    // error, is this envelope with exactly one payload property set on the body.
+    public class SubsonicResponse {
+        [JsonPropertyName("subsonic-response")]
+        public SubsonicResponseBody Body { get; set; }
+
+        public SubsonicResponse() {
+        }
+
+        public SubsonicResponse(SubsonicResponseBody body) {
+            Body = body;
+        }
+    }
+
+    public class SubsonicResponseBody {
+        // Highest Subsonic API version whose endpoints are covered here
+        public const string ApiVersion = "1.16.1";
+
+        [JsonPropertyName("status")]
+        public string Status { get; set; } = "ok";
+
+        [JsonPropertyName("version")]
+        public string Version { get; set; } = ApiVersion;
+
+        [JsonPropertyName("type")]
+        public string Type { get; set; } = "WaveBox";
+
+        [JsonPropertyName("serverVersion")]
+        public string ServerVersion { get; set; }
+
+        [JsonPropertyName("openSubsonic")]
+        public bool OpenSubsonic { get; set; } = true;
+
+        // Exactly one of the following is non-null per response; nulls are suppressed so the
+        // envelope stays clean.  XML renders each as a child element of <subsonic-response>.
+
+        [JsonPropertyName("error"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicError Error { get; set; }
+
+        [JsonPropertyName("license"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicLicense License { get; set; }
+
+        [JsonPropertyName("openSubsonicExtensions"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicExtension> OpenSubsonicExtensions { get; set; }
+
+        [JsonPropertyName("tokenInfo"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicTokenInfo TokenInfo { get; set; }
+
+        [JsonPropertyName("scanStatus"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicScanStatus ScanStatus { get; set; }
+
+        [JsonPropertyName("musicFolders"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicMusicFolders MusicFolders { get; set; }
+
+        [JsonPropertyName("indexes"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicIndexes Indexes { get; set; }
+
+        [JsonPropertyName("directory"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicDirectory Directory { get; set; }
+
+        [JsonPropertyName("genres"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicGenres Genres { get; set; }
+
+        [JsonPropertyName("artists"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicArtistsID3 Artists { get; set; }
+
+        [JsonPropertyName("artist"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicArtistWithAlbumsID3 Artist { get; set; }
+
+        [JsonPropertyName("album"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicAlbumWithSongsID3 Album { get; set; }
+
+        [JsonPropertyName("song"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicChild Song { get; set; }
+
+        [JsonPropertyName("videos"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicVideos Videos { get; set; }
+
+        [JsonPropertyName("artistInfo"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicArtistInfo ArtistInfo { get; set; }
+
+        [JsonPropertyName("artistInfo2"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicArtistInfo ArtistInfo2 { get; set; }
+
+        [JsonPropertyName("lyrics"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicLyrics Lyrics { get; set; }
+
+        [JsonPropertyName("nowPlaying"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicNowPlaying NowPlaying { get; set; }
+
+        [JsonPropertyName("starred"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicStarred Starred { get; set; }
+
+        [JsonPropertyName("starred2"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicStarred2 Starred2 { get; set; }
+
+        [JsonPropertyName("albumList"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicAlbumList AlbumList { get; set; }
+
+        [JsonPropertyName("albumList2"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicAlbumList2 AlbumList2 { get; set; }
+
+        [JsonPropertyName("randomSongs"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicSongs RandomSongs { get; set; }
+
+        [JsonPropertyName("songsByGenre"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicSongs SongsByGenre { get; set; }
+
+        [JsonPropertyName("searchResult2"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicSearchResult2 SearchResult2 { get; set; }
+
+        [JsonPropertyName("searchResult3"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicSearchResult3 SearchResult3 { get; set; }
+
+        [JsonPropertyName("playlists"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicPlaylists Playlists { get; set; }
+
+        [JsonPropertyName("playlist"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicPlaylistWithSongs Playlist { get; set; }
+
+        [JsonPropertyName("user"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicUser User { get; set; }
+
+        [JsonPropertyName("users"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public SubsonicUsers Users { get; set; }
+    }
+
+    public class SubsonicError {
+        [JsonPropertyName("code")]
+        public int Code { get; set; }
+
+        [JsonPropertyName("message")]
+        public string Message { get; set; }
+
+        // Subsonic error codes used by WaveBox
+        public const int Generic = 0;
+        public const int MissingParameter = 10;
+        public const int ClientTooOld = 20;
+        public const int ServerTooOld = 30;
+        public const int WrongCredentials = 40;
+        public const int TokenAuthNotSupported = 41;
+        public const int MechanismNotSupported = 42;
+        public const int ConflictingMechanisms = 43;
+        public const int InvalidApiKey = 44;
+        public const int NotAuthorized = 50;
+        public const int NotFound = 70;
+    }
+}
diff --git a/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicSearch.cs b/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicSearch.cs
new file mode 100644
index 0000000..7bd711f
--- /dev/null
+++ b/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicSearch.cs
@@ -0,0 +1,27 @@
+using System;
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+namespace WaveBox.Core.ApiResponse.Subsonic {
+    public class SubsonicSearchResult2 {
+        [JsonPropertyName("artist"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicIndexArtist> Artist { get; set; }
+
+        [JsonPropertyName("album"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicChild> Album { get; set; }
+
+        [JsonPropertyName("song"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicChild> Song { get; set; }
+    }
+
+    public class SubsonicSearchResult3 {
+        [JsonPropertyName("artist"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicArtistID3> Artist { get; set; }
+
+        [JsonPropertyName("album"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicAlbumID3> Album { get; set; }
+
+        [JsonPropertyName("song"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicChild> Song { get; set; }
+    }
+}
diff --git a/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicSystem.cs b/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicSystem.cs
new file mode 100644
index 0000000..e0f7680
--- /dev/null
+++ b/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicSystem.cs
@@ -0,0 +1,43 @@
+using System;
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+namespace WaveBox.Core.ApiResponse.Subsonic {
+    public class SubsonicLicense {
+        [JsonPropertyName("valid")]
+        public bool Valid { get; set; } = true;
+
+        [JsonPropertyName("email"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Email { get; set; }
+
+        [JsonPropertyName("licenseExpires"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string LicenseExpires { get; set; }
+    }
+
+    public class SubsonicExtension {
+        [JsonPropertyName("name")]
+        public string Name { get; set; }
+
+        [JsonPropertyName("versions")]
+        public IList<int> Versions { get; set; }
+    }
+
+    public class SubsonicTokenInfo {
+        [JsonPropertyName("username")]
+        public string Username { get; set; }
+    }
+
+    public class SubsonicScanStatus {
+        [JsonPropertyName("scanning")]
+        public bool Scanning { get; set; }
+
+        [JsonPropertyName("count"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public long? Count { get; set; }
+    }
+
+    // Intentionally empty: WaveBox has no last.fm-style artist metadata, and every field of the
+    // Subsonic artistInfo schema is optional.  Clients calling getArtistInfo(2) get a valid,
+    // empty object rather than an error.
+    public class SubsonicArtistInfo {
+    }
+}
diff --git a/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicUsers.cs b/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicUsers.cs
new file mode 100644
index 0000000..e571aa3
--- /dev/null
+++ b/WaveBox.Core/src/ApiResponse/Subsonic/SubsonicUsers.cs
@@ -0,0 +1,63 @@
+using System;
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+namespace WaveBox.Core.ApiResponse.Subsonic {
+    public class SubsonicUsers {
+        [JsonPropertyName("user"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<SubsonicUser> User { get; set; }
+    }
+
+    // WaveBox roles are coarse (Test < Guest < User < Admin), so the fine-grained Subsonic role
+    // flags are derived: User-level grants the everyday roles, Admin grants administration.
+    // Features WaveBox doesn't have (jukebox, sharing, podcasts, uploads) are always false.
+    public class SubsonicUser {
+        [JsonPropertyName("username")]
+        public string Username { get; set; }
+
+        [JsonPropertyName("email"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public string Email { get; set; }
+
+        [JsonPropertyName("scrobblingEnabled")]
+        public bool ScrobblingEnabled { get; set; }
+
+        [JsonPropertyName("adminRole")]
+        public bool AdminRole { get; set; }
+
+        [JsonPropertyName("settingsRole")]
+        public bool SettingsRole { get; set; }
+
+        [JsonPropertyName("downloadRole")]
+        public bool DownloadRole { get; set; }
+
+        [JsonPropertyName("uploadRole")]
+        public bool UploadRole { get; set; }
+
+        [JsonPropertyName("playlistRole")]
+        public bool PlaylistRole { get; set; }
+
+        [JsonPropertyName("coverArtRole")]
+        public bool CoverArtRole { get; set; }
+
+        [JsonPropertyName("commentRole")]
+        public bool CommentRole { get; set; }
+
+        [JsonPropertyName("podcastRole")]
+        public bool PodcastRole { get; set; }
+
+        [JsonPropertyName("streamRole")]
+        public bool StreamRole { get; set; }
+
+        [JsonPropertyName("jukeboxRole")]
+        public bool JukeboxRole { get; set; }
+
+        [JsonPropertyName("shareRole")]
+        public bool ShareRole { get; set; }
+
+        [JsonPropertyName("videoConversionRole")]
+        public bool VideoConversionRole { get; set; }
+
+        [JsonPropertyName("folder"), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+        public IList<int> Folder { get; set; }
+    }
+}
diff --git a/WaveBox.Core/src/Model/AlbumFolder.cs b/WaveBox.Core/src/Model/AlbumFolder.cs
new file mode 100644
index 0000000..8235012
--- /dev/null
+++ b/WaveBox.Core/src/Model/AlbumFolder.cs
@@ -0,0 +1,12 @@
+using System;
+
+namespace WaveBox.Core.Model {
+    // Result row mapping an album to the folder that holds its songs (MIN(FolderId) when a
+    // multi-disc album spans subfolders).  Lets folder-flavored Subsonic endpoints hand out
+    // browsable folder ids for tag-derived album lists.  ORM-mapped: rooted in ModelTypeRegistry.
+    public class AlbumFolder {
+        public int? AlbumId { get; set; }
+
+        public int? FolderId { get; set; }
+    }
+}
diff --git a/WaveBox.Core/src/Model/GroupCount.cs b/WaveBox.Core/src/Model/GroupCount.cs
new file mode 100644
index 0000000..dfcd9cb
--- /dev/null
+++ b/WaveBox.Core/src/Model/GroupCount.cs
@@ -0,0 +1,13 @@
+using System;
+
+namespace WaveBox.Core.Model {
+    // Result row for GROUP BY aggregate queries (e.g. song count and total duration per album,
+    // album count per album artist or genre).  ORM-mapped: rooted in ModelTypeRegistry.
+    public class GroupCount {
+        public int? GroupId { get; set; }
+
+        public int Count { get; set; }
+
+        public long Total { get; set; }
+    }
+}
diff --git a/WaveBox.Core/src/Model/Playlist.cs b/WaveBox.Core/src/Model/Playlist.cs
index 7377818..a6db9d4 100644
--- a/WaveBox.Core/src/Model/Playlist.cs
+++ b/WaveBox.Core/src/Model/Playlist.cs
@@ -244,6 +244,17 @@ public void RemoveMediaItemAtIndexes(IList<int> indices) {
             } finally {
                 Injection.Get<IDatabase>().CloseSqliteConnection(conn);
             }
+
+            // Refresh the playlist's cached count/duration to match the remaining rows;
+            // stale counts corrupt the positions of later inserts
+            IList<IMediaItem> remaining = ListOfMediaItems();
+            int duration = 0;
+            foreach (IMediaItem remainingItem in remaining) {
+                duration += remainingItem.Duration ?? 0;
+            }
+            PlaylistCount = remaining.Count;
+            PlaylistDuration = duration;
+            UpdateDatabase();
         }
 
         public void MoveMediaItem(int fromIndex, int toIndex) {
diff --git a/WaveBox.Core/src/Model/User.cs b/WaveBox.Core/src/Model/User.cs
index 637d575..2554477 100644
--- a/WaveBox.Core/src/Model/User.cs
+++ b/WaveBox.Core/src/Model/User.cs
@@ -48,6 +48,12 @@ public class User : IGroupingItem {
         [JsonPropertyName("lastfmSession")]
         public string LastfmSession { get; set; }
 
+        // Persistent key for OpenSubsonic apiKey authentication.  IgnoreWrite keeps ORM inserts
+        // from referencing the column (it is added by a schema migration and written only via
+        // the raw SQL in UpdateApiKey); databases created before the migration simply read null.
+        [JsonPropertyName("apiKey"), IgnoreWrite]
+        public string ApiKey { get; set; }
+
         [JsonPropertyName("createTime")]
         public long? CreateTime { get; set; }
 
@@ -143,6 +149,27 @@ public bool UpdateLastfmSession(string sessionKey) {
             return false;
         }
 
+        // Set or clear (null) this user's OpenSubsonic API key
+        public bool UpdateApiKey(string apiKey) {
+            ISQLiteConnection conn = null;
+            try {
+                conn = Injection.Get<IDatabase>().GetSqliteConnection();
+                int affected = conn.Execute("UPDATE User SET ApiKey = ? WHERE UserId = ?", apiKey, this.UserId);
+
+                if (affected > 0) {
+                    this.ApiKey = apiKey;
+
+                    return Injection.Get<IUserRepository>().UpdateUserCache(this);
+                }
+            } catch (Exception e) {
+                logger.Error(e);
+            } finally {
+                Injection.Get<IDatabase>().CloseSqliteConnection(conn);
+            }
+
+            return false;
+        }
+
         // Update a user's username
         public bool UpdateUsername(string username) {
             ISQLiteConnection conn = null;
diff --git a/WaveBox.Core/src/ModelTypeRegistry.cs b/WaveBox.Core/src/ModelTypeRegistry.cs
index 498e529..e384358 100644
--- a/WaveBox.Core/src/ModelTypeRegistry.cs
+++ b/WaveBox.Core/src/ModelTypeRegistry.cs
@@ -14,12 +14,14 @@ public static class ModelTypeRegistry {
         public static void EnsurePreserved() {
             Root<Album>();
             Root<AlbumArtist>();
+            Root<AlbumFolder>();
             Root<Art>();
             Root<ArtItem>();
             Root<Artist>();
             Root<Favorite>();
             Root<Folder>();
             Root<Genre>();
+            Root<GroupCount>();
             Root<MediaItem>();
             Root<Playlist>();
             Root<PlaylistItem>();
diff --git a/WaveBox.Core/src/Repository/AlbumRepository.cs b/WaveBox.Core/src/Repository/AlbumRepository.cs
index 3bbb472..9b84985 100644
--- a/WaveBox.Core/src/Repository/AlbumRepository.cs
+++ b/WaveBox.Core/src/Repository/AlbumRepository.cs
@@ -92,6 +92,62 @@ public IList<Album> AllWithNoMusicBrainzId() {
             return this.database.GetList<Album>("SELECT * FROM Album WHERE MusicBrainzId IS NULL");
         }
 
+        // Albums by date added, newest first (Item.Timestamp is stamped when the item id is generated)
+        public IList<Album> NewestAlbums(int limit, int offset) {
+            return this.database.GetList<Album>(
+                       "SELECT Album.*, AlbumArtist.AlbumArtistName, ArtItem.ArtId FROM Album " +
+                       "LEFT JOIN AlbumArtist ON Album.AlbumArtistId = AlbumArtist.AlbumArtistId " +
+                       "LEFT JOIN ArtItem ON Album.AlbumId = ArtItem.ItemId " +
+                       "JOIN Item ON Item.ItemId = Album.AlbumId " +
+                       "ORDER BY Item.Timestamp DESC LIMIT ? OFFSET ?",
+                       limit, offset);
+        }
+
+        // Albums by last play time, most recent first (album-level PLAYED rows in the Stat table)
+        public IList<Album> RecentAlbums(int limit, int offset) {
+            return this.database.GetList<Album>(
+                       "SELECT Album.*, AlbumArtist.AlbumArtistName, ArtItem.ArtId FROM Stat " +
+                       "JOIN Album ON Album.AlbumId = Stat.ItemId " +
+                       "LEFT JOIN AlbumArtist ON Album.AlbumArtistId = AlbumArtist.AlbumArtistId " +
+                       "LEFT JOIN ArtItem ON Album.AlbumId = ArtItem.ItemId " +
+                       "WHERE Stat.StatType = ? " +
+                       "GROUP BY Album.AlbumId ORDER BY MAX(Stat.Timestamp) DESC LIMIT ? OFFSET ?",
+                       (int)StatType.PLAYED, limit, offset);
+        }
+
+        // Albums by play count, most played first
+        public IList<Album> FrequentAlbums(int limit, int offset) {
+            return this.database.GetList<Album>(
+                       "SELECT Album.*, AlbumArtist.AlbumArtistName, ArtItem.ArtId FROM Stat " +
+                       "JOIN Album ON Album.AlbumId = Stat.ItemId " +
+                       "LEFT JOIN AlbumArtist ON Album.AlbumArtistId = AlbumArtist.AlbumArtistId " +
+                       "LEFT JOIN ArtItem ON Album.AlbumId = ArtItem.ItemId " +
+                       "WHERE Stat.StatType = ? " +
+                       "GROUP BY Album.AlbumId ORDER BY COUNT(Stat.StatId) DESC LIMIT ? OFFSET ?",
+                       (int)StatType.PLAYED, limit, offset);
+        }
+
+        // Representative folder per album (the folder holding its songs), one row per AlbumId
+        public IList<AlbumFolder> FoldersByAlbum() {
+            return this.database.GetList<AlbumFolder>(
+                       "SELECT AlbumId, MIN(FolderId) AS FolderId FROM Song " +
+                       "WHERE AlbumId IS NOT NULL AND FolderId IS NOT NULL GROUP BY AlbumId");
+        }
+
+        // Song count and total duration per album, one row per AlbumId
+        public IList<GroupCount> SongCountsByAlbum() {
+            return this.database.GetList<GroupCount>(
+                       "SELECT AlbumId AS GroupId, COUNT(*) AS Count, IFNULL(SUM(Duration), 0) AS Total FROM Song " +
+                       "WHERE AlbumId IS NOT NULL GROUP BY AlbumId");
+        }
+
+        // Album count per album artist, one row per AlbumArtistId
+        public IList<GroupCount> AlbumCountsByAlbumArtist() {
+            return this.database.GetList<GroupCount>(
+                       "SELECT AlbumArtistId AS GroupId, COUNT(*) AS Count, 0 AS Total FROM Album " +
+                       "WHERE AlbumArtistId IS NOT NULL GROUP BY AlbumArtistId");
+        }
+
         public int CountAlbums() {
             return this.database.GetScalar<int>("SELECT COUNT(AlbumId) FROM Album");
         }
diff --git a/WaveBox.Core/src/Repository/FolderRepository.cs b/WaveBox.Core/src/Repository/FolderRepository.cs
index 9da339c..d43629d 100644
--- a/WaveBox.Core/src/Repository/FolderRepository.cs
+++ b/WaveBox.Core/src/Repository/FolderRepository.cs
@@ -126,6 +126,16 @@ public IList<Folder> ListOfSubFolders(int folderId) {
             return this.database.GetList<Folder>("SELECT * FROM Folder WHERE ParentFolderId = ? ORDER BY FolderName COLLATE NOCASE", folderId);
         }
 
+        // Substring search on folder name, media-folder roots excluded
+        public IList<Folder> SearchFolders(string query) {
+            if ((object)query == null) {
+                return new List<Folder>();
+            }
+            return this.database.GetList<Folder>(
+                       "SELECT * FROM Folder WHERE ParentFolderId IS NOT NULL AND FolderName LIKE ? ORDER BY FolderName COLLATE NOCASE",
+                       "%" + query + "%");
+        }
+
         public int? GetParentFolderId(string path) {
             string parentFolderPath = Directory.GetParent(path).FullName;
 
diff --git a/WaveBox.Core/src/Repository/GenreRepository.cs b/WaveBox.Core/src/Repository/GenreRepository.cs
index dd820ef..407c305 100644
--- a/WaveBox.Core/src/Repository/GenreRepository.cs
+++ b/WaveBox.Core/src/Repository/GenreRepository.cs
@@ -23,6 +23,20 @@ public Genre GenreForId(int? genreId) {
             return this.database.GetSingle<Genre>("SELECT * FROM Genre WHERE GenreId = ?", genreId);
         }
 
+        // Song count per genre, one row per GenreId
+        public IList<GroupCount> SongCountsByGenre() {
+            return this.database.GetList<GroupCount>(
+                       "SELECT GenreId AS GroupId, COUNT(*) AS Count, 0 AS Total FROM Song " +
+                       "WHERE GenreId IS NOT NULL GROUP BY GenreId");
+        }
+
+        // Distinct album count per genre, one row per GenreId
+        public IList<GroupCount> AlbumCountsByGenre() {
+            return this.database.GetList<GroupCount>(
+                       "SELECT GenreId AS GroupId, COUNT(DISTINCT AlbumId) AS Count, 0 AS Total FROM Song " +
+                       "WHERE GenreId IS NOT NULL AND AlbumId IS NOT NULL GROUP BY GenreId");
+        }
+
         private static List<Genre> memCachedGenres = new List<Genre>();
         public Genre GenreForName(string genreName) {
             if ((object)genreName == null) {
diff --git a/WaveBox.Core/src/Repository/Interfaces/IAlbumRepository.cs b/WaveBox.Core/src/Repository/Interfaces/IAlbumRepository.cs
index 5b748bc..62e5557 100644
--- a/WaveBox.Core/src/Repository/Interfaces/IAlbumRepository.cs
+++ b/WaveBox.Core/src/Repository/Interfaces/IAlbumRepository.cs
@@ -15,6 +15,12 @@ public interface IAlbumRepository {
         IList<Album> RangeAlbums(char start, char end);
         IList<Album> LimitAlbums(int index, int duration = Int32.MinValue);
         IList<Album> AllWithNoMusicBrainzId();
+        IList<Album> NewestAlbums(int limit, int offset);
+        IList<Album> RecentAlbums(int limit, int offset);
+        IList<Album> FrequentAlbums(int limit, int offset);
+        IList<AlbumFolder> FoldersByAlbum();
+        IList<GroupCount> SongCountsByAlbum();
+        IList<GroupCount> AlbumCountsByAlbumArtist();
     }
 }
 
diff --git a/WaveBox.Core/src/Repository/Interfaces/IFolderRepository.cs b/WaveBox.Core/src/Repository/Interfaces/IFolderRepository.cs
index fa9fa7a..3c5126b 100644
--- a/WaveBox.Core/src/Repository/Interfaces/IFolderRepository.cs
+++ b/WaveBox.Core/src/Repository/Interfaces/IFolderRepository.cs
@@ -12,6 +12,7 @@ public interface IFolderRepository {
         IList<Song> ListOfSongs(int folderId, bool recursive = false);
         IList<Video> ListOfVideos(int folderId, bool recursive = false);
         IList<Folder> ListOfSubFolders(int folderId);
+        IList<Folder> SearchFolders(string query);
         int? GetParentFolderId(string path);
         IList<Album> AlbumsForFolderId(int folderId);
     }
diff --git a/WaveBox.Core/src/Repository/Interfaces/IGenreRepository.cs b/WaveBox.Core/src/Repository/Interfaces/IGenreRepository.cs
index 806d965..e8eb013 100644
--- a/WaveBox.Core/src/Repository/Interfaces/IGenreRepository.cs
+++ b/WaveBox.Core/src/Repository/Interfaces/IGenreRepository.cs
@@ -10,6 +10,8 @@ public interface IGenreRepository {
         IList<Album> ListOfAlbums(int genreId);
         IList<Song> ListOfSongs(int genreId);
         IList<Folder> ListOfFolders(int genreId);
+        IList<GroupCount> SongCountsByGenre();
+        IList<GroupCount> AlbumCountsByGenre();
         bool InsertGenre(Genre genre, bool replace);
     }
 }
diff --git a/WaveBox.Core/src/SubsonicJsonContext.cs b/WaveBox.Core/src/SubsonicJsonContext.cs
new file mode 100644
index 0000000..fad5356
--- /dev/null
+++ b/WaveBox.Core/src/SubsonicJsonContext.cs
@@ -0,0 +1,13 @@
+using System.Text.Json.Serialization;
+using WaveBox.Core.ApiResponse.Subsonic;
+
+namespace WaveBox.Core {
+    // Source-generated System.Text.Json context for the Subsonic API surface (NativeAOT-safe).
+    // SubsonicResponse is the single serialization root: every Subsonic DTO must be reachable
+    // from its property graph or its metadata is never generated and serialization fails at
+    // runtime under AOT.
+    [JsonSourceGenerationOptions(WriteIndented = false)]
+    [JsonSerializable(typeof(SubsonicResponse))]
+    public partial class SubsonicJsonContext : JsonSerializerContext {
+    }
+}
diff --git a/WaveBox.Server/res/wavebox.db b/WaveBox.Server/res/wavebox.db
index 6f76e0d..b0ebca0 100644
Binary files a/WaveBox.Server/res/wavebox.db and b/WaveBox.Server/res/wavebox.db differ
diff --git a/WaveBox.Server/res/wavebox.sql b/WaveBox.Server/res/wavebox.sql
index 1b08357..47e83bd 100644
--- a/WaveBox.Server/res/wavebox.sql
+++ b/WaveBox.Server/res/wavebox.sql
@@ -139,7 +139,8 @@ CREATE TABLE "User" (
     "PasswordSalt" TEXT NOT NULL,
     "LastfmSession" TEXT,
     "CreateTime" INTEGER NOT NULL,
-    "DeleteTime" INTEGER
+    "DeleteTime" INTEGER,
+    "ApiKey" TEXT
 );
 CREATE TABLE "Song" (
     "ItemId" INTEGER UNIQUE NOT NULL,
@@ -207,5 +208,6 @@ CREATE INDEX "stat_Timestamp" ON "Stat" ("Timestamp");
 CREATE INDEX "song_FolderIdFileName" ON "song" ("FolderId","FileName");
 CREATE INDEX "song_ItemId" ON "Song" ("ItemId");
 CREATE INDEX "favorite_userId" ON "Favorite" ("FavoriteUserId");
+CREATE UNIQUE INDEX "user_ApiKey" ON "User" ("ApiKey");
 CREATE UNIQUE INDEX "album_AlbumNameArtistId" ON "Album" ("AlbumName", "AlbumArtistId");
 COMMIT;
diff --git a/WaveBox.Server/src/ApiHandler/ArtStream.cs b/WaveBox.Server/src/ApiHandler/ArtStream.cs
new file mode 100644
index 0000000..d5349c0
--- /dev/null
+++ b/WaveBox.Server/src/ApiHandler/ArtStream.cs
@@ -0,0 +1,137 @@
+using System;
+using System.IO;
+using System.Linq;
+using SixLabors.ImageSharp;
+using SixLabors.ImageSharp.Processing;
+using WaveBox.Core;
+using WaveBox.Core.Extensions;
+using WaveBox.Core.Model;
+using WaveBox.Core.Model.Repository;
+using WaveBox.Server.Extensions;
+
+namespace WaveBox.ApiHandler {
+    // Art resolution and resizing, shared by the legacy /api/art handler and Subsonic getCoverArt.
+    // Extracted verbatim from ArtApiHandler: art bytes are not stored in the database — they are
+    // re-read from the song's tag or the folder's image file on every request.
+    public static class ArtStream {
+        private static readonly WaveBox.Core.Logging.ILog logger = WaveBox.Core.Logging.LogManager.GetLogger(typeof(ArtStream));
+
+        public static Stream CreateStream(Art art) {
+            if ((object)art.ArtId == null) {
+                return null;
+            }
+
+            int? itemId = Injection.Get<IArtRepository>().ItemIdForArtId((int)art.ArtId);
+
+            if ((object)itemId == null) {
+                return null;
+            }
+
+            ItemType type = Injection.Get<IItemRepository>().ItemTypeForItemId((int)itemId);
+
+            Stream stream = null;
+
+            if (type == ItemType.Song) {
+                stream = StreamForSong((int)itemId);
+            } else if (type == ItemType.Folder) {
+                stream = StreamForFolder((int)itemId);
+            }
+
+            return stream;
+        }
+
+        /// <summary>
+        /// Aspect-fit resize into a size x size box (Lanczos), optional Gaussian blur, always re-encoded as JPEG
+        /// </summary>
+        public static Stream ResizeImage(Stream stream, int size, double blurSigma) {
+            using (var image = SixLabors.ImageSharp.Image.Load(stream)) {
+                float nPercentW = ((float)size / (float)image.Width);
+                float nPercentH = ((float)size / (float)image.Height);
+                float nPercent = nPercentH < nPercentW ? nPercentH : nPercentW;
+
+                int destWidth = (int)(image.Width * nPercent);
+                int destHeight = (int)(image.Height * nPercent);
+
+                image.Mutate(x => {
+                    x.Resize(destWidth, destHeight, KnownResamplers.Lanczos3);
+                    if (blurSigma > 0.0) {
+                        x.GaussianBlur((float)blurSigma);
+                    }
+                });
+
+                MemoryStream output = new MemoryStream();
+                image.SaveAsJpeg(output);
+                output.Position = 0;
+                return output;
+            }
+        }
+
+        public static Stream StreamForSong(int songId) {
+            Song song = Injection.Get<ISongRepository>().SongForId(songId);
+            Stream stream = null;
+
+            // Open the image from the tag
+            TagLib.File f = null;
+            try {
+                f = TagLib.File.Create(song.FilePath());
+                byte[] data = f.Tag.Pictures[0].Data.Data;
+
+                stream = new MemoryStream(data);
+            } catch (TagLib.CorruptFileException e) {
+                logger.IfInfo(song.FileName + " has a corrupt tag so can't return the art. " + e);
+            } catch (Exception e) {
+                logger.Error("Error processing file: ", e);
+            }
+
+            return stream;
+        }
+
+        public static Stream StreamForFolder(int folderId) {
+            Folder folder = Injection.Get<IFolderRepository>().FolderForId(folderId);
+            Stream stream = null;
+
+            string artPath = FolderArtPath(folder);
+
+            if ((object)artPath != null) {
+                stream = new FileStream(artPath, FileMode.Open, FileAccess.Read);
+            }
+
+            return stream;
+        }
+
+        public static string FolderArtPath(Folder folder) {
+            string artPath = null;
+
+            foreach (string fileName in Injection.Get<IServerSettings>().FolderArtNames) {
+                string path = folder.FolderPath + Path.DirectorySeparatorChar + fileName;
+                if (System.IO.File.Exists(path)) {
+                    // Use this one
+                    artPath = path;
+                }
+            }
+
+            if ((object)artPath == null) {
+                // Check for any images
+                FolderContainsImages(folder.FolderPath, out artPath);
+            }
+
+            return artPath;
+        }
+
+        public static bool FolderContainsImages(string dir, out string firstImageFoundPath) {
+            string[] validImageExtensions = new string[] { ".jpg", ".jpeg", ".png", ".gif", ".bmp" };
+            string ext = null;
+            firstImageFoundPath = null;
+
+            foreach (string file in Directory.GetFiles(dir)) {
+                ext = Path.GetExtension(file).ToLower();
+                if (validImageExtensions.Contains(ext) && !Path.GetFileName(file).StartsWith(".")) {
+                    firstImageFoundPath = file;
+                }
+            }
+
+            // Return true if firstImageFoundPath exists
+            return ((object)firstImageFoundPath != null);
+        }
+    }
+}
diff --git a/WaveBox.Server/src/ApiHandler/Handlers/ArtApiHandler.cs b/WaveBox.Server/src/ApiHandler/Handlers/ArtApiHandler.cs
index 1f2fd13..7b14b59 100644
--- a/WaveBox.Server/src/ApiHandler/Handlers/ArtApiHandler.cs
+++ b/WaveBox.Server/src/ApiHandler/Handlers/ArtApiHandler.cs
@@ -52,7 +52,7 @@ public void Process(UriWrapper uri, IHttpProcessor processor, User user) {
 
             // Grab art stream
             Art art = Injection.Get<IArtRepository>().ArtForId((int)uri.Id);
-            Stream stream = CreateStream(art);
+            Stream stream = ArtStream.CreateStream(art);
 
             // If the stream could not be produced, return error
             if ((object)stream == null) {
@@ -68,7 +68,7 @@ public void Process(UriWrapper uri, IHttpProcessor processor, User user) {
                 // Parse size if valid
                 if (size != Int32.MaxValue) {
                     try {
-                        Stream resized = ResizeImage(stream, size, blurSigma);
+                        Stream resized = ArtStream.ResizeImage(stream, size, blurSigma);
                         stream.Close();
                         stream = resized;
                     } catch (Exception e) {
@@ -87,123 +87,5 @@ public void Process(UriWrapper uri, IHttpProcessor processor, User user) {
             // Close the file so we don't get sharing violations on future accesses
             stream.Close();
         }
-
-        /// <summary>
-        /// Aspect-fit resize into a size x size box (Lanczos), optional Gaussian blur, always re-encoded as JPEG
-        /// </summary>
-        private Stream ResizeImage(Stream stream, int size, double blurSigma) {
-            using (var image = SixLabors.ImageSharp.Image.Load(stream)) {
-                float nPercentW = ((float)size / (float)image.Width);
-                float nPercentH = ((float)size / (float)image.Height);
-                float nPercent = nPercentH < nPercentW ? nPercentH : nPercentW;
-
-                int destWidth = (int)(image.Width * nPercent);
-                int destHeight = (int)(image.Height * nPercent);
-
-                image.Mutate(x => {
-                    x.Resize(destWidth, destHeight, KnownResamplers.Lanczos3);
-                    if (blurSigma > 0.0) {
-                        x.GaussianBlur((float)blurSigma);
-                    }
-                });
-
-                MemoryStream output = new MemoryStream();
-                image.SaveAsJpeg(output);
-                output.Position = 0;
-                return output;
-            }
-        }
-
-        private Stream CreateStream(Art art) {
-            if ((object)art.ArtId == null) {
-                return null;
-            }
-
-            int? itemId = Injection.Get<IArtRepository>().ItemIdForArtId((int)art.ArtId);
-
-            if ((object)itemId == null) {
-                return null;
-            }
-
-            ItemType type = Injection.Get<IItemRepository>().ItemTypeForItemId((int)itemId);
-
-            Stream stream = null;
-
-            if (type == ItemType.Song) {
-                stream = StreamForSong((int)itemId);
-            } else if (type == ItemType.Folder) {
-                stream = StreamForFolder((int)itemId);
-            }
-
-            return stream;
-        }
-
-        private Stream StreamForSong(int songId) {
-            Song song = Injection.Get<ISongRepository>().SongForId(songId);
-            Stream stream = null;
-
-            // Open the image from the tag
-            TagLib.File f = null;
-            try {
-                f = TagLib.File.Create(song.FilePath());
-                byte[] data = f.Tag.Pictures[0].Data.Data;
-
-                stream = new MemoryStream(data);
-            } catch (TagLib.CorruptFileException e) {
-                logger.IfInfo(song.FileName + " has a corrupt tag so can't return the art. " + e);
-            } catch (Exception e) {
-                logger.Error("Error processing file: ", e);
-            }
-
-            return stream;
-        }
-
-        private Stream StreamForFolder(int folderId) {
-            Folder folder = Injection.Get<IFolderRepository>().FolderForId(folderId);
-            Stream stream = null;
-
-            string artPath = FolderArtPath(folder);
-
-            if ((object)artPath != null) {
-                stream = new FileStream(artPath, FileMode.Open, FileAccess.Read);
-            }
-
-            return stream;
-        }
-
-        private string FolderArtPath(Folder folder) {
-            string artPath = null;
-
-            foreach (string fileName in Injection.Get<IServerSettings>().FolderArtNames) {
-                string path = folder.FolderPath + Path.DirectorySeparatorChar + fileName;
-                if (System.IO.File.Exists(path)) {
-                    // Use this one
-                    artPath = path;
-                }
-            }
-
-            if ((object)artPath == null) {
-                // Check for any images
-                FolderContainsImages(folder.FolderPath, out artPath);
-            }
-
-            return artPath;
-        }
-
-        private bool FolderContainsImages(string dir, out string firstImageFoundPath) {
-            string[] validImageExtensions = new string[] { ".jpg", ".jpeg", ".png", ".gif", ".bmp" };
-            string ext = null;
-            firstImageFoundPath = null;
-
-            foreach (string file in Directory.GetFiles(dir)) {
-                ext = Path.GetExtension(file).ToLower();
-                if (validImageExtensions.Contains(ext) && !Path.GetFileName(file).StartsWith(".")) {
-                    firstImageFoundPath = file;
-                }
-            }
-
-            // Return true if firstImageFoundPath exists
-            return ((object)firstImageFoundPath != null);
-        }
     }
 }
diff --git a/WaveBox.Server/src/ApiHandler/Handlers/TranscodeApiHandler.cs b/WaveBox.Server/src/ApiHandler/Handlers/TranscodeApiHandler.cs
index 6147913..dccd427 100644
--- a/WaveBox.Server/src/ApiHandler/Handlers/TranscodeApiHandler.cs
+++ b/WaveBox.Server/src/ApiHandler/Handlers/TranscodeApiHandler.cs
@@ -207,63 +207,10 @@ public void Process(UriWrapper uri, IHttpProcessor processor, User user) {
                     transcoder = transcodeService.TranscodeVideo(item, transType, quality, isDirect, width, height, maintainAspect, offsetSeconds, lengthSeconds);
                 }
 
-                // If a transcoder was generated...
-                if ((object)transcoder != null) {
-                    length = (long)transcoder.EstimatedOutputSize;
-
-                    // Wait up 5 seconds for file or basestream to appear
-                    for (int i = 0; i < 20; i++) {
-                        if (transcoder.IsDirect) {
-                            logger.IfInfo("Checking if base stream exists");
-                            if ((object)transcoder.TranscodeProcess != null && (object)transcoder.TranscodeProcess.StandardOutput.BaseStream != null) {
-                                // The base stream exists, so the transcoding process has started
-                                logger.IfInfo("Base stream exists, starting transfer");
-                                stream = transcoder.TranscodeProcess.StandardOutput.BaseStream;
-                                break;
-                            }
-                        } else {
-                            logger.IfInfo("Checking if file exists (" + transcoder.OutputPath + ")");
-                            if (File.Exists(transcoder.OutputPath)) {
-                                // The file exists, so the transcoding process has started
-                                stream = new FileStream(transcoder.OutputPath, FileMode.Open, FileAccess.Read);
-                                break;
-                            }
-                        }
-                        Thread.Sleep(250);
-                    }
-                }
-
-                // Send the file if either there is no transcoder and the original file exists OR
-                // it's a direct transcoder and the base stream exists OR
-                // it's a file transcoder and the transcoded file exists
-                if ((object)transcoder == null && File.Exists(item.FilePath()) ||
-                        (transcoder.IsDirect && (object)stream != null) ||
-                        (!transcoder.IsDirect && File.Exists(transcoder.OutputPath))) {
-                    logger.IfInfo("Sending direct stream");
-                    string mimeType = (object)transcoder == null ? item.FileType.MimeType() : transcoder.MimeType;
-                    processor.Transcoder = transcoder;
-
-                    if (uri.Parameters.ContainsKey("offsetSeconds")) {
-                        logger.IfInfo("Writing file at offsetSeconds " + uri.Parameters["offsetSeconds"]);
-                    }
-
-                    DateTime lastModified = transcoder.IsDirect ? DateTime.UtcNow : new FileInfo(transcoder.OutputPath).LastWriteTimeUtc;
-
-                    // Direct write file
-                    processor.WriteFile(stream, startOffset, length, mimeType, null, estimateContentLength, lastModified, limitToSize);
-                    stream.Close();
+                // Wait for the transcoder's output and send it (shared with Subsonic stream)
+                if (TranscodeStreamer.Send(transcodeService, transcoder, processor, startOffset, limitToSize, estimateContentLength)) {
                     logger.IfInfo("Successfully sent direct stream");
-
-                    if (uri.Parameters.ContainsKey("offsetSeconds")) {
-                        logger.IfInfo("DONE writing file at offsetSeconds " + uri.Parameters["offsetSeconds"]);
-                    }
-                } else {
-                    processor.WriteErrorHeader();
                 }
-
-                // Spin off a thread to consume the transcoder in 30 seconds.
-                Thread consume = new Thread(() => transcodeService.ConsumedTranscode(transcoder));
-                consume.Start();
             } catch (Exception e) {
                 logger.Error(e);
             }
diff --git a/WaveBox.Server/src/ApiHandler/Handlers/UsersApiHandler.cs b/WaveBox.Server/src/ApiHandler/Handlers/UsersApiHandler.cs
index 29d7f4e..0ba6036 100644
--- a/WaveBox.Server/src/ApiHandler/Handlers/UsersApiHandler.cs
+++ b/WaveBox.Server/src/ApiHandler/Handlers/UsersApiHandler.cs
@@ -25,7 +25,10 @@ public bool CheckPermission(User user, string action) {
                 return user.HasPermission(Role.Admin);
             // Write
             // update - so user can update their own username/password, but not role
+            // generateApiKey/revokeApiKey - self-service (admin may manage any user's key)
             case "update":
+            case "generateApiKey":
+            case "revokeApiKey":
                 return user.HasPermission(Role.User);
             // Read
             case "read":
@@ -170,6 +173,9 @@ public void Process(UriWrapper uri, IHttpProcessor processor, User user) {
                     return;
                 }
 
+                // Drop any cached Subsonic credential verification for this user
+                Injection.Get<WaveBox.Subsonic.SubsonicAuth>().Evict(deleteUser.UserName);
+
                 // Return deleted user
                 logger.IfInfo(String.Format("Successfully deleted user [id: {0}, username: {1}]", deleteUser.UserId, deleteUser.UserName));
                 listOfUsers.Add(deleteUser);
@@ -187,6 +193,10 @@ public void Process(UriWrapper uri, IHttpProcessor processor, User user) {
                     return;
                 }
 
+                // Drop any cached Subsonic credential verification before mutating credentials
+                // (keyed by the pre-update username)
+                Injection.Get<WaveBox.Subsonic.SubsonicAuth>().Evict(updateUser.UserName);
+
                 // If user isn't an admin, verify that they are attempting to update themselves
                 if (!user.HasPermission(Role.Admin) && user.UserId != updateUser.UserId) {
                     processor.WriteJson(new UsersResponse("Permission denied", null));
@@ -225,6 +235,35 @@ public void Process(UriWrapper uri, IHttpProcessor processor, User user) {
                 return;
             }
 
+            // generateApiKey / revokeApiKey - manage the user's OpenSubsonic API key
+            if (uri.Action == "generateApiKey" || uri.Action == "revokeApiKey") {
+                User keyUser = Injection.Get<IUserRepository>().UserForId((int)uri.Id);
+                if (keyUser.UserName == null) {
+                    processor.WriteJson(new UsersResponse("Invalid user ID for action '" + uri.Action + "'", null));
+                    return;
+                }
+
+                // Non-admins may only manage their own key
+                if (!user.HasPermission(Role.Admin) && user.UserId != keyUser.UserId) {
+                    processor.WriteJson(new UsersResponse("Permission denied", null));
+                    return;
+                }
+
+                string apiKey = uri.Action == "generateApiKey"
+                    ? Convert.ToHexString(System.Security.Cryptography.RandomNumberGenerator.GetBytes(32)).ToLowerInvariant()
+                    : null;
+                if (!keyUser.UpdateApiKey(apiKey)) {
+                    processor.WriteJson(new UsersResponse("Action '" + uri.Action + "' failed to update API key", null));
+                    return;
+                }
+
+                logger.IfInfo(String.Format("Successfully {0} API key for user [id: {1}, username: {2}]", apiKey == null ? "revoked" : "generated", keyUser.UserId, keyUser.UserName));
+                listOfUsers.Add(keyUser);
+
+                processor.WriteJson(new UsersResponse(null, listOfUsers));
+                return;
+            }
+
             // Invalid action
             processor.WriteJson(new UsersResponse("Invalid action specified", null));
             return;
diff --git a/WaveBox.Server/src/Injection/ServerModule.cs b/WaveBox.Server/src/Injection/ServerModule.cs
index 28a2db2..019a813 100644
--- a/WaveBox.Server/src/Injection/ServerModule.cs
+++ b/WaveBox.Server/src/Injection/ServerModule.cs
@@ -18,6 +18,9 @@ public static IServiceCollection AddWaveBoxServer(this IServiceCollection servic
             services.AddSingleton<IApiAuthenticate, ApiAuthenticate>();
             services.AddSingleton<IApiHandlerFactory, ApiHandlerFactory>();
 
+            // Subsonic API (stateless per-request auth with a verified-credential cache)
+            services.AddSingleton<WaveBox.Subsonic.SubsonicAuth>();
+
             // Web client with 5 second timeout (was TimedWebClient/LinuxWebClient under Mono)
             services.AddSingleton<IWebClient>(sp => new HttpClientWebClient(5000));
 
diff --git a/WaveBox.Server/src/Program.cs b/WaveBox.Server/src/Program.cs
index 7ae8a5b..401a35a 100644
--- a/WaveBox.Server/src/Program.cs
+++ b/WaveBox.Server/src/Program.cs
@@ -46,6 +46,9 @@ public static void Main(string[] args) {
             // Root ORM-mapped model types so trimming/NativeAOT preserves their reflection metadata
             ModelTypeRegistry.EnsurePreserved();
 
+            // Root Subsonic DTO types for the reflection-based Subsonic XML serializer
+            WaveBox.Core.ApiResponse.Subsonic.SubsonicDtoRegistry.EnsurePreserved();
+
             WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
 
             short port = ReadPortFromConf();
@@ -57,6 +60,7 @@ public static void Main(string[] args) {
 
             builder.Services.AddWaveBoxCore().AddWaveBoxServer();
             builder.Services.AddSingleton<ApiDispatcher>();
+            builder.Services.AddSingleton<WaveBox.Subsonic.SubsonicDispatcher>();
             builder.Services.AddHostedService<WaveBoxLifecycleService>();
 
             // Standards-compliant gzip/deflate for text responses (replaces the hand-rolled negotiation)
@@ -88,6 +92,10 @@ public static void Main(string[] args) {
 
             app.UseResponseCompression();
 
+            // Subsonic-compatible API branch; registered before the terminal legacy handler
+            WaveBox.Subsonic.SubsonicDispatcher subsonicDispatcher = app.Services.GetRequiredService<WaveBox.Subsonic.SubsonicDispatcher>();
+            app.Map("/rest", branch => branch.Run(subsonicDispatcher.ProcessAsync));
+
             // Single terminal handler: /api dispatch plus web UI, matching the legacy server's routing
             ApiDispatcher dispatcher = app.Services.GetRequiredService<ApiDispatcher>();
             app.Run(dispatcher.ProcessAsync);
diff --git a/WaveBox.Server/src/Static/Database.cs b/WaveBox.Server/src/Static/Database.cs
index 2a06c75..135711b 100644
--- a/WaveBox.Server/src/Static/Database.cs
+++ b/WaveBox.Server/src/Static/Database.cs
@@ -77,6 +77,10 @@ public void DatabaseSetup() {
                 }
             }
 
+            // Upgrade databases created before newer columns existed (the bundled template's
+            // Version table is empty, so schema state is detected per-column instead)
+            this.UpgradeSchema();
+
             if (!File.Exists(QuerylogPath)) {
                 try {
                     logger.IfInfo("Query log database file doesn't exist; Creating it : " + QUERY_LOG_FILE_NAME);
@@ -101,6 +105,25 @@ public void DatabaseSetup() {
             }
         }
 
+        private void UpgradeSchema() {
+            ISQLiteConnection conn = null;
+            try {
+                conn = GetSqliteConnection();
+
+                // Subsonic API keys: User.ApiKey column + unique index
+                int hasApiKey = conn.ExecuteScalar<int>("SELECT COUNT(*) FROM pragma_table_info('User') WHERE name = 'ApiKey'");
+                if (hasApiKey == 0) {
+                    logger.IfInfo("Upgrading database schema: adding User.ApiKey");
+                    conn.Execute("ALTER TABLE User ADD COLUMN ApiKey TEXT");
+                }
+                conn.Execute("CREATE UNIQUE INDEX IF NOT EXISTS user_ApiKey ON User(ApiKey)");
+            } catch (Exception e) {
+                logger.Error(e);
+            } finally {
+                CloseSqliteConnection(conn);
+            }
+        }
+
         public ISQLiteConnection GetSqliteConnection() {
             if (isPoolingEnabled) {
                 return mainPool.GetSqliteConnection();
diff --git a/WaveBox.Server/src/Subsonic/Handlers/SubsonicAnnotationHandlers.cs b/WaveBox.Server/src/Subsonic/Handlers/SubsonicAnnotationHandlers.cs
new file mode 100644
index 0000000..19f8aee
--- /dev/null
+++ b/WaveBox.Server/src/Subsonic/Handlers/SubsonicAnnotationHandlers.cs
@@ -0,0 +1,143 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using WaveBox.Api;
+using WaveBox.Core;
+using WaveBox.Core.ApiResponse.Subsonic;
+using WaveBox.Core.Extensions;
+using WaveBox.Core.Model;
+using WaveBox.Core.Model.Repository;
+using WaveBox.Service;
+using WaveBox.Service.Services;
+
+namespace WaveBox.Subsonic.Handlers {
+    public static class SubsonicAnnotationHandlers {
+        private static readonly WaveBox.Core.Logging.ILog logger = WaveBox.Core.Logging.LogManager.GetLogger(typeof(SubsonicAnnotationHandlers));
+
+        public static void Star(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            List<int> ids = AllTargetIds(req);
+            if (ids.Count == 0) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.MissingParameter, "Required parameter id is missing");
+                return;
+            }
+
+            IFavoriteRepository favoriteRepository = Injection.Get<IFavoriteRepository>();
+            IItemRepository itemRepository = Injection.Get<IItemRepository>();
+
+            // Skip ids that are already starred so repeated star calls don't stack duplicates
+            HashSet<int> alreadyStarred = new HashSet<int>(
+                favoriteRepository.FavoritesForUserId((int)user.UserId)
+                .Where(f => f.FavoriteItemId != null)
+                .Select(f => (int)f.FavoriteItemId));
+
+            foreach (int id in ids) {
+                if (alreadyStarred.Contains(id)) {
+                    continue;
+                }
+                ItemType itemType = itemRepository.ItemTypeForItemId(id);
+                if (itemType == ItemType.Unknown) {
+                    SubsonicWriter.WriteError(req, processor, SubsonicError.NotFound, "No item exists with id " + id);
+                    return;
+                }
+                favoriteRepository.AddFavorite((int)user.UserId, id, itemType);
+            }
+
+            SubsonicWriter.Write(req, processor, SubsonicWriter.Body());
+        }
+
+        public static void Unstar(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            List<int> ids = AllTargetIds(req);
+            if (ids.Count == 0) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.MissingParameter, "Required parameter id is missing");
+                return;
+            }
+
+            IFavoriteRepository favoriteRepository = Injection.Get<IFavoriteRepository>();
+            IList<Favorite> favorites = favoriteRepository.FavoritesForUserId((int)user.UserId);
+
+            foreach (int id in ids) {
+                foreach (Favorite favorite in favorites.Where(f => f.FavoriteItemId == id && f.FavoriteId != null)) {
+                    favoriteRepository.DeleteFavorite((int)favorite.FavoriteId);
+                }
+            }
+
+            SubsonicWriter.Write(req, processor, SubsonicWriter.Body());
+        }
+
+        // star/unstar accept media ids (id), ID3 album ids (albumId), and ID3 artist ids
+        // (artistId); the global id space makes them interchangeable
+        private static List<int> AllTargetIds(SubsonicRequest req) {
+            List<int> ids = new List<int>();
+            ids.AddRange(req.GetIntList("id"));
+            ids.AddRange(req.GetIntList("albumId"));
+            ids.AddRange(req.GetIntList("artistId"));
+            return ids;
+        }
+
+        public static void Scrobble(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            IList<int> ids = req.GetIntList("id");
+            if (ids.Count == 0) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.MissingParameter, "Required parameter id is missing");
+                return;
+            }
+
+            // time values are milliseconds since epoch, parallel to the id values
+            IList<string> times = req.GetAll("time");
+            bool submission = req.GetBool("submission", true);
+
+            ISongRepository songRepository = Injection.Get<ISongRepository>();
+            IStatRepository statRepository = Injection.Get<IStatRepository>();
+            NowPlayingService nowPlayingService = (NowPlayingService)ServiceManager.GetInstance("nowplaying");
+            List<LfmScrobbleData> lastfmScrobbles = new List<LfmScrobbleData>();
+
+            for (int i = 0; i < ids.Count; i++) {
+                Song song = songRepository.SongForId(ids[i]);
+                if (song == null || song.ItemId == null) {
+                    continue;
+                }
+
+                long timestamp = DateTime.UtcNow.ToUnixTime();
+                long parsedMs;
+                if (i < times.Count && Int64.TryParse(times[i], out parsedMs)) {
+                    timestamp = parsedMs / 1000;
+                }
+
+                // Register with now playing regardless; a submission also records play stats
+                // (song, album, artist, folder — same as the legacy stats endpoint)
+                if (nowPlayingService != null && song.Duration != null && song.Duration > 0) {
+                    nowPlayingService.Register(user, song, timestamp);
+                }
+
+                if (submission) {
+                    statRepository.RecordStat((int)song.ItemId, StatType.PLAYED, timestamp);
+                    if ((object)song.AlbumId != null) {
+                        statRepository.RecordStat((int)song.AlbumId, StatType.PLAYED, timestamp);
+                    }
+                    if ((object)song.ArtistId != null) {
+                        statRepository.RecordStat((int)song.ArtistId, StatType.PLAYED, timestamp);
+                    }
+                    if ((object)song.FolderId != null) {
+                        statRepository.RecordStat((int)song.FolderId, StatType.PLAYED, timestamp);
+                    }
+
+                    lastfmScrobbles.Add(new LfmScrobbleData((int)song.ItemId, timestamp));
+                }
+            }
+
+            // Pass submissions through to Last.fm when the user has linked an account
+            if (submission && lastfmScrobbles.Count > 0 && user.LastfmSession != null) {
+                Thread lastfmThread = new Thread(() => {
+                    try {
+                        new Lastfm(user).Scrobble(lastfmScrobbles, LfmScrobbleType.SUBMIT);
+                    } catch (Exception e) {
+                        logger.Error(e);
+                    }
+                });
+                lastfmThread.Start();
+            }
+
+            SubsonicWriter.Write(req, processor, SubsonicWriter.Body());
+        }
+    }
+}
diff --git a/WaveBox.Server/src/Subsonic/Handlers/SubsonicBrowsingHandlers.cs b/WaveBox.Server/src/Subsonic/Handlers/SubsonicBrowsingHandlers.cs
new file mode 100644
index 0000000..24d1250
--- /dev/null
+++ b/WaveBox.Server/src/Subsonic/Handlers/SubsonicBrowsingHandlers.cs
@@ -0,0 +1,275 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using WaveBox.Api;
+using WaveBox.Core;
+using WaveBox.Core.ApiResponse.Subsonic;
+using WaveBox.Core.Extensions;
+using WaveBox.Core.Model;
+using WaveBox.Core.Model.Repository;
+
+namespace WaveBox.Subsonic.Handlers {
+    public static class SubsonicBrowsingHandlers {
+        public static void GetMusicFolders(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            List<SubsonicMusicFolder> folders = new List<SubsonicMusicFolder>();
+            foreach (Folder root in Injection.Get<IFolderRepository>().MediaFolders()) {
+                folders.Add(new SubsonicMusicFolder {
+                    Id = root.FolderId == null ? null : root.FolderId.ToString(),
+                    Name = root.FolderName
+                });
+            }
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.MusicFolders = new SubsonicMusicFolders { MusicFolder = folders };
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        public static void GetIndexes(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            IFolderRepository folderRepository = Injection.Get<IFolderRepository>();
+            int? musicFolderId = req.GetInt("musicFolderId");
+
+            // Top-level entries across the requested media folder(s) plus loose media at the roots
+            List<Folder> topLevel = new List<Folder>();
+            List<SubsonicChild> looseMedia = new List<SubsonicChild>();
+            foreach (Folder root in folderRepository.MediaFolders()) {
+                if (musicFolderId != null && root.FolderId != musicFolderId) {
+                    continue;
+                }
+                topLevel.AddRange(folderRepository.ListOfSubFolders((int)root.FolderId));
+                looseMedia.AddRange(folderRepository.ListOfSongs((int)root.FolderId).Select(SubsonicMapper.ChildFromSong));
+                looseMedia.AddRange(folderRepository.ListOfVideos((int)root.FolderId).Select(SubsonicMapper.ChildFromVideo));
+            }
+            topLevel.Sort((x, y) => StringComparer.OrdinalIgnoreCase.Compare(x.FolderName, y.FolderName));
+
+            List<SubsonicIndex> indexes = new List<SubsonicIndex>();
+            foreach (KeyValuePair<string, List<Folder>> bucket in SubsonicMapper.GroupByIndex(topLevel, f => f.FolderName)) {
+                indexes.Add(new SubsonicIndex {
+                    Name = bucket.Key,
+                    Artist = bucket.Value.Select(f => new SubsonicIndexArtist {
+                        Id = f.FolderId == null ? null : f.FolderId.ToString(),
+                        Name = f.FolderName
+                    }).ToList()
+                });
+            }
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.Indexes = new SubsonicIndexes {
+                LastModified = DateTimeOffset.UtcNow.ToUnixTimeMilliseconds(),
+                IgnoredArticles = "",
+                Index = indexes,
+                Child = looseMedia.Count > 0 ? looseMedia : null
+            };
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        // Accepts folder ids (the true directory tree) but also album and album-artist ids,
+        // because getAlbumList/search2 hand out album entries as browsable directories to
+        // folder-mode clients.  The global item id space makes the type resolvable from the id.
+        public static void GetMusicDirectory(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            int? id = req.GetInt("id");
+            if (id == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.MissingParameter, "Required parameter id is missing");
+                return;
+            }
+
+            SubsonicDirectory directory = null;
+            ItemType itemType = Injection.Get<IItemRepository>().ItemTypeForItemId((int)id);
+
+            if (itemType == ItemType.Folder) {
+                IFolderRepository folderRepository = Injection.Get<IFolderRepository>();
+                Folder folder = folderRepository.FolderForId((int)id);
+                if (folder != null && folder.FolderId != null) {
+                    List<SubsonicChild> children = new List<SubsonicChild>();
+                    children.AddRange(folderRepository.ListOfSubFolders((int)folder.FolderId).Select(SubsonicMapper.ChildFromFolder));
+                    children.AddRange(folderRepository.ListOfSongs((int)folder.FolderId).Select(SubsonicMapper.ChildFromSong));
+                    children.AddRange(folderRepository.ListOfVideos((int)folder.FolderId).Select(SubsonicMapper.ChildFromVideo));
+
+                    directory = new SubsonicDirectory {
+                        Id = folder.FolderId.ToString(),
+                        Parent = folder.ParentFolderId == null ? null : folder.ParentFolderId.ToString(),
+                        Name = folder.FolderName,
+                        Child = children
+                    };
+                }
+            } else if (itemType == ItemType.Album) {
+                Album album = Injection.Get<IAlbumRepository>().AlbumForId((int)id);
+                if (album != null && album.AlbumId != null) {
+                    directory = new SubsonicDirectory {
+                        Id = album.AlbumId.ToString(),
+                        Parent = album.AlbumArtistId == null ? null : album.AlbumArtistId.ToString(),
+                        Name = album.AlbumName,
+                        Child = album.ListOfSongs().Select(SubsonicMapper.ChildFromSong).ToList()
+                    };
+                }
+            } else if (itemType == ItemType.AlbumArtist) {
+                AlbumArtist albumArtist = Injection.Get<IAlbumArtistRepository>().AlbumArtistForId(id);
+                if (albumArtist != null && albumArtist.AlbumArtistId != null) {
+                    directory = new SubsonicDirectory {
+                        Id = albumArtist.AlbumArtistId.ToString(),
+                        Name = albumArtist.AlbumArtistName,
+                        Child = albumArtist.ListOfAlbums().Select(SubsonicMapper.ChildFromAlbum).ToList()
+                    };
+                }
+            }
+
+            if (directory == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.NotFound, "Directory not found");
+                return;
+            }
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.Directory = directory;
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        public static void GetArtists(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            IList<AlbumArtist> albumArtists = Injection.Get<IAlbumArtistRepository>().AllAlbumArtists();
+            IDictionary<int, GroupCount> albumCounts = SubsonicMapper.ToLookup(Injection.Get<IAlbumRepository>().AlbumCountsByAlbumArtist());
+
+            List<SubsonicIndexID3> indexes = new List<SubsonicIndexID3>();
+            foreach (KeyValuePair<string, List<AlbumArtist>> bucket in SubsonicMapper.GroupByIndex(albumArtists, a => a.AlbumArtistName)) {
+                indexes.Add(new SubsonicIndexID3 {
+                    Name = bucket.Key,
+                    Artist = bucket.Value.Select(a => {
+                        GroupCount count;
+                        int? albumCount = a.AlbumArtistId != null && albumCounts.TryGetValue((int)a.AlbumArtistId, out count) ? count.Count : (int?)0;
+                        // includeCoverArt: false — ArtId is a DB lookup per artist, too costly for the full index
+                        return SubsonicMapper.ArtistID3FromAlbumArtist(a, albumCount, false);
+                    }).ToList()
+                });
+            }
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.Artists = new SubsonicArtistsID3 { IgnoredArticles = "", Index = indexes };
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        public static void GetArtist(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            int? id = req.GetInt("id");
+            if (id == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.MissingParameter, "Required parameter id is missing");
+                return;
+            }
+
+            AlbumArtist albumArtist = Injection.Get<IAlbumArtistRepository>().AlbumArtistForId(id);
+            if (albumArtist == null || albumArtist.AlbumArtistId == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.NotFound, "Artist not found");
+                return;
+            }
+
+            IList<Album> albums = albumArtist.ListOfAlbums();
+            IDictionary<int, GroupCount> songCounts = SubsonicMapper.ToLookup(Injection.Get<IAlbumRepository>().SongCountsByAlbum());
+
+            SubsonicArtistWithAlbumsID3 dto = new SubsonicArtistWithAlbumsID3();
+            SubsonicMapper.FillArtistID3(dto, albumArtist, albums.Count, true);
+            dto.Album = albums.Select(a => SubsonicMapper.AlbumID3FromAlbum(a, songCounts)).ToList();
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.Artist = dto;
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        public static void GetAlbum(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            int? id = req.GetInt("id");
+            if (id == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.MissingParameter, "Required parameter id is missing");
+                return;
+            }
+
+            Album album = Injection.Get<IAlbumRepository>().AlbumForId((int)id);
+            if (album == null || album.AlbumId == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.NotFound, "Album not found");
+                return;
+            }
+
+            // Already disc/track-sorted with artist/genre/art joined in
+            IList<Song> songs = album.ListOfSongs();
+
+            SubsonicAlbumWithSongsID3 dto = new SubsonicAlbumWithSongsID3();
+            SubsonicMapper.FillAlbumID3(dto, album, null);
+            dto.SongCount = songs.Count;
+            dto.Duration = songs.Sum(s => s.Duration ?? 0);
+            dto.Created = songs.Count > 0 ? SubsonicMapper.Iso8601(songs[0].LastModified) : null;
+            dto.Genre = songs.Select(s => s.GenreName).FirstOrDefault(g => g != null);
+            dto.Song = songs.Select(SubsonicMapper.ChildFromSong).ToList();
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.Album = dto;
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        public static void GetSong(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            int? id = req.GetInt("id");
+            if (id == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.MissingParameter, "Required parameter id is missing");
+                return;
+            }
+
+            Song song = Injection.Get<ISongRepository>().SongForId((int)id);
+            if (song == null || song.ItemId == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.NotFound, "Song not found");
+                return;
+            }
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.Song = SubsonicMapper.ChildFromSong(song);
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        public static void GetGenres(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            IGenreRepository genreRepository = Injection.Get<IGenreRepository>();
+            IDictionary<int, GroupCount> songCounts = SubsonicMapper.ToLookup(genreRepository.SongCountsByGenre());
+            IDictionary<int, GroupCount> albumCounts = SubsonicMapper.ToLookup(genreRepository.AlbumCountsByGenre());
+
+            List<SubsonicGenre> genres = new List<SubsonicGenre>();
+            foreach (Genre genre in genreRepository.AllGenres()) {
+                if (genre.GenreId == null) {
+                    continue;
+                }
+                GroupCount count;
+                genres.Add(new SubsonicGenre {
+                    Value = genre.GenreName,
+                    SongCount = songCounts.TryGetValue((int)genre.GenreId, out count) ? count.Count : 0,
+                    AlbumCount = albumCounts.TryGetValue((int)genre.GenreId, out count) ? count.Count : 0
+                });
+            }
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.Genres = new SubsonicGenres { Genre = genres };
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        public static void GetVideos(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            IList<Video> videos = Injection.Get<IVideoRepository>().AllVideos();
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.Videos = new SubsonicVideos { Video = videos.Select(SubsonicMapper.ChildFromVideo).ToList() };
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        public static void GetLyrics(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            string artist = req.Get("artist");
+            string title = req.Get("title");
+
+            SubsonicLyrics lyrics = new SubsonicLyrics { Artist = artist, Title = title };
+
+            if (!String.IsNullOrEmpty(title)) {
+                IList<Song> matches = Injection.Get<ISongRepository>().SearchSongs("SongName", title);
+                Song match = matches.FirstOrDefault(s =>
+                    s.Lyrics != null
+                    && (String.IsNullOrEmpty(artist)
+                        || String.Equals(s.ArtistName, artist, StringComparison.OrdinalIgnoreCase)
+                        || String.Equals(s.AlbumArtistName, artist, StringComparison.OrdinalIgnoreCase)));
+                if (match != null) {
+                    lyrics.Artist = match.ArtistName ?? match.AlbumArtistName;
+                    lyrics.Title = match.SongName;
+                    lyrics.Value = match.Lyrics;
+                }
+            }
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.Lyrics = lyrics;
+            SubsonicWriter.Write(req, processor, body);
+        }
+    }
+}
diff --git a/WaveBox.Server/src/Subsonic/Handlers/SubsonicListHandlers.cs b/WaveBox.Server/src/Subsonic/Handlers/SubsonicListHandlers.cs
new file mode 100644
index 0000000..c9ccb13
--- /dev/null
+++ b/WaveBox.Server/src/Subsonic/Handlers/SubsonicListHandlers.cs
@@ -0,0 +1,378 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using WaveBox.Api;
+using WaveBox.Core;
+using WaveBox.Core.ApiResponse.Subsonic;
+using WaveBox.Core.Extensions;
+using WaveBox.Core.Model;
+using WaveBox.Core.Model.Repository;
+using WaveBox.Service;
+using WaveBox.Service.Services;
+
+namespace WaveBox.Subsonic.Handlers {
+    public static class SubsonicListHandlers {
+        private const int MaxListSize = 500;
+
+        // Folder-flavored list: entries carry the id of the folder holding each album's songs,
+        // so folder-mode clients browse the real directory tree (getAlbumList2 is the tag flavor)
+        public static void GetAlbumList(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            IList<Album> albums = AlbumsForListType(req, user, out SubsonicError error);
+            if (error != null) {
+                SubsonicWriter.WriteError(req, processor, error.Code, error.Message);
+                return;
+            }
+
+            IDictionary<int, int> folderByAlbum = SubsonicMapper.ToFolderLookup(Injection.Get<IAlbumRepository>().FoldersByAlbum());
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.AlbumList = new SubsonicAlbumList { Album = albums.Select(a => SubsonicMapper.ChildFromAlbumInFolder(a, folderByAlbum)).ToList() };
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        public static void GetAlbumList2(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            IList<Album> albums = AlbumsForListType(req, user, out SubsonicError error);
+            if (error != null) {
+                SubsonicWriter.WriteError(req, processor, error.Code, error.Message);
+                return;
+            }
+
+            IDictionary<int, GroupCount> songCounts = SubsonicMapper.ToLookup(Injection.Get<IAlbumRepository>().SongCountsByAlbum());
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.AlbumList2 = new SubsonicAlbumList2 { Album = albums.Select(a => SubsonicMapper.AlbumID3FromAlbum(a, songCounts)).ToList() };
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        private static IList<Album> AlbumsForListType(SubsonicRequest req, User user, out SubsonicError error) {
+            error = null;
+
+            string type = req.Get("type");
+            if (String.IsNullOrEmpty(type)) {
+                error = new SubsonicError { Code = SubsonicError.MissingParameter, Message = "Required parameter type is missing" };
+                return null;
+            }
+
+            int size = Math.Min(req.GetInt("size") ?? 10, MaxListSize);
+            int offset = req.GetInt("offset") ?? 0;
+            IAlbumRepository albumRepository = Injection.Get<IAlbumRepository>();
+
+            switch (type.ToLowerInvariant()) {
+            case "random":
+                return albumRepository.RandomAlbums(size);
+
+            case "newest":
+                return albumRepository.NewestAlbums(size, offset);
+
+            case "recent":
+                return albumRepository.RecentAlbums(size, offset);
+
+            case "frequent":
+                return albumRepository.FrequentAlbums(size, offset);
+
+            case "alphabeticalbyname":
+                return albumRepository.AllAlbums().Skip(offset).Take(size).ToList();
+
+            case "alphabeticalbyartist":
+                return albumRepository.AllAlbums()
+                       .OrderBy(a => a.AlbumArtistName ?? "", StringComparer.OrdinalIgnoreCase)
+                       .ThenBy(a => a.AlbumName ?? "", StringComparer.OrdinalIgnoreCase)
+                       .Skip(offset).Take(size).ToList();
+
+            case "byyear": {
+                int? fromYear = req.GetInt("fromYear");
+                int? toYear = req.GetInt("toYear");
+                if (fromYear == null || toYear == null) {
+                    error = new SubsonicError { Code = SubsonicError.MissingParameter, Message = "Required parameters fromYear and toYear are missing" };
+                    return null;
+                }
+                bool descending = fromYear > toYear;
+                int low = Math.Min((int)fromYear, (int)toYear);
+                int high = Math.Max((int)fromYear, (int)toYear);
+                IEnumerable<Album> byYear = albumRepository.AllAlbums().Where(a => a.ReleaseYear != null && a.ReleaseYear >= low && a.ReleaseYear <= high);
+                byYear = descending ? byYear.OrderByDescending(a => a.ReleaseYear) : byYear.OrderBy(a => a.ReleaseYear);
+                return byYear.Skip(offset).Take(size).ToList();
+            }
+
+            case "bygenre": {
+                string genreName = req.Get("genre");
+                if (String.IsNullOrEmpty(genreName)) {
+                    error = new SubsonicError { Code = SubsonicError.MissingParameter, Message = "Required parameter genre is missing" };
+                    return null;
+                }
+                Genre genre = Injection.Get<IGenreRepository>().GenreForName(genreName);
+                if (genre == null || genre.GenreId == null) {
+                    return new List<Album>();
+                }
+                return Injection.Get<IGenreRepository>().ListOfAlbums((int)genre.GenreId).Skip(offset).Take(size).ToList();
+            }
+
+            case "starred":
+                return StarredItems(user).Albums.Skip(offset).Take(size).ToList();
+
+            case "highest":
+                // Ratings don't exist in WaveBox; an empty list keeps client home screens happy
+                return new List<Album>();
+
+            default:
+                error = new SubsonicError { Code = SubsonicError.Generic, Message = "Unsupported album list type: " + type };
+                return null;
+            }
+        }
+
+        public static void GetRandomSongs(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            int size = Math.Min(req.GetInt("size") ?? 10, MaxListSize);
+            string genreName = req.Get("genre");
+            int? fromYear = req.GetInt("fromYear");
+            int? toYear = req.GetInt("toYear");
+
+            IEnumerable<Song> songs;
+            if (!String.IsNullOrEmpty(genreName)) {
+                Genre genre = Injection.Get<IGenreRepository>().GenreForName(genreName);
+                songs = genre == null || genre.GenreId == null
+                        ? new List<Song>()
+                        : Injection.Get<IGenreRepository>().ListOfSongs((int)genre.GenreId);
+            } else {
+                songs = Injection.Get<ISongRepository>().AllSongs();
+            }
+
+            if (fromYear != null) {
+                songs = songs.Where(s => s.ReleaseYear != null && s.ReleaseYear >= fromYear);
+            }
+            if (toYear != null) {
+                songs = songs.Where(s => s.ReleaseYear != null && s.ReleaseYear <= toYear);
+            }
+
+            List<Song> pool = songs.ToList();
+            List<SubsonicChild> picked = new List<SubsonicChild>();
+            Random random = Random.Shared;
+            while (picked.Count < size && pool.Count > 0) {
+                int index = random.Next(pool.Count);
+                picked.Add(SubsonicMapper.ChildFromSong(pool[index]));
+                pool.RemoveAt(index);
+            }
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.RandomSongs = new SubsonicSongs { Song = picked };
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        public static void GetSongsByGenre(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            string genreName = req.Get("genre");
+            if (String.IsNullOrEmpty(genreName)) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.MissingParameter, "Required parameter genre is missing");
+                return;
+            }
+
+            int count = Math.Min(req.GetInt("count") ?? 10, MaxListSize);
+            int offset = req.GetInt("offset") ?? 0;
+
+            List<SubsonicChild> songs = new List<SubsonicChild>();
+            Genre genre = Injection.Get<IGenreRepository>().GenreForName(genreName);
+            if (genre != null && genre.GenreId != null) {
+                songs = Injection.Get<IGenreRepository>().ListOfSongs((int)genre.GenreId)
+                        .Skip(offset).Take(count)
+                        .Select(SubsonicMapper.ChildFromSong).ToList();
+            }
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.SongsByGenre = new SubsonicSongs { Song = songs };
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        public static void GetNowPlaying(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            List<SubsonicNowPlayingEntry> entries = new List<SubsonicNowPlayingEntry>();
+
+            NowPlayingService nowPlayingService = (NowPlayingService)ServiceManager.GetInstance("nowplaying");
+            if (nowPlayingService != null) {
+                long now = DateTime.UtcNow.ToUnixTime();
+                foreach (NowPlaying nowPlaying in nowPlayingService.Playing.ToList()) {
+                    SubsonicChild child = SubsonicMapper.ChildFromMediaItem(nowPlaying.MediaItem);
+                    if (child == null) {
+                        continue;
+                    }
+
+                    SubsonicNowPlayingEntry entry = new SubsonicNowPlayingEntry();
+                    CopyChild(child, entry);
+                    entry.Username = nowPlaying.User != null ? nowPlaying.User.UserName : null;
+                    entry.PlayerName = nowPlaying.User != null && nowPlaying.User.CurrentSession != null ? nowPlaying.User.CurrentSession.ClientName : null;
+                    entry.MinutesAgo = nowPlaying.StartTime != null ? (int)Math.Max(0, (now - (long)nowPlaying.StartTime) / 60) : (int?)null;
+                    entries.Add(entry);
+                }
+            }
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.NowPlaying = new SubsonicNowPlaying { Entry = entries };
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        // Folder flavor: starred folders appear directly, and tag-starred albums are mapped to
+        // the folders holding their songs (getStarred2 is the tag flavor and ignores folders)
+        public static void GetStarred(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            StarredCollections starred = StarredItems(user);
+            IDictionary<int, int> folderByAlbum = SubsonicMapper.ToFolderLookup(Injection.Get<IAlbumRepository>().FoldersByAlbum());
+
+            List<SubsonicIndexArtist> artists = new List<SubsonicIndexArtist>(starred.FolderArtists);
+            artists.AddRange(starred.Artists.Select(a => new SubsonicIndexArtist { Id = a.Id, Name = a.Name, Starred = a.Starred }));
+
+            List<SubsonicChild> albums = new List<SubsonicChild>(starred.FolderAlbums);
+            albums.AddRange(starred.Albums.Select(a => WithStarred(SubsonicMapper.ChildFromAlbumInFolder(a, folderByAlbum), starred.StarredDate(a.AlbumId))));
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.Starred = new SubsonicStarred {
+                Artist = artists,
+                Album = albums,
+                Song = starred.Songs
+            };
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        public static void GetStarred2(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            StarredCollections starred = StarredItems(user);
+            IDictionary<int, GroupCount> songCounts = SubsonicMapper.ToLookup(Injection.Get<IAlbumRepository>().SongCountsByAlbum());
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.Starred2 = new SubsonicStarred2 {
+                Artist = starred.Artists,
+                Album = starred.Albums.Select(a => {
+                    SubsonicAlbumID3 dto = SubsonicMapper.AlbumID3FromAlbum(a, songCounts);
+                    dto.Starred = starred.StarredDate(a.AlbumId);
+                    return dto;
+                }).ToList(),
+                Song = starred.Songs
+            };
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        // Shared partitioning of a user's favorites into Subsonic starred buckets
+        internal class StarredCollections {
+            public List<SubsonicArtistID3> Artists = new List<SubsonicArtistID3>();
+            public List<Album> Albums = new List<Album>();
+            public List<SubsonicChild> Songs = new List<SubsonicChild>();
+            // Starred folders, only surfaced by the folder-flavored getStarred
+            public List<SubsonicIndexArtist> FolderArtists = new List<SubsonicIndexArtist>();
+            public List<SubsonicChild> FolderAlbums = new List<SubsonicChild>();
+            public Dictionary<int, string> StarredDates = new Dictionary<int, string>();
+
+            public string StarredDate(int? itemId) {
+                string date;
+                return itemId != null && this.StarredDates.TryGetValue((int)itemId, out date) ? date : null;
+            }
+        }
+
+        internal static StarredCollections StarredItems(User user) {
+            StarredCollections result = new StarredCollections();
+            if (user.UserId == null) {
+                return result;
+            }
+
+            HashSet<int> mediaRootIds = new HashSet<int>(
+                Injection.Get<IFolderRepository>().MediaFolders()
+                .Where(f => f.FolderId != null)
+                .Select(f => (int)f.FolderId));
+
+            foreach (Favorite favorite in Injection.Get<IFavoriteRepository>().FavoritesForUserId((int)user.UserId)) {
+                if (favorite.FavoriteItemId == null || favorite.FavoriteItemType == null) {
+                    continue;
+                }
+
+                int itemId = (int)favorite.FavoriteItemId;
+                string starredDate = SubsonicMapper.Iso8601(favorite.TimeStamp ?? DateTime.UtcNow.ToUnixTime());
+                result.StarredDates[itemId] = starredDate;
+
+                switch (favorite.FavoriteItemType) {
+                case ItemType.Song: {
+                    Song song = Injection.Get<ISongRepository>().SongForId(itemId);
+                    if (song != null && song.ItemId != null) {
+                        result.Songs.Add(WithStarred(SubsonicMapper.ChildFromSong(song), starredDate));
+                    }
+                    break;
+                }
+                case ItemType.Video: {
+                    Video video = Injection.Get<IVideoRepository>().VideoForId(itemId);
+                    if (video != null && video.ItemId != null) {
+                        result.Songs.Add(WithStarred(SubsonicMapper.ChildFromVideo(video), starredDate));
+                    }
+                    break;
+                }
+                case ItemType.Album: {
+                    Album album = Injection.Get<IAlbumRepository>().AlbumForId(itemId);
+                    if (album != null && album.AlbumId != null) {
+                        result.Albums.Add(album);
+                    }
+                    break;
+                }
+                case ItemType.AlbumArtist: {
+                    AlbumArtist albumArtist = Injection.Get<IAlbumArtistRepository>().AlbumArtistForId(itemId);
+                    if (albumArtist != null && albumArtist.AlbumArtistId != null) {
+                        SubsonicArtistID3 dto = SubsonicMapper.ArtistID3FromAlbumArtist(albumArtist, null, false);
+                        dto.Starred = starredDate;
+                        result.Artists.Add(dto);
+                    }
+                    break;
+                }
+                case ItemType.Artist: {
+                    Artist artist = Injection.Get<IArtistRepository>().ArtistForId(itemId);
+                    if (artist != null && artist.ArtistId != null) {
+                        result.Artists.Add(new SubsonicArtistID3 {
+                            Id = artist.ArtistId.ToString(),
+                            Name = artist.ArtistName,
+                            Starred = starredDate
+                        });
+                    }
+                    break;
+                }
+                case ItemType.Folder: {
+                    Folder folder = Injection.Get<IFolderRepository>().FolderForId(itemId);
+                    if (folder != null && folder.FolderId != null) {
+                        // Children of a media root read as "artists", deeper folders as "albums"
+                        if (folder.ParentFolderId != null && mediaRootIds.Contains((int)folder.ParentFolderId)) {
+                            result.FolderArtists.Add(new SubsonicIndexArtist {
+                                Id = folder.FolderId.ToString(),
+                                Name = folder.FolderName,
+                                Starred = starredDate
+                            });
+                        } else {
+                            result.FolderAlbums.Add(WithStarred(SubsonicMapper.ChildFromFolder(folder), starredDate));
+                        }
+                    }
+                    break;
+                }
+                }
+            }
+
+            return result;
+        }
+
+        internal static SubsonicChild WithStarred(SubsonicChild child, string starredDate) {
+            child.Starred = starredDate;
+            return child;
+        }
+
+        internal static void CopyChild(SubsonicChild from, SubsonicChild to) {
+            to.Id = from.Id;
+            to.Parent = from.Parent;
+            to.IsDir = from.IsDir;
+            to.Title = from.Title;
+            to.Album = from.Album;
+            to.Artist = from.Artist;
+            to.Track = from.Track;
+            to.Year = from.Year;
+            to.Genre = from.Genre;
+            to.CoverArt = from.CoverArt;
+            to.Size = from.Size;
+            to.ContentType = from.ContentType;
+            to.Suffix = from.Suffix;
+            to.Duration = from.Duration;
+            to.BitRate = from.BitRate;
+            to.Path = from.Path;
+            to.IsVideo = from.IsVideo;
+            to.DiscNumber = from.DiscNumber;
+            to.Created = from.Created;
+            to.Starred = from.Starred;
+            to.AlbumId = from.AlbumId;
+            to.ArtistId = from.ArtistId;
+            to.Type = from.Type;
+        }
+    }
+}
diff --git a/WaveBox.Server/src/Subsonic/Handlers/SubsonicMediaHandlers.cs b/WaveBox.Server/src/Subsonic/Handlers/SubsonicMediaHandlers.cs
new file mode 100644
index 0000000..e661713
--- /dev/null
+++ b/WaveBox.Server/src/Subsonic/Handlers/SubsonicMediaHandlers.cs
@@ -0,0 +1,163 @@
+using System;
+using System.IO;
+using WaveBox.Api;
+using WaveBox.ApiHandler;
+using WaveBox.Core;
+using WaveBox.Core.ApiResponse.Subsonic;
+using WaveBox.Core.Extensions;
+using WaveBox.Core.Model;
+using WaveBox.Core.Model.Repository;
+using WaveBox.Server.Extensions;
+using WaveBox.Service;
+using WaveBox.Service.Services;
+using WaveBox.Service.Services.Http;
+using WaveBox.Transcoding;
+
+namespace WaveBox.Subsonic.Handlers {
+    public static class SubsonicMediaHandlers {
+        private static readonly WaveBox.Core.Logging.ILog logger = WaveBox.Core.Logging.LogManager.GetLogger(typeof(SubsonicMediaHandlers));
+
+        public static void GetCoverArt(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            int? id = req.GetInt("id");
+            if (id == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.NotFound, "Cover art not found");
+                return;
+            }
+
+            Art art = Injection.Get<IArtRepository>().ArtForId((int)id);
+            Stream stream = ArtStream.CreateStream(art);
+            if ((object)stream == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.NotFound, "Cover art not found");
+                return;
+            }
+
+            int? size = req.GetInt("size");
+            if (size != null && size > 0) {
+                try {
+                    Stream resized = ArtStream.ResizeImage(stream, (int)size, 0);
+                    stream.Close();
+                    stream = resized;
+                } catch (Exception e) {
+                    logger.Error("Error resizing cover art, returning original: ", e);
+                    stream.Position = 0;
+                }
+            }
+
+            DateTime? lastModified = null;
+            if (!ReferenceEquals(art.LastModified, null)) {
+                lastModified = ((long)art.LastModified).ToDateTime();
+            }
+            processor.WriteFile(stream, 0, stream.Length, "image/jpeg", null, true, lastModified);
+            stream.Close();
+        }
+
+        public static void Stream(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            StreamOrDownload(req, processor, allowTranscode: true);
+        }
+
+        public static void Download(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            StreamOrDownload(req, processor, allowTranscode: false);
+        }
+
+        private static void StreamOrDownload(SubsonicRequest req, HttpContextProcessor processor, bool allowTranscode) {
+            int? id = req.GetInt("id");
+            if (id == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.MissingParameter, "Required parameter id is missing");
+                return;
+            }
+
+            IMediaItem item = null;
+            ItemType itemType = Injection.Get<IItemRepository>().ItemTypeForItemId((int)id);
+            if (itemType == ItemType.Song) {
+                item = Injection.Get<ISongRepository>().SongForId((int)id);
+            } else if (itemType == ItemType.Video) {
+                item = Injection.Get<IVideoRepository>().VideoForId((int)id);
+            }
+
+            if (item == null || item.ItemId == null || !File.Exists(item.FilePath())) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.NotFound, "Media not found");
+                return;
+            }
+
+            string format = req.Get("format");
+            int maxBitRate = req.GetInt("maxBitRate") ?? 0;
+
+            if (allowTranscode && itemType == ItemType.Song && !"raw".Equals(format, StringComparison.OrdinalIgnoreCase)) {
+                string nativeSuffix = Path.GetExtension(item.FileName ?? "").TrimStart('.').ToLowerInvariant();
+                bool wantsFormat = !String.IsNullOrEmpty(format) && !format.Equals(nativeSuffix, StringComparison.OrdinalIgnoreCase);
+                bool overBitrate = maxBitRate > 0 && (item.Bitrate == null || item.Bitrate > maxBitRate);
+
+                if (wantsFormat || overBitrate) {
+                    TranscodeSong(req, processor, item, format, maxBitRate);
+                    return;
+                }
+            }
+
+            SendDirect(req, processor, item);
+        }
+
+        // Direct byte-for-byte file streaming with Range support (same semantics as /api/stream)
+        private static void SendDirect(SubsonicRequest req, HttpContextProcessor processor, IMediaItem item) {
+            try {
+                System.IO.Stream stream = item.File();
+                long length = stream.Length;
+                int startOffset = 0;
+                long? limitToSize = null;
+
+                if (processor.HttpHeaders.ContainsKey("Range")) {
+                    string range = (string)processor.HttpHeaders["Range"];
+                    var split = range.Split(new char[] { '-', '=' });
+                    string start = split[1];
+                    string end = split.Length > 2 ? split[2] : null;
+
+                    logger.IfInfo("Range header: " + range + "  Resuming from " + start);
+                    startOffset = Convert.ToInt32(start);
+                    if (!ReferenceEquals(end, null) && end != String.Empty) {
+                        limitToSize = (Convert.ToInt64(end) + 1) - startOffset;
+                    }
+                }
+
+                processor.WriteFile(stream, startOffset, length, item.FileType.MimeType(), null, true, new FileInfo(item.FilePath()).LastWriteTimeUtc, limitToSize);
+                stream.Close();
+            } catch (Exception e) {
+                logger.Error(e);
+            }
+        }
+
+        private static void TranscodeSong(SubsonicRequest req, HttpContextProcessor processor, IMediaItem item, string format, int maxBitRate) {
+            TranscodeService transcodeService = (TranscodeService)ServiceManager.GetInstance("transcode");
+            if ((object)transcodeService == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.Generic, "Transcoding is not available");
+                return;
+            }
+
+            TranscodeType transType = TranscodeTypeForFormat(format);
+
+            // A quality value above the TranscodeQuality enum range is treated as raw kbps
+            uint quality = maxBitRate > 0 ? (uint)maxBitRate : 192;
+
+            logger.IfInfo("Subsonic transcode: " + item.FileName + " -> " + transType + " @ " + quality);
+
+            ITranscoder transcoder = transcodeService.TranscodeSong(item, transType, quality, false, 0, (uint)(item.Duration ?? 0));
+            bool estimateContentLength = req.GetBool("estimateContentLength", false);
+
+            TranscodeStreamer.Send(transcodeService, transcoder, processor, 0, null, estimateContentLength);
+        }
+
+        private static TranscodeType TranscodeTypeForFormat(string format) {
+            switch ((format ?? "mp3").ToLowerInvariant()) {
+            case "aac":
+            case "m4a":
+            case "mp4":
+                return TranscodeType.AAC;
+            case "ogg":
+            case "oga":
+                return TranscodeType.OGG;
+            case "opus":
+                return TranscodeType.OPUS;
+            default:
+                return TranscodeType.MP3;
+            }
+        }
+    }
+}
diff --git a/WaveBox.Server/src/Subsonic/Handlers/SubsonicPlaylistHandlers.cs b/WaveBox.Server/src/Subsonic/Handlers/SubsonicPlaylistHandlers.cs
new file mode 100644
index 0000000..d1abc84
--- /dev/null
+++ b/WaveBox.Server/src/Subsonic/Handlers/SubsonicPlaylistHandlers.cs
@@ -0,0 +1,141 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using WaveBox.Api;
+using WaveBox.Core;
+using WaveBox.Core.ApiResponse.Subsonic;
+using WaveBox.Core.Model;
+using WaveBox.Core.Model.Repository;
+
+namespace WaveBox.Subsonic.Handlers {
+    public static class SubsonicPlaylistHandlers {
+        public static void GetPlaylists(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            List<SubsonicPlaylist> playlists = Injection.Get<IPlaylistRepository>().AllPlaylists()
+                    .Where(p => p.PlaylistId != null)
+                    .Select(p => SubsonicMapper.PlaylistFromPlaylist(p, user.UserName))
+                    .ToList();
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.Playlists = new SubsonicPlaylists { Playlist = playlists };
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        public static void GetPlaylist(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            int? id = req.GetInt("id");
+            if (id == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.MissingParameter, "Required parameter id is missing");
+                return;
+            }
+
+            Playlist playlist = Injection.Get<IPlaylistRepository>().PlaylistForId((int)id);
+            if (playlist == null || playlist.PlaylistId == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.NotFound, "Playlist not found");
+                return;
+            }
+
+            WritePlaylistWithSongs(req, processor, user, playlist);
+        }
+
+        public static void CreatePlaylist(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            int? playlistId = req.GetInt("playlistId");
+            string name = req.Get("name");
+            IList<int> songIds = req.GetIntList("songId");
+
+            IPlaylistRepository playlistRepository = Injection.Get<IPlaylistRepository>();
+            Playlist playlist;
+
+            if (playlistId != null) {
+                // Updating an existing playlist: spec semantics are full replacement
+                playlist = playlistRepository.PlaylistForId((int)playlistId);
+                if (playlist == null || playlist.PlaylistId == null) {
+                    SubsonicWriter.WriteError(req, processor, SubsonicError.NotFound, "Playlist not found");
+                    return;
+                }
+                playlist.ClearPlaylist();
+            } else if (!String.IsNullOrEmpty(name)) {
+                Playlist existing = playlistRepository.PlaylistForName(name);
+                if (existing != null && existing.PlaylistId != null) {
+                    SubsonicWriter.WriteError(req, processor, SubsonicError.Generic, "A playlist named " + name + " already exists");
+                    return;
+                }
+                playlist = new Playlist { PlaylistName = name };
+                playlist.CreatePlaylist();
+            } else {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.MissingParameter, "Required parameter name or playlistId is missing");
+                return;
+            }
+
+            if (songIds.Count > 0) {
+                playlist.AddMediaItems(songIds.ToList());
+            }
+
+            // Re-read so counts/duration reflect the mutation
+            playlist = playlistRepository.PlaylistForId((int)playlist.PlaylistId);
+            WritePlaylistWithSongs(req, processor, user, playlist);
+        }
+
+        public static void UpdatePlaylist(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            int? playlistId = req.GetInt("playlistId");
+            if (playlistId == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.MissingParameter, "Required parameter playlistId is missing");
+                return;
+            }
+
+            Playlist playlist = Injection.Get<IPlaylistRepository>().PlaylistForId((int)playlistId);
+            if (playlist == null || playlist.PlaylistId == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.NotFound, "Playlist not found");
+                return;
+            }
+
+            string name = req.Get("name");
+            if (!String.IsNullOrEmpty(name)) {
+                playlist.PlaylistName = name;
+                playlist.UpdateDatabase();
+            }
+
+            // Remove before add, positions are 0-based (matches WaveBox ItemPosition);
+            // RemoveMediaItemAtIndexes re-packs positions itself
+            IList<int> removeIndexes = req.GetIntList("songIndexToRemove");
+            if (removeIndexes.Count > 0) {
+                playlist.RemoveMediaItemAtIndexes(removeIndexes.ToList());
+            }
+
+            IList<int> addIds = req.GetIntList("songIdToAdd");
+            if (addIds.Count > 0) {
+                playlist.AddMediaItems(addIds.ToList());
+            }
+
+            SubsonicWriter.Write(req, processor, SubsonicWriter.Body());
+        }
+
+        public static void DeletePlaylist(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            int? id = req.GetInt("id");
+            if (id == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.MissingParameter, "Required parameter id is missing");
+                return;
+            }
+
+            Playlist playlist = Injection.Get<IPlaylistRepository>().PlaylistForId((int)id);
+            if (playlist == null || playlist.PlaylistId == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.NotFound, "Playlist not found");
+                return;
+            }
+
+            playlist.DeletePlaylist();
+            SubsonicWriter.Write(req, processor, SubsonicWriter.Body());
+        }
+
+        private static void WritePlaylistWithSongs(SubsonicRequest req, HttpContextProcessor processor, User user, Playlist playlist) {
+            SubsonicPlaylistWithSongs dto = new SubsonicPlaylistWithSongs();
+            SubsonicMapper.FillPlaylist(dto, playlist, user.UserName);
+            dto.Entry = playlist.ListOfMediaItems()
+                        .Select(SubsonicMapper.ChildFromMediaItem)
+                        .Where(c => c != null)
+                        .ToList();
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.Playlist = dto;
+            SubsonicWriter.Write(req, processor, body);
+        }
+    }
+}
diff --git a/WaveBox.Server/src/Subsonic/Handlers/SubsonicSearchHandlers.cs b/WaveBox.Server/src/Subsonic/Handlers/SubsonicSearchHandlers.cs
new file mode 100644
index 0000000..1a6af16
--- /dev/null
+++ b/WaveBox.Server/src/Subsonic/Handlers/SubsonicSearchHandlers.cs
@@ -0,0 +1,127 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using WaveBox.Api;
+using WaveBox.Core;
+using WaveBox.Core.ApiResponse.Subsonic;
+using WaveBox.Core.Model;
+using WaveBox.Core.Model.Repository;
+
+namespace WaveBox.Subsonic.Handlers {
+    public static class SubsonicSearchHandlers {
+        // Folder flavor: artist/album hits come from the folder tree by folder name — children
+        // of a media root read as "artists", deeper folders as "albums" (search3 is the tag flavor)
+        public static void Search2(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            string query = CleanQuery(req.Get("query"));
+            if (query == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.MissingParameter, "Required parameter query is missing");
+                return;
+            }
+
+            int artistCount = req.GetInt("artistCount") ?? 20;
+            int artistOffset = req.GetInt("artistOffset") ?? 0;
+            int albumCount = req.GetInt("albumCount") ?? 20;
+            int albumOffset = req.GetInt("albumOffset") ?? 0;
+            int songCount = req.GetInt("songCount") ?? 20;
+            int songOffset = req.GetInt("songOffset") ?? 0;
+
+            IFolderRepository folderRepository = Injection.Get<IFolderRepository>();
+            HashSet<int> mediaRootIds = new HashSet<int>(
+                folderRepository.MediaFolders()
+                .Where(f => f.FolderId != null)
+                .Select(f => (int)f.FolderId));
+
+            IList<Folder> folderHits;
+            IList<Song> songs;
+            if (query.Length == 0) {
+                folderHits = folderRepository.SearchFolders("");
+                songs = Injection.Get<ISongRepository>().AllSongs();
+            } else {
+                folderHits = folderRepository.SearchFolders(query);
+                songs = Injection.Get<ISongRepository>().SearchSongs("SongName", query, false);
+            }
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.SearchResult2 = new SubsonicSearchResult2 {
+                Artist = folderHits
+                    .Where(f => f.ParentFolderId != null && mediaRootIds.Contains((int)f.ParentFolderId))
+                    .Skip(artistOffset).Take(artistCount)
+                    .Select(f => new SubsonicIndexArtist { Id = f.FolderId.ToString(), Name = f.FolderName })
+                    .ToList(),
+                Album = folderHits
+                    .Where(f => f.ParentFolderId == null || !mediaRootIds.Contains((int)f.ParentFolderId))
+                    .Skip(albumOffset).Take(albumCount)
+                    .Select(SubsonicMapper.ChildFromFolder)
+                    .ToList(),
+                Song = songs.Skip(songOffset).Take(songCount).Select(SubsonicMapper.ChildFromSong).ToList()
+            };
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        public static void Search3(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            SearchResults results = RunSearch(req, out SubsonicError error);
+            if (error != null) {
+                SubsonicWriter.WriteError(req, processor, error.Code, error.Message);
+                return;
+            }
+
+            IDictionary<int, GroupCount> songCounts = SubsonicMapper.ToLookup(Injection.Get<IAlbumRepository>().SongCountsByAlbum());
+            IDictionary<int, GroupCount> albumCounts = SubsonicMapper.ToLookup(Injection.Get<IAlbumRepository>().AlbumCountsByAlbumArtist());
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.SearchResult3 = new SubsonicSearchResult3 {
+                Artist = results.Artists.Select(a => {
+                    GroupCount count;
+                    int? albumCount = a.AlbumArtistId != null && albumCounts.TryGetValue((int)a.AlbumArtistId, out count) ? count.Count : (int?)0;
+                    return SubsonicMapper.ArtistID3FromAlbumArtist(a, albumCount, false);
+                }).ToList(),
+                Album = results.Albums.Select(a => SubsonicMapper.AlbumID3FromAlbum(a, songCounts)).ToList(),
+                Song = results.Songs.Select(SubsonicMapper.ChildFromSong).ToList()
+            };
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        private class SearchResults {
+            public IList<AlbumArtist> Artists;
+            public IList<Album> Albums;
+            public IList<Song> Songs;
+        }
+
+        // Clients commonly send `foo*` or a quoted query; the repositories do substring LIKE matching
+        private static string CleanQuery(string query) {
+            return query == null ? null : query.Trim().Trim('"').TrimEnd('*');
+        }
+
+        private static SearchResults RunSearch(SubsonicRequest req, out SubsonicError error) {
+            error = null;
+
+            string query = CleanQuery(req.Get("query"));
+            if (query == null) {
+                error = new SubsonicError { Code = SubsonicError.MissingParameter, Message = "Required parameter query is missing" };
+                return null;
+            }
+
+            int artistCount = req.GetInt("artistCount") ?? 20;
+            int artistOffset = req.GetInt("artistOffset") ?? 0;
+            int albumCount = req.GetInt("albumCount") ?? 20;
+            int albumOffset = req.GetInt("albumOffset") ?? 0;
+            int songCount = req.GetInt("songCount") ?? 20;
+            int songOffset = req.GetInt("songOffset") ?? 0;
+
+            SearchResults results = new SearchResults();
+
+            if (query.Length == 0) {
+                // OpenSubsonic convention: an empty query returns the whole library (offline sync)
+                results.Artists = Injection.Get<IAlbumArtistRepository>().AllAlbumArtists().Skip(artistOffset).Take(artistCount).ToList();
+                results.Albums = Injection.Get<IAlbumRepository>().AllAlbums().Skip(albumOffset).Take(albumCount).ToList();
+                results.Songs = Injection.Get<ISongRepository>().AllSongs().Skip(songOffset).Take(songCount).ToList();
+            } else {
+                results.Artists = Injection.Get<IAlbumArtistRepository>().SearchAlbumArtists("AlbumArtistName", query, false).Skip(artistOffset).Take(artistCount).ToList();
+                results.Albums = Injection.Get<IAlbumRepository>().SearchAlbums("AlbumName", query, false).Skip(albumOffset).Take(albumCount).ToList();
+                results.Songs = Injection.Get<ISongRepository>().SearchSongs("SongName", query, false).Skip(songOffset).Take(songCount).ToList();
+            }
+
+            return results;
+        }
+    }
+}
diff --git a/WaveBox.Server/src/Subsonic/Handlers/SubsonicSystemHandlers.cs b/WaveBox.Server/src/Subsonic/Handlers/SubsonicSystemHandlers.cs
new file mode 100644
index 0000000..82eb4cc
--- /dev/null
+++ b/WaveBox.Server/src/Subsonic/Handlers/SubsonicSystemHandlers.cs
@@ -0,0 +1,69 @@
+using System;
+using System.Collections.Generic;
+using WaveBox.Api;
+using WaveBox.Core;
+using WaveBox.Core.ApiResponse.Subsonic;
+using WaveBox.Core.Model;
+using WaveBox.Core.Model.Repository;
+
+namespace WaveBox.Subsonic.Handlers {
+    public static class SubsonicSystemHandlers {
+        public static void Ping(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            SubsonicWriter.Write(req, processor, SubsonicWriter.Body());
+        }
+
+        public static void GetLicense(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            // WaveBox is free software; report a perpetually valid license
+            body.License = new SubsonicLicense {
+                Valid = true,
+                LicenseExpires = "2099-12-31T23:59:59Z"
+            };
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        public static void GetOpenSubsonicExtensions(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.OpenSubsonicExtensions = new List<SubsonicExtension> {
+                new SubsonicExtension { Name = "apiKeyAuthentication", Versions = new List<int> { 1 } },
+                new SubsonicExtension { Name = "formPost", Versions = new List<int> { 1 } }
+            };
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        public static void TokenInfo(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            // Only meaningful for API key auth: reports which user the key belongs to
+            if (req.Get("apiKey") == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.Generic, "tokenInfo requires API key authentication");
+                return;
+            }
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.TokenInfo = new SubsonicTokenInfo { Username = user.UserName };
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        public static void GetScanStatus(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.ScanStatus = new SubsonicScanStatus {
+                Scanning = false,
+                Count = Injection.Get<ISongRepository>().CountSongs()
+            };
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        // WaveBox has no last.fm-style artist metadata; an empty artistInfo is valid per the
+        // schema (all fields optional) and keeps clients that poll this endpoint happy
+        public static void GetArtistInfo(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.ArtistInfo = new SubsonicArtistInfo();
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        public static void GetArtistInfo2(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.ArtistInfo2 = new SubsonicArtistInfo();
+            SubsonicWriter.Write(req, processor, body);
+        }
+    }
+}
diff --git a/WaveBox.Server/src/Subsonic/Handlers/SubsonicUserHandlers.cs b/WaveBox.Server/src/Subsonic/Handlers/SubsonicUserHandlers.cs
new file mode 100644
index 0000000..2ddc651
--- /dev/null
+++ b/WaveBox.Server/src/Subsonic/Handlers/SubsonicUserHandlers.cs
@@ -0,0 +1,165 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using WaveBox.Api;
+using WaveBox.Core;
+using WaveBox.Core.ApiResponse.Subsonic;
+using WaveBox.Core.Model;
+using WaveBox.Core.Model.Repository;
+
+namespace WaveBox.Subsonic.Handlers {
+    public static class SubsonicUserHandlers {
+        public static void GetUser(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            string username = req.Get("username") ?? user.UserName;
+
+            // Non-admins may only view themselves
+            if (!user.HasPermission(Role.Admin) && !String.Equals(username, user.UserName, StringComparison.OrdinalIgnoreCase)) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.NotAuthorized, user.UserName + " is not authorized to view other users");
+                return;
+            }
+
+            User target = Injection.Get<IUserRepository>().UserForName(username);
+            if (target == null || target.UserId == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.NotFound, "User not found");
+                return;
+            }
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.User = SubsonicMapper.UserFromUser(target, MediaFolderIds());
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        public static void GetUsers(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            IList<int> folderIds = MediaFolderIds();
+            List<SubsonicUser> users = Injection.Get<IUserRepository>().AllUsers()
+                    .Where(u => u.UserId != null)
+                    .Select(u => SubsonicMapper.UserFromUser(u, folderIds))
+                    .ToList();
+
+            SubsonicResponseBody body = SubsonicWriter.Body();
+            body.Users = new SubsonicUsers { User = users };
+            SubsonicWriter.Write(req, processor, body);
+        }
+
+        public static void ChangePassword(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            string username = req.Get("username");
+            string password = DecodePassword(req.Get("password"));
+            if (String.IsNullOrEmpty(username) || String.IsNullOrEmpty(password)) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.MissingParameter, "Required parameters username and password are missing");
+                return;
+            }
+
+            // Non-admins may only change their own password
+            if (!user.HasPermission(Role.Admin) && !String.Equals(username, user.UserName, StringComparison.OrdinalIgnoreCase)) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.NotAuthorized, user.UserName + " is not authorized to change other users' passwords");
+                return;
+            }
+
+            User target = Injection.Get<IUserRepository>().UserForName(username);
+            if (target == null || target.UserId == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.NotFound, "User not found");
+                return;
+            }
+
+            if (!target.UpdatePassword(password)) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.Generic, "Failed to change password");
+                return;
+            }
+
+            Injection.Get<SubsonicAuth>().Evict(target.UserName);
+            SubsonicWriter.Write(req, processor, SubsonicWriter.Body());
+        }
+
+        public static void CreateUser(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            string username = req.Get("username");
+            string password = DecodePassword(req.Get("password"));
+            if (String.IsNullOrEmpty(username) || String.IsNullOrEmpty(password)) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.MissingParameter, "Required parameters username and password are missing");
+                return;
+            }
+
+            Role role = req.GetBool("adminRole", false) ? Role.Admin : Role.User;
+            User created = Injection.Get<IUserRepository>().CreateUser(username, password, role, null);
+            if (created == null || created.UserId == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.Generic, "User " + username + " already exists");
+                return;
+            }
+
+            SubsonicWriter.Write(req, processor, SubsonicWriter.Body());
+        }
+
+        public static void UpdateUser(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            string username = req.Get("username");
+            if (String.IsNullOrEmpty(username)) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.MissingParameter, "Required parameter username is missing");
+                return;
+            }
+
+            User target = Injection.Get<IUserRepository>().UserForName(username);
+            if (target == null || target.UserId == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.NotFound, "User not found");
+                return;
+            }
+
+            string password = DecodePassword(req.Get("password"));
+            if (!String.IsNullOrEmpty(password) && !target.UpdatePassword(password)) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.Generic, "Failed to change password");
+                return;
+            }
+
+            string adminRole = req.Get("adminRole");
+            if (adminRole != null) {
+                Role role = req.GetBool("adminRole", false) ? Role.Admin : Role.User;
+                if (role != target.Role && !target.UpdateRole(role)) {
+                    SubsonicWriter.WriteError(req, processor, SubsonicError.Generic, "Failed to change role");
+                    return;
+                }
+            }
+
+            Injection.Get<SubsonicAuth>().Evict(target.UserName);
+            SubsonicWriter.Write(req, processor, SubsonicWriter.Body());
+        }
+
+        public static void DeleteUser(SubsonicRequest req, HttpContextProcessor processor, User user) {
+            string username = req.Get("username");
+            if (String.IsNullOrEmpty(username)) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.MissingParameter, "Required parameter username is missing");
+                return;
+            }
+
+            User target = Injection.Get<IUserRepository>().UserForName(username);
+            if (target == null || target.UserId == null) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.NotFound, "User not found");
+                return;
+            }
+
+            if (!target.Delete()) {
+                SubsonicWriter.WriteError(req, processor, SubsonicError.Generic, "Failed to delete user");
+                return;
+            }
+
+            Injection.Get<SubsonicAuth>().Evict(target.UserName);
+            SubsonicWriter.Write(req, processor, SubsonicWriter.Body());
+        }
+
+        private static IList<int> MediaFolderIds() {
+            return Injection.Get<IFolderRepository>().MediaFolders()
+                   .Where(f => f.FolderId != null)
+                   .Select(f => (int)f.FolderId)
+                   .ToList();
+        }
+
+        // Subsonic passwords may arrive hex-encoded as enc:HEX
+        private static string DecodePassword(string password) {
+            if (password != null && password.StartsWith("enc:", StringComparison.OrdinalIgnoreCase)) {
+                try {
+                    return Encoding.UTF8.GetString(Convert.FromHexString(password.Substring(4)));
+                } catch (FormatException) {
+                    return password;
+                }
+            }
+            return password;
+        }
+    }
+}
diff --git a/WaveBox.Server/src/Subsonic/SubsonicAuth.cs b/WaveBox.Server/src/Subsonic/SubsonicAuth.cs
new file mode 100644
index 0000000..f012dd6
--- /dev/null
+++ b/WaveBox.Server/src/Subsonic/SubsonicAuth.cs
@@ -0,0 +1,147 @@
+using System;
+using System.Collections.Concurrent;
+using System.Security.Cryptography;
+using System.Text;
+using WaveBox.Core;
+using WaveBox.Core.ApiResponse.Subsonic;
+using WaveBox.Core.Model;
+using WaveBox.Core.Model.Repository;
+
+namespace WaveBox.Subsonic {
+    // Stateless per-request Subsonic authentication.
+    //
+    // Supported mechanisms:
+    //   - apiKey=...            (OpenSubsonic apiKeyAuthentication extension)
+    //   - u=user&p=password     (plaintext or p=enc:HEX), verified against the PBKDF2 hash
+    // Classic token auth (t=md5(password+salt)) is impossible with hashed-only password
+    // storage and returns error 42 so clients fall back or surface a clear message.
+    //
+    // Because PBKDF2 verification is deliberately expensive and Subsonic clients send
+    // credentials on every request (including every seek within a stream), successful u/p
+    // verifications are cached for a sliding TTL keyed by a SHA256 of the presented password.
+    public class SubsonicAuth {
+        private class VerifiedAuth {
+            public byte[] PasswordSha256;
+            public DateTime Expires;
+        }
+
+        private static readonly TimeSpan CacheTtl = TimeSpan.FromMinutes(10);
+
+        private readonly ConcurrentDictionary<string, VerifiedAuth> verified = new ConcurrentDictionary<string, VerifiedAuth>(StringComparer.Ordinal);
+
+        // Returns the authenticated user (a per-request copy carrying a synthesized in-memory
+        // session), or null with a populated error
+        public User Authenticate(SubsonicRequest req, out SubsonicError error) {
+            error = null;
+
+            string apiKey = req.Get("apiKey");
+            string username = req.Get("u");
+            string password = req.Get("p");
+            string token = req.Get("t");
+            string salt = req.Get("s");
+
+            if (apiKey != null) {
+                if (username != null || password != null || token != null || salt != null) {
+                    error = new SubsonicError { Code = SubsonicError.ConflictingMechanisms, Message = "Multiple conflicting authentication mechanisms provided" };
+                    return null;
+                }
+
+                User keyUser = this.UserForApiKey(apiKey);
+                if (keyUser == null) {
+                    error = new SubsonicError { Code = SubsonicError.InvalidApiKey, Message = "Invalid API key" };
+                    return null;
+                }
+
+                return this.Authenticated(keyUser, req);
+            }
+
+            if (token != null || salt != null) {
+                error = new SubsonicError { Code = SubsonicError.MechanismNotSupported, Message = "Token authentication is not supported; use an API key or password authentication" };
+                return null;
+            }
+
+            if (username == null || password == null) {
+                error = new SubsonicError { Code = SubsonicError.MissingParameter, Message = "Required authentication parameter is missing" };
+                return null;
+            }
+
+            // Hex-encoded password variant: p=enc:48656c6c6f
+            if (password.StartsWith("enc:", StringComparison.OrdinalIgnoreCase)) {
+                try {
+                    password = Encoding.UTF8.GetString(Convert.FromHexString(password.Substring(4)));
+                } catch (FormatException) {
+                    error = new SubsonicError { Code = SubsonicError.WrongCredentials, Message = "Wrong username or password" };
+                    return null;
+                }
+            }
+
+            User user = Injection.Get<IUserRepository>().UserForName(username);
+            if (user == null || user.UserId == null) {
+                error = new SubsonicError { Code = SubsonicError.WrongCredentials, Message = "Wrong username or password" };
+                return null;
+            }
+
+            byte[] presented = SHA256.HashData(Encoding.UTF8.GetBytes(password));
+
+            VerifiedAuth cached;
+            bool cacheHit = this.verified.TryGetValue(username, out cached)
+                && cached.Expires > DateTime.UtcNow
+                && CryptographicOperations.FixedTimeEquals(cached.PasswordSha256, presented);
+
+            if (!cacheHit && !user.Authenticate(password)) {
+                error = new SubsonicError { Code = SubsonicError.WrongCredentials, Message = "Wrong username or password" };
+                return null;
+            }
+
+            // Cache the successful verification with a sliding expiry
+            this.verified[username] = new VerifiedAuth { PasswordSha256 = presented, Expires = DateTime.UtcNow + CacheTtl };
+
+            return this.Authenticated(user, req);
+        }
+
+        // Drop a user's cached verification (call after password change, user update, or delete)
+        public void Evict(string username) {
+            if (username != null) {
+                VerifiedAuth removed;
+                this.verified.TryRemove(username, out removed);
+            }
+        }
+
+        private User UserForApiKey(string apiKey) {
+            if (String.IsNullOrEmpty(apiKey)) {
+                return null;
+            }
+
+            byte[] presented = Encoding.UTF8.GetBytes(apiKey);
+            foreach (User candidate in Injection.Get<IUserRepository>().AllUsers()) {
+                if (String.IsNullOrEmpty(candidate.ApiKey)) {
+                    continue;
+                }
+                byte[] stored = Encoding.UTF8.GetBytes(candidate.ApiKey);
+                if (CryptographicOperations.FixedTimeEquals(stored, presented)) {
+                    return candidate;
+                }
+            }
+
+            return null;
+        }
+
+        // Repository users are shared cache instances; hand each request its own copy so the
+        // synthesized session (and its client name) can't leak across concurrent requests
+        private User Authenticated(User user, SubsonicRequest req) {
+            return new User {
+                UserId = user.UserId,
+                UserName = user.UserName,
+                Role = user.Role,
+                LastfmSession = user.LastfmSession,
+                CreateTime = user.CreateTime,
+                DeleteTime = user.DeleteTime,
+                // In-memory only, never persisted: NowPlayingService reads CurrentSession.ClientName
+                CurrentSession = new Session {
+                    UserId = user.UserId,
+                    ClientName = req.ClientName
+                }
+            };
+        }
+    }
+}
diff --git a/WaveBox.Server/src/Subsonic/SubsonicDispatcher.cs b/WaveBox.Server/src/Subsonic/SubsonicDispatcher.cs
new file mode 100644
index 0000000..19a9109
--- /dev/null
+++ b/WaveBox.Server/src/Subsonic/SubsonicDispatcher.cs
@@ -0,0 +1,179 @@
+using System;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Http;
+using WaveBox.Api;
+using WaveBox.Core;
+using WaveBox.Core.ApiResponse.Subsonic;
+using WaveBox.Core.Extensions;
+using WaveBox.Core.Model;
+using WaveBox.Subsonic.Handlers;
+
+namespace WaveBox.Subsonic {
+    // Terminal middleware for the /rest branch: parses the Subsonic endpoint name, merges
+    // query/form parameters, authenticates statelessly, and dispatches through an explicit
+    // (AOT-safe, no reflection) endpoint table.
+    public class SubsonicDispatcher {
+        private static readonly WaveBox.Core.Logging.ILog logger = WaveBox.Core.Logging.LogManager.GetLogger(typeof(SubsonicDispatcher));
+
+        private class SubsonicEndpoint {
+            public Action<SubsonicRequest, HttpContextProcessor, User> Handler;
+            public Role MinRole = Role.Test;
+
+            public SubsonicEndpoint(Action<SubsonicRequest, HttpContextProcessor, User> handler, Role minRole = Role.Test) {
+                Handler = handler;
+                MinRole = minRole;
+            }
+        }
+
+        private readonly Dictionary<string, SubsonicEndpoint> endpoints = new Dictionary<string, SubsonicEndpoint>(StringComparer.Ordinal);
+
+        public SubsonicDispatcher() {
+            // Explicit registration, lowercase keys (endpoint names are matched case-insensitively).
+            // Reflection scanning is not NativeAOT-compatible, same as ApiHandlerFactory.
+
+            // System
+            this.Register("ping", SubsonicSystemHandlers.Ping);
+            this.Register("getlicense", SubsonicSystemHandlers.GetLicense);
+            this.Register("getopensubsonicextensions", SubsonicSystemHandlers.GetOpenSubsonicExtensions);
+            this.Register("tokeninfo", SubsonicSystemHandlers.TokenInfo);
+            this.Register("getscanstatus", SubsonicSystemHandlers.GetScanStatus);
+            this.Register("getartistinfo", SubsonicSystemHandlers.GetArtistInfo);
+            this.Register("getartistinfo2", SubsonicSystemHandlers.GetArtistInfo2);
+
+            // Browsing
+            this.Register("getmusicfolders", SubsonicBrowsingHandlers.GetMusicFolders);
+            this.Register("getindexes", SubsonicBrowsingHandlers.GetIndexes);
+            this.Register("getmusicdirectory", SubsonicBrowsingHandlers.GetMusicDirectory);
+            this.Register("getartists", SubsonicBrowsingHandlers.GetArtists);
+            this.Register("getartist", SubsonicBrowsingHandlers.GetArtist);
+            this.Register("getalbum", SubsonicBrowsingHandlers.GetAlbum);
+            this.Register("getsong", SubsonicBrowsingHandlers.GetSong);
+            this.Register("getgenres", SubsonicBrowsingHandlers.GetGenres);
+            this.Register("getvideos", SubsonicBrowsingHandlers.GetVideos);
+            this.Register("getlyrics", SubsonicBrowsingHandlers.GetLyrics);
+
+            // Media retrieval
+            this.Register("getcoverart", SubsonicMediaHandlers.GetCoverArt);
+            this.Register("stream", SubsonicMediaHandlers.Stream);
+            this.Register("download", SubsonicMediaHandlers.Download);
+
+            // Album/song lists
+            this.Register("getalbumlist", SubsonicListHandlers.GetAlbumList);
+            this.Register("getalbumlist2", SubsonicListHandlers.GetAlbumList2);
+            this.Register("getrandomsongs", SubsonicListHandlers.GetRandomSongs);
+            this.Register("getsongsbygenre", SubsonicListHandlers.GetSongsByGenre);
+            this.Register("getnowplaying", SubsonicListHandlers.GetNowPlaying);
+            this.Register("getstarred", SubsonicListHandlers.GetStarred);
+            this.Register("getstarred2", SubsonicListHandlers.GetStarred2);
+
+            // Searching
+            this.Register("search2", SubsonicSearchHandlers.Search2);
+            this.Register("search3", SubsonicSearchHandlers.Search3);
+
+            // Media annotation (writes require a full user account, same as the legacy API)
+            this.Register("star", SubsonicAnnotationHandlers.Star, Role.User);
+            this.Register("unstar", SubsonicAnnotationHandlers.Unstar, Role.User);
+            this.Register("scrobble", SubsonicAnnotationHandlers.Scrobble, Role.User);
+
+            // Playlists
+            this.Register("getplaylists", SubsonicPlaylistHandlers.GetPlaylists);
+            this.Register("getplaylist", SubsonicPlaylistHandlers.GetPlaylist);
+            this.Register("createplaylist", SubsonicPlaylistHandlers.CreatePlaylist, Role.User);
+            this.Register("updateplaylist", SubsonicPlaylistHandlers.UpdatePlaylist, Role.User);
+            this.Register("deleteplaylist", SubsonicPlaylistHandlers.DeletePlaylist, Role.User);
+
+            // User management (getUser/changePassword do their own self-or-admin checks)
+            this.Register("getuser", SubsonicUserHandlers.GetUser);
+            this.Register("getusers", SubsonicUserHandlers.GetUsers, Role.Admin);
+            this.Register("changepassword", SubsonicUserHandlers.ChangePassword, Role.User);
+            this.Register("createuser", SubsonicUserHandlers.CreateUser, Role.Admin);
+            this.Register("updateuser", SubsonicUserHandlers.UpdateUser, Role.Admin);
+            this.Register("deleteuser", SubsonicUserHandlers.DeleteUser, Role.Admin);
+        }
+
+        private void Register(string name, Action<SubsonicRequest, HttpContextProcessor, User> handler, Role minRole = Role.Test) {
+            this.endpoints[name] = new SubsonicEndpoint(handler, minRole);
+        }
+
+        public async Task ProcessAsync(HttpContext context) {
+            string method = context.Request.Method.ToUpperInvariant();
+
+            if (method != "GET" && method != "POST") {
+                context.Response.StatusCode = 405;
+                context.Response.Headers["Allow"] = "GET, POST";
+                return;
+            }
+
+            // Form bodies (OpenSubsonic formPost extension) merge with the query string
+            IFormCollection form = null;
+            if (context.Request.HasFormContentType) {
+                form = await context.Request.ReadFormAsync(context.RequestAborted);
+            }
+
+            SubsonicRequest req = new SubsonicRequest(context, form);
+
+            // Handlers are synchronous and may block (transcode tailing), so dispatch on a
+            // worker thread rather than tying up the request loop, same as ApiDispatcher
+            await Task.Run(() => this.Dispatch(context, req), context.RequestAborted);
+        }
+
+        private void Dispatch(HttpContext context, SubsonicRequest req) {
+            HttpContextProcessor processor = new HttpContextProcessor(context);
+            string name = EndpointName(context.Request.Path.Value);
+            string ip = context.Connection.RemoteIpAddress != null ? context.Connection.RemoteIpAddress.ToString() : "unknown";
+
+            try {
+                if (String.IsNullOrEmpty(name)) {
+                    SubsonicWriter.WriteError(req, processor, SubsonicError.Generic, "Unknown endpoint");
+                    return;
+                }
+
+                SubsonicError authError;
+                User user = Injection.Get<SubsonicAuth>().Authenticate(req, out authError);
+                if (user == null) {
+                    logger.IfInfo(String.Format("[{0}] Subsonic: {1} auth failed ({2})", ip, name, authError.Code));
+                    SubsonicWriter.WriteError(req, processor, authError.Code, authError.Message);
+                    return;
+                }
+
+                SubsonicEndpoint endpoint;
+                if (!this.endpoints.TryGetValue(name.ToLowerInvariant(), out endpoint)) {
+                    SubsonicWriter.WriteError(req, processor, SubsonicError.Generic, name + " is not supported by WaveBox");
+                    return;
+                }
+
+                if (!user.HasPermission(endpoint.MinRole)) {
+                    SubsonicWriter.WriteError(req, processor, SubsonicError.NotAuthorized, user.UserName + " is not authorized to use " + name);
+                    return;
+                }
+
+                logger.IfInfo(String.Format("[{0}/{1}@{2}] Subsonic: {3}", user.UserName, req.ClientName, ip, name));
+
+                endpoint.Handler(req, processor, user);
+            } catch (Exception e) {
+                logger.Error(e);
+                try {
+                    SubsonicWriter.WriteError(req, processor, SubsonicError.Generic, "Internal error");
+                } catch (Exception inner) {
+                    logger.Error(inner);
+                }
+            }
+        }
+
+        // "/ping.view" -> "ping"; the branch middleware has already stripped the /rest prefix
+        private static string EndpointName(string path) {
+            if (String.IsNullOrEmpty(path)) {
+                return null;
+            }
+
+            string name = path.Trim('/');
+
+            if (name.EndsWith(".view", StringComparison.OrdinalIgnoreCase)) {
+                name = name.Substring(0, name.Length - ".view".Length);
+            }
+
+            return name;
+        }
+    }
+}
diff --git a/WaveBox.Server/src/Subsonic/SubsonicMapper.cs b/WaveBox.Server/src/Subsonic/SubsonicMapper.cs
new file mode 100644
index 0000000..32c432e
--- /dev/null
+++ b/WaveBox.Server/src/Subsonic/SubsonicMapper.cs
@@ -0,0 +1,279 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using WaveBox.Core.ApiResponse.Subsonic;
+using WaveBox.Core.Extensions;
+using WaveBox.Core.Model;
+
+namespace WaveBox.Subsonic {
+    // Translates WaveBox domain models into Subsonic DTOs.  All entity ids serialize as
+    // strings (the Subsonic schema requires string ids; some clients break on bare ints).
+    public static class SubsonicMapper {
+        // Unix seconds -> ISO 8601 UTC, the Subsonic date format
+        public static string Iso8601(long? unixSeconds) {
+            if (unixSeconds == null) {
+                return null;
+            }
+            return DateTimeOffset.FromUnixTimeSeconds(unixSeconds.Value).UtcDateTime.ToString("yyyy-MM-dd'T'HH:mm:ss'Z'", CultureInfo.InvariantCulture);
+        }
+
+        public static SubsonicChild ChildFromSong(Song song) {
+            return new SubsonicChild {
+                Id = song.ItemId == null ? null : song.ItemId.ToString(),
+                Parent = song.FolderId == null ? null : song.FolderId.ToString(),
+                IsDir = false,
+                Title = song.SongName ?? song.FileName,
+                Album = song.AlbumName,
+                Artist = song.ArtistName ?? song.AlbumArtistName,
+                Track = song.TrackNumber,
+                DiscNumber = song.DiscNumber,
+                Year = song.ReleaseYear,
+                Genre = song.GenreName,
+                CoverArt = song.ArtId == null ? null : song.ArtId.ToString(),
+                Size = song.FileSize,
+                ContentType = song.FileType.MimeType(),
+                Suffix = Suffix(song.FileName),
+                Duration = song.Duration,
+                BitRate = song.Bitrate,
+                Path = VirtualPath(song.ArtistName ?? song.AlbumArtistName, song.AlbumName, song.FileName),
+                IsVideo = false,
+                Created = Iso8601(song.LastModified),
+                AlbumId = song.AlbumId == null ? null : song.AlbumId.ToString(),
+                ArtistId = song.AlbumArtistId == null ? null : song.AlbumArtistId.ToString(),
+                Type = "music"
+            };
+        }
+
+        public static SubsonicChild ChildFromVideo(Video video) {
+            return new SubsonicChild {
+                Id = video.ItemId == null ? null : video.ItemId.ToString(),
+                Parent = video.FolderId == null ? null : video.FolderId.ToString(),
+                IsDir = false,
+                Title = video.FileName == null ? null : System.IO.Path.GetFileNameWithoutExtension(video.FileName),
+                Genre = video.GenreName,
+                CoverArt = video.ArtId == null ? null : video.ArtId.ToString(),
+                Size = video.FileSize,
+                ContentType = video.FileType.MimeType(),
+                Suffix = Suffix(video.FileName),
+                Duration = video.Duration,
+                BitRate = video.Bitrate,
+                Path = video.FileName,
+                IsVideo = true,
+                Created = Iso8601(video.LastModified),
+                Type = "video"
+            };
+        }
+
+        public static SubsonicChild ChildFromMediaItem(IMediaItem item) {
+            Song song = item as Song;
+            if (song != null) {
+                return ChildFromSong(song);
+            }
+            Video video = item as Video;
+            if (video != null) {
+                return ChildFromVideo(video);
+            }
+            return null;
+        }
+
+        // Note: reading Folder.ArtId costs one small DB lookup per folder
+        public static SubsonicChild ChildFromFolder(Folder folder) {
+            int? artId = folder.ArtId;
+            return new SubsonicChild {
+                Id = folder.FolderId == null ? null : folder.FolderId.ToString(),
+                Parent = folder.ParentFolderId == null ? null : folder.ParentFolderId.ToString(),
+                IsDir = true,
+                Title = folder.FolderName,
+                CoverArt = artId == null ? null : artId.ToString()
+            };
+        }
+
+        // Folder-flavored album entry for getAlbumList and search2
+        public static SubsonicChild ChildFromAlbum(Album album) {
+            return new SubsonicChild {
+                Id = album.AlbumId == null ? null : album.AlbumId.ToString(),
+                Parent = album.AlbumArtistId == null ? null : album.AlbumArtistId.ToString(),
+                IsDir = true,
+                Title = album.AlbumName,
+                Album = album.AlbumName,
+                Artist = album.AlbumArtistName,
+                Year = album.ReleaseYear,
+                CoverArt = album.ArtId == null ? null : album.ArtId.ToString(),
+                AlbumId = album.AlbumId == null ? null : album.AlbumId.ToString(),
+                ArtistId = album.AlbumArtistId == null ? null : album.AlbumArtistId.ToString()
+            };
+        }
+
+        // Folder-flavored album entry for the non-ID3 endpoints (getAlbumList, getStarred):
+        // album metadata for display, but the browsable id is the folder holding the album's
+        // songs so folder-mode clients traverse the real directory tree
+        public static SubsonicChild ChildFromAlbumInFolder(Album album, IDictionary<int, int> folderByAlbum) {
+            SubsonicChild child = ChildFromAlbum(album);
+
+            int folderId;
+            if (folderByAlbum != null && album.AlbumId != null && folderByAlbum.TryGetValue((int)album.AlbumId, out folderId)) {
+                child.Id = folderId.ToString();
+                // The tag artist id would be wrong as a directory parent; leave it unset
+                child.Parent = null;
+            }
+
+            return child;
+        }
+
+        public static IDictionary<int, int> ToFolderLookup(IList<AlbumFolder> albumFolders) {
+            Dictionary<int, int> lookup = new Dictionary<int, int>();
+            foreach (AlbumFolder albumFolder in albumFolders) {
+                if (albumFolder.AlbumId != null && albumFolder.FolderId != null) {
+                    lookup[(int)albumFolder.AlbumId] = (int)albumFolder.FolderId;
+                }
+            }
+            return lookup;
+        }
+
+        // counts: optional SongCountsByAlbum() lookup keyed by AlbumId
+        public static SubsonicAlbumID3 AlbumID3FromAlbum(Album album, IDictionary<int, GroupCount> counts) {
+            SubsonicAlbumID3 dto = new SubsonicAlbumID3();
+            FillAlbumID3(dto, album, counts);
+            return dto;
+        }
+
+        public static void FillAlbumID3(SubsonicAlbumID3 dto, Album album, IDictionary<int, GroupCount> counts) {
+            dto.Id = album.AlbumId == null ? null : album.AlbumId.ToString();
+            dto.Name = album.AlbumName;
+            dto.Artist = album.AlbumArtistName;
+            dto.ArtistId = album.AlbumArtistId == null ? null : album.AlbumArtistId.ToString();
+            dto.CoverArt = album.ArtId == null ? null : album.ArtId.ToString();
+            dto.Year = album.ReleaseYear;
+
+            GroupCount stats;
+            if (counts != null && album.AlbumId != null && counts.TryGetValue((int)album.AlbumId, out stats)) {
+                dto.SongCount = stats.Count;
+                dto.Duration = (int)stats.Total;
+            }
+        }
+
+        // Note: reading AlbumArtist.ArtId costs one small DB lookup; pass includeCoverArt: false
+        // when mapping long lists
+        public static SubsonicArtistID3 ArtistID3FromAlbumArtist(AlbumArtist albumArtist, int? albumCount, bool includeCoverArt) {
+            SubsonicArtistID3 dto = new SubsonicArtistID3();
+            FillArtistID3(dto, albumArtist, albumCount, includeCoverArt);
+            return dto;
+        }
+
+        public static void FillArtistID3(SubsonicArtistID3 dto, AlbumArtist albumArtist, int? albumCount, bool includeCoverArt) {
+            dto.Id = albumArtist.AlbumArtistId == null ? null : albumArtist.AlbumArtistId.ToString();
+            dto.Name = albumArtist.AlbumArtistName;
+            dto.AlbumCount = albumCount;
+            if (includeCoverArt) {
+                int? artId = albumArtist.ArtId;
+                dto.CoverArt = artId == null ? null : artId.ToString();
+            }
+        }
+
+        public static SubsonicPlaylist PlaylistFromPlaylist(Playlist playlist, string owner) {
+            SubsonicPlaylist dto = new SubsonicPlaylist();
+            FillPlaylist(dto, playlist, owner);
+            return dto;
+        }
+
+        public static void FillPlaylist(SubsonicPlaylist dto, Playlist playlist, string owner) {
+            dto.Id = playlist.PlaylistId == null ? null : playlist.PlaylistId.ToString();
+            dto.Name = playlist.PlaylistName;
+            dto.Owner = owner;
+            dto.Public = true;
+            dto.SongCount = playlist.PlaylistCount ?? 0;
+            dto.Duration = playlist.PlaylistDuration ?? 0;
+            dto.Created = Iso8601(playlist.LastUpdateTime);
+            dto.Changed = Iso8601(playlist.LastUpdateTime);
+        }
+
+        public static SubsonicUser UserFromUser(User user, IList<int> folderIds) {
+            bool userRole = user.HasPermission(Role.User);
+            return new SubsonicUser {
+                Username = user.UserName,
+                ScrobblingEnabled = user.LastfmSession != null,
+                AdminRole = user.HasPermission(Role.Admin),
+                SettingsRole = userRole,
+                DownloadRole = userRole,
+                UploadRole = false,
+                PlaylistRole = userRole,
+                CoverArtRole = userRole,
+                CommentRole = false,
+                PodcastRole = false,
+                StreamRole = true,
+                JukeboxRole = false,
+                ShareRole = false,
+                VideoConversionRole = false,
+                Folder = folderIds
+            };
+        }
+
+        // Group a sorted list into Subsonic index buckets: A-Z by first letter, everything else
+        // under "#".  Items must already be sorted by name (the repositories sort NOCASE).
+        public static List<KeyValuePair<string, List<T>>> GroupByIndex<T>(IEnumerable<T> items, Func<T, string> nameOf) {
+            Dictionary<string, List<T>> buckets = new Dictionary<string, List<T>>(StringComparer.Ordinal);
+            List<string> order = new List<string>();
+
+            foreach (T item in items) {
+                string name = nameOf(item);
+                string key = "#";
+                if (!String.IsNullOrEmpty(name)) {
+                    char first = Char.ToUpperInvariant(name[0]);
+                    if (first >= 'A' && first <= 'Z') {
+                        key = first.ToString();
+                    }
+                }
+
+                List<T> bucket;
+                if (!buckets.TryGetValue(key, out bucket)) {
+                    bucket = new List<T>();
+                    buckets[key] = bucket;
+                    order.Add(key);
+                }
+                bucket.Add(item);
+            }
+
+            order.Sort(StringComparer.Ordinal);
+            return order.Select(key => new KeyValuePair<string, List<T>>(key, buckets[key])).ToList();
+        }
+
+        public static IDictionary<int, GroupCount> ToLookup(IList<GroupCount> counts) {
+            Dictionary<int, GroupCount> lookup = new Dictionary<int, GroupCount>();
+            foreach (GroupCount count in counts) {
+                if (count.GroupId != null) {
+                    lookup[(int)count.GroupId] = count;
+                }
+            }
+            return lookup;
+        }
+
+        private static string Suffix(string fileName) {
+            if (String.IsNullOrEmpty(fileName)) {
+                return null;
+            }
+            string extension = System.IO.Path.GetExtension(fileName);
+            return String.IsNullOrEmpty(extension) ? null : extension.TrimStart('.').ToLowerInvariant();
+        }
+
+        // Synthetic Artist/Album/File path: real filesystem paths must not leak to clients
+        private static string VirtualPath(string artist, string album, string fileName) {
+            if (String.IsNullOrEmpty(fileName)) {
+                return null;
+            }
+            string clean(string part) {
+                return part == null ? null : part.Replace('/', '_');
+            }
+            List<string> parts = new List<string>();
+            if (!String.IsNullOrEmpty(artist)) {
+                parts.Add(clean(artist));
+            }
+            if (!String.IsNullOrEmpty(album)) {
+                parts.Add(clean(album));
+            }
+            parts.Add(clean(fileName));
+            return String.Join("/", parts);
+        }
+    }
+}
diff --git a/WaveBox.Server/src/Subsonic/SubsonicRequest.cs b/WaveBox.Server/src/Subsonic/SubsonicRequest.cs
new file mode 100644
index 0000000..30e21ca
--- /dev/null
+++ b/WaveBox.Server/src/Subsonic/SubsonicRequest.cs
@@ -0,0 +1,81 @@
+using System;
+using System.Collections.Generic;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Primitives;
+
+namespace WaveBox.Subsonic {
+    // Read-only view over the merged query string and form body of a Subsonic request.
+    // Unlike the legacy UriWrapper, values are URL-decoded by ASP.NET and duplicate keys are
+    // preserved (Subsonic clients send repeated id/songId/songIdToAdd parameters).
+    public class SubsonicRequest {
+        private readonly IQueryCollection query;
+        private readonly IFormCollection form;
+
+        public HttpContext Context { get; private set; }
+
+        public SubsonicRequest(HttpContext context, IFormCollection form) {
+            this.Context = context;
+            this.query = context.Request.Query;
+            this.form = form;
+        }
+
+        // First value for a key, or null when absent/empty
+        public string Get(string key) {
+            IList<string> all = this.GetAll(key);
+            return all.Count > 0 ? all[0] : null;
+        }
+
+        // All non-empty values for a key, query string first, then form body
+        public IList<string> GetAll(string key) {
+            List<string> values = new List<string>();
+            StringValues found;
+            if (this.query != null && this.query.TryGetValue(key, out found)) {
+                foreach (string value in found) {
+                    if (!String.IsNullOrEmpty(value)) {
+                        values.Add(value);
+                    }
+                }
+            }
+            if (this.form != null && this.form.TryGetValue(key, out found)) {
+                foreach (string value in found) {
+                    if (!String.IsNullOrEmpty(value)) {
+                        values.Add(value);
+                    }
+                }
+            }
+            return values;
+        }
+
+        public int? GetInt(string key) {
+            int value;
+            return Int32.TryParse(this.Get(key), out value) ? value : (int?)null;
+        }
+
+        public long? GetLong(string key) {
+            long value;
+            return Int64.TryParse(this.Get(key), out value) ? value : (long?)null;
+        }
+
+        public bool GetBool(string key, bool defaultValue) {
+            string value = this.Get(key);
+            if (value == null) {
+                return defaultValue;
+            }
+            return value == "1" || value.Equals("true", StringComparison.OrdinalIgnoreCase);
+        }
+
+        public IList<int> GetIntList(string key) {
+            List<int> values = new List<int>();
+            foreach (string value in this.GetAll(key)) {
+                int parsed;
+                if (Int32.TryParse(value, out parsed)) {
+                    values.Add(parsed);
+                }
+            }
+            return values;
+        }
+
+        // Subsonic client name (c parameter)
+        public string ClientName { get { return this.Get("c") ?? "Subsonic"; } }
+    }
+}
diff --git a/WaveBox.Server/src/Subsonic/SubsonicWriter.cs b/WaveBox.Server/src/Subsonic/SubsonicWriter.cs
new file mode 100644
index 0000000..9a30469
--- /dev/null
+++ b/WaveBox.Server/src/Subsonic/SubsonicWriter.cs
@@ -0,0 +1,64 @@
+using System;
+using System.Text.Json;
+using WaveBox.Core;
+using WaveBox.Core.ApiResponse.Subsonic;
+using WaveBox.Service.Services.Http;
+
+namespace WaveBox.Subsonic {
+    // Builds and writes Subsonic envelope responses in the format the client requested:
+    // XML by default (the Subsonic standard), JSON for f=json, JSONP for f=jsonp&callback=.
+    public static class SubsonicWriter {
+        private static readonly WaveBox.Core.Logging.ILog logger = WaveBox.Core.Logging.LogManager.GetLogger(typeof(SubsonicWriter));
+
+        // Source-generated serializer contexts (NativeAOT-safe), compact/indented pair like HttpContextProcessor
+        private static readonly SubsonicJsonContext compactJson = SubsonicJsonContext.Default;
+        private static readonly SubsonicJsonContext indentedJson = new SubsonicJsonContext(new JsonSerializerOptions {
+            WriteIndented = true
+        });
+
+        // A fresh "ok" envelope body; handlers set exactly one payload property on it
+        public static SubsonicResponseBody Body() {
+            return new SubsonicResponseBody { ServerVersion = ServerInfo.BuildVersion };
+        }
+
+        public static void Write(SubsonicRequest req, IHttpProcessor processor, SubsonicResponseBody body) {
+            try {
+                bool pretty = Injection.Get<IServerSettings>().PrettyJson;
+                string format = (req.Get("f") ?? "xml").ToLowerInvariant();
+
+                if (format == "json") {
+                    processor.WriteText(ToJson(body, pretty), "application/json");
+                    return;
+                }
+
+                if (format == "jsonp") {
+                    string callback = req.Get("callback");
+                    if (String.IsNullOrEmpty(callback)) {
+                        // jsonp without a callback degrades to plain JSON
+                        processor.WriteText(ToJson(body, pretty), "application/json");
+                    } else {
+                        processor.WriteText(callback + "(" + ToJson(body, pretty) + ");", "text/javascript");
+                    }
+                    return;
+                }
+
+                // f=xml or anything else: the Subsonic default
+                processor.WriteText(SubsonicXmlSerializer.Serialize(body, pretty), "text/xml");
+            } catch (Exception e) {
+                logger.Error(e);
+            }
+        }
+
+        public static void WriteError(SubsonicRequest req, IHttpProcessor processor, int code, string message) {
+            SubsonicResponseBody body = Body();
+            body.Status = "failed";
+            body.Error = new SubsonicError { Code = code, Message = message };
+            Write(req, processor, body);
+        }
+
+        private static string ToJson(SubsonicResponseBody body, bool pretty) {
+            SubsonicJsonContext context = pretty ? indentedJson : compactJson;
+            return JsonSerializer.Serialize(new SubsonicResponse(body), context.SubsonicResponse);
+        }
+    }
+}
diff --git a/WaveBox.Server/src/Subsonic/SubsonicXmlSerializer.cs b/WaveBox.Server/src/Subsonic/SubsonicXmlSerializer.cs
new file mode 100644
index 0000000..fce6ba2
--- /dev/null
+++ b/WaveBox.Server/src/Subsonic/SubsonicXmlSerializer.cs
@@ -0,0 +1,174 @@
+using System;
+using System.Collections;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Diagnostics.CodeAnalysis;
+using System.Globalization;
+using System.Reflection;
+using System.Text;
+using System.Text.Json.Serialization;
+using System.Xml;
+using WaveBox.Core.ApiResponse.Subsonic;
+
+namespace WaveBox.Subsonic {
+    // Renders the Subsonic envelope as classic Subsonic XML using the mechanical XML<->JSON
+    // mapping the protocol defines: scalar properties become attributes, nested objects and
+    // lists become (repeated) child elements, and [SubsonicXmlText] properties become element
+    // text.  Element/attribute names come from the same [JsonPropertyName] metadata the JSON
+    // path uses, so the two wire formats cannot drift apart.
+    //
+    // Reflection over the DTOs is NativeAOT-safe because every DTO type is rooted in
+    // SubsonicDtoRegistry (same pattern as the sqlite-net ORM and ModelTypeRegistry).
+    public static class SubsonicXmlSerializer {
+        public const string XmlNamespace = "http://subsonic.org/restapi";
+
+        private class PropertyEntry {
+            public string Name;
+            public PropertyInfo Property;
+        }
+
+        private class TypeShape {
+            public List<PropertyEntry> Attributes = new List<PropertyEntry>();
+            public List<PropertyEntry> Elements = new List<PropertyEntry>();
+            public PropertyInfo Text;
+        }
+
+        private static readonly ConcurrentDictionary<Type, TypeShape> shapes = new ConcurrentDictionary<Type, TypeShape>();
+
+        public static string Serialize(SubsonicResponseBody body, bool indent) {
+            StringBuilder sb = new StringBuilder();
+
+            // Declared by hand: XmlWriter over a StringBuilder would declare utf-16, but the
+            // response bytes are written as UTF-8 by IHttpProcessor.WriteText
+            sb.Append("<?xml version=\"1.0\" encoding=\"UTF-8\"?>");
+            if (indent) {
+                sb.Append('\n');
+            }
+
+            XmlWriterSettings settings = new XmlWriterSettings {
+                Indent = indent,
+                OmitXmlDeclaration = true
+            };
+
+            using (XmlWriter writer = XmlWriter.Create(sb, settings)) {
+                WriteObject(writer, "subsonic-response", body, XmlNamespace);
+            }
+
+            return sb.ToString();
+        }
+
+        private static void WriteObject(XmlWriter writer, string name, object obj, string ns = null) {
+            if (ns != null) {
+                writer.WriteStartElement(name, ns);
+            } else {
+                writer.WriteStartElement(name);
+            }
+
+            TypeShape shape = ShapeFor(obj.GetType());
+
+            foreach (PropertyEntry attribute in shape.Attributes) {
+                object value = attribute.Property.GetValue(obj);
+                if (value != null) {
+                    writer.WriteAttributeString(attribute.Name, FormatValue(value));
+                }
+            }
+
+            if (shape.Text != null) {
+                object text = shape.Text.GetValue(obj);
+                if (text != null) {
+                    writer.WriteString(FormatValue(text));
+                }
+            }
+
+            foreach (PropertyEntry element in shape.Elements) {
+                object value = element.Property.GetValue(obj);
+                if (value == null) {
+                    continue;
+                }
+
+                IEnumerable list = value as IEnumerable;
+                if (list != null && !(value is string)) {
+                    // Lists render as repeated elements; primitive items (extension versions,
+                    // user folder ids) as text-content elements
+                    foreach (object item in list) {
+                        if (item == null) {
+                            continue;
+                        }
+                        if (IsScalar(item.GetType())) {
+                            writer.WriteElementString(element.Name, FormatValue(item));
+                        } else {
+                            WriteObject(writer, element.Name, item);
+                        }
+                    }
+                } else {
+                    WriteObject(writer, element.Name, value);
+                }
+            }
+
+            writer.WriteEndElement();
+        }
+
+        // Reflection here is only reachable for DTO types rooted in SubsonicDtoRegistry,
+        // which preserves all member metadata under trimming/NativeAOT
+        [UnconditionalSuppressMessage("Trimming", "IL2070", Justification = "All Subsonic DTO types are rooted in SubsonicDtoRegistry")]
+        private static TypeShape BuildShape(Type type) {
+            TypeShape shape = new TypeShape();
+
+            foreach (PropertyInfo property in type.GetProperties(BindingFlags.Public | BindingFlags.Instance)) {
+                if (!property.CanRead || property.GetIndexParameters().Length != 0) {
+                    continue;
+                }
+
+                JsonIgnoreAttribute ignore = property.GetCustomAttribute<JsonIgnoreAttribute>();
+                if (ignore != null && ignore.Condition == JsonIgnoreCondition.Always) {
+                    continue;
+                }
+
+                if (property.GetCustomAttribute<SubsonicXmlTextAttribute>() != null) {
+                    shape.Text = property;
+                    continue;
+                }
+
+                JsonPropertyNameAttribute jsonName = property.GetCustomAttribute<JsonPropertyNameAttribute>();
+                string name = jsonName != null ? jsonName.Name : Char.ToLowerInvariant(property.Name[0]) + property.Name.Substring(1);
+
+                PropertyEntry entry = new PropertyEntry { Name = name, Property = property };
+                Type valueType = Nullable.GetUnderlyingType(property.PropertyType) ?? property.PropertyType;
+                if (IsScalar(valueType)) {
+                    shape.Attributes.Add(entry);
+                } else {
+                    shape.Elements.Add(entry);
+                }
+            }
+
+            return shape;
+        }
+
+        private static TypeShape ShapeFor(Type type) {
+            TypeShape shape;
+            if (!shapes.TryGetValue(type, out shape)) {
+                shape = BuildShape(type);
+                shapes.TryAdd(type, shape);
+            }
+            return shape;
+        }
+
+        private static bool IsScalar(Type type) {
+            type = Nullable.GetUnderlyingType(type) ?? type;
+            return type.IsPrimitive || type.IsEnum || type == typeof(string) || type == typeof(decimal);
+        }
+
+        private static string FormatValue(object value) {
+            if (value is bool) {
+                return (bool)value ? "true" : "false";
+            }
+
+            IFormattable formattable = value as IFormattable;
+            if (formattable != null) {
+                return formattable.ToString(null, CultureInfo.InvariantCulture);
+            }
+
+            return value.ToString();
+        }
+    }
+}
diff --git a/WaveBox.Server/src/Transcoding/TranscodeStreamer.cs b/WaveBox.Server/src/Transcoding/TranscodeStreamer.cs
new file mode 100644
index 0000000..b4bde02
--- /dev/null
+++ b/WaveBox.Server/src/Transcoding/TranscodeStreamer.cs
@@ -0,0 +1,69 @@
+using System;
+using System.IO;
+using System.Threading;
+using WaveBox.Core.Extensions;
+using WaveBox.Service.Services;
+using WaveBox.Service.Services.Http;
+
+namespace WaveBox.Transcoding {
+    // The wait-for-transcode-output-and-send loop, shared by the legacy /api/transcode handler
+    // and Subsonic stream.  Extracted verbatim from TranscodeApiHandler.
+    public static class TranscodeStreamer {
+        private static readonly WaveBox.Core.Logging.ILog logger = WaveBox.Core.Logging.LogManager.GetLogger(typeof(TranscodeStreamer));
+
+        // Waits up to 5 seconds for the transcoder's output (file or stdout stream) to appear,
+        // streams it to the client (tailing the growing file via processor.Transcoder), then
+        // spins off the consume thread that reference-counts and eventually cleans up the
+        // transcoder.  Returns false if no output ever appeared (an error header was written).
+        public static bool Send(TranscodeService transcodeService, ITranscoder transcoder, IHttpProcessor processor, int startOffset, long? limitToSize, bool estimateContentLength) {
+            if ((object)transcoder == null) {
+                processor.WriteErrorHeader();
+                return false;
+            }
+
+            Stream stream = null;
+            long length = (long)transcoder.EstimatedOutputSize;
+
+            // Wait up 5 seconds for file or basestream to appear
+            for (int i = 0; i < 20; i++) {
+                if (transcoder.IsDirect) {
+                    logger.IfInfo("Checking if base stream exists");
+                    if ((object)transcoder.TranscodeProcess != null && (object)transcoder.TranscodeProcess.StandardOutput.BaseStream != null) {
+                        // The base stream exists, so the transcoding process has started
+                        logger.IfInfo("Base stream exists, starting transfer");
+                        stream = transcoder.TranscodeProcess.StandardOutput.BaseStream;
+                        break;
+                    }
+                } else {
+                    logger.IfInfo("Checking if file exists (" + transcoder.OutputPath + ")");
+                    if (File.Exists(transcoder.OutputPath)) {
+                        // The file exists, so the transcoding process has started
+                        stream = new FileStream(transcoder.OutputPath, FileMode.Open, FileAccess.Read);
+                        break;
+                    }
+                }
+                Thread.Sleep(250);
+            }
+
+            bool sent = false;
+            if ((transcoder.IsDirect && (object)stream != null) ||
+                    (!transcoder.IsDirect && File.Exists(transcoder.OutputPath))) {
+                processor.Transcoder = transcoder;
+
+                DateTime lastModified = transcoder.IsDirect ? DateTime.UtcNow : new FileInfo(transcoder.OutputPath).LastWriteTimeUtc;
+
+                processor.WriteFile(stream, startOffset, length, transcoder.MimeType, null, estimateContentLength, lastModified, limitToSize);
+                stream.Close();
+                sent = true;
+            } else {
+                processor.WriteErrorHeader();
+            }
+
+            // Spin off a thread to consume the transcoder in 30 seconds.
+            Thread consume = new Thread(() => transcodeService.ConsumedTranscode(transcoder));
+            consume.Start();
+
+            return sent;
+        }
+    }
+}