feat(media-proxy): sign attachment URLs and gate origins (#2830 )

fix(api): chunk guild permission batch RPC over 100 guilds (#2829 )
fix(desktop): drop redundant casts flagged by clippy 1.98 (#2826 )
2026-10-09 12:12:25 +09:00 · 2026-09-18 15:57:32 +02:00 · 2026-09-18 12:54:03 +02:00 · 2026-09-17 21:28:48 +02:00 · 2026-09-17 21:08:56 +02:00 · 2026-09-17 15:32:25 +02:00
1284 changed files with 41813 additions and 136885 deletions
@@ -1,14 +1,14 @@
-FROM chrislusf/seaweedfs:4.31 AS seaweedfs
+FROM chrislusf/seaweedfs:4.47 AS seaweedfs

-FROM erlang:28.5.0.1
+FROM erlang:28.5.0.6

 ARG USERNAME=vscode
 ARG USER_UID=1000
 ARG USER_GID=1000
-ARG NODE_MAJOR=24
-ARG ELP_VERSION=2026-02-27
-ARG PNPM_VERSION=10.29.3
-ARG WASM_BINDGEN_VERSION=0.2.123
+ARG NODE_MAJOR=26
+ARG ELP_VERSION=2026-08-10
+ARG PNPM_VERSION=12.4.2
+ARG WASM_BINDGEN_VERSION=0.2.128

 ENV DEBIAN_FRONTEND=noninteractive

@@ -131,7 +131,8 @@ RUN apt-get update \
 RUN curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL https://deb.nodesource.com/setup_${NODE_MAJOR}.x | bash - \
 	&& apt-get install -y --no-install-recommends nodejs \
 	&& rm -rf /var/lib/apt/lists/* \
-	&& corepack enable
+	&& npm install -g "pnpm@${PNPM_VERSION}" \
+	&& pnpm --version

 RUN python3 -m pip install --break-system-packages --no-cache-dir awscli

@@ -167,7 +168,7 @@ RUN ARCH="$(dpkg --print-architecture)" \
 		arm64) ELP_ARCH="aarch64" ;; \
 		*) echo "Unsupported architecture for ELP: $ARCH" >&2; exit 1 ;; \
 	esac \
-	&& curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL "https://github.com/WhatsApp/erlang-language-platform/releases/download/${ELP_VERSION}/elp-linux-${ELP_ARCH}-unknown-linux-gnu-otp-28.tar.gz" -o /tmp/elp.tgz \
+	&& curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL "https://github.com/WhatsApp/erlang-language-platform/releases/download/${ELP_VERSION}/elp-linux-${ELP_ARCH}-unknown-linux-gnu-otp-28.5.tar.gz" -o /tmp/elp.tgz \
 	&& tar -C /usr/local/bin -xzf /tmp/elp.tgz elp \
 	&& chmod +x /usr/local/bin/elp \
 	&& rm /tmp/elp.tgz
@@ -194,7 +195,4 @@ RUN curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL https://sh.rustup.rs
 	&& cargo install wasm-bindgen-cli --version "${WASM_BINDGEN_VERSION}" --locked \
 	&& rm -rf "/home/${USERNAME}/.cargo/registry" "/home/${USERNAME}/.cargo/git"

-RUN corepack prepare "pnpm@${PNPM_VERSION}" --activate \
-	&& pnpm --version
-
 WORKDIR /workspaces/fluxer
@@ -9,7 +9,7 @@ services:
    init: true
    environment:
      DOCKER_HOST: unix:///var/run/docker.sock
-      npm_config_store_dir: /home/vscode/.local/share/pnpm/store
+      pnpm_config_store_dir: /home/vscode/.local/share/pnpm/store
      FLUXER_PUBLIC_PORT: "${FLUXER_DEV_PROXY_PORT:-8088}"
      FLUXER_PUBLIC_URL: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
      FLUXER_API_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/api"
@@ -292,13 +292,13 @@ services:
      start_period: 5s

  valkey:
-    image: valkey/valkey:8.1.7-alpine
+    image: valkey/valkey:9.1.2-alpine
    command: ["valkey-server", "--save", "", "--appendonly", "no"]
    ports:
      - "127.0.0.1:${FLUXER_DEV_VALKEY_PORT:-6379}:6379"

  nats:
-    image: nats:2.14.2-alpine
+    image: nats:2.14.7-alpine
    command: ["-js", "-sd", "/data", "-m", "8222"]
    volumes:
      - nats-data:/data
@@ -321,9 +321,10 @@ services:
      - "127.0.0.1:${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}:${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}/udp"

  meilisearch:
-    image: getmeili/meilisearch:v1.12
+    image: getmeili/meilisearch:v1.53
    environment:
      MEILI_NO_ANALYTICS: "true"
+      MEILI_UPGRADE_DB: "true"
      MEILI_MASTER_KEY: fluxer-dev-meilisearch
    volumes:
      - meilisearch-data:/meili_data
@@ -337,7 +338,7 @@ services:
      start_period: 5s

  mailpit:
-    image: axllent/mailpit:v1.30
+    image: axllent/mailpit:v1.31
    environment:
      MP_DATABASE: /data/mailpit.db
      MP_MAX_MESSAGES: 5000
@@ -28,9 +28,6 @@ f:media_proxy:
 f:messages:
  - changed-files:
    - any-glob-to-any-file: fluxer_messages/**/*
-f:recon:
-  - changed-files:
-    - any-glob-to-any-file: fluxer_recon/**/*
 f:snowflakes:
  - changed-files:
    - any-glob-to-any-file: fluxer_snowflakes/**/*
@@ -58,13 +58,13 @@ jobs:
    outputs:
      build_version: ${{ steps.vars.outputs.build_version }}
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: Create token
        id: create-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
@@ -101,19 +101,19 @@ jobs:
          - platform: arm64
            runner: ubuntu-24.04-arm
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: resolve source date
        id: source
        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}
-      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
        with:
          context: ${{ inputs.context }}
          file: ${{ inputs.dockerfile }}
@@ -141,15 +141,15 @@ jobs:
      contents: write
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -43,13 +43,13 @@ jobs:
    outputs:
      build_version: ${{ steps.vars.outputs.build_version }}
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: set variables
        id: vars
        run: >-
@@ -73,18 +73,18 @@ jobs:
      BUNDLE_LOCAL_ASSETS: "true"
      FLUXER_APP_PROXY_TIME_FREEZE_ENABLED: "false"
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: prepare docker config
        run: >-
          tools/ci/run.sh build-app-proxy
          --step prepare_docker_config
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
      - name: configure ghcr auth
        env:
          GHCR_USERNAME: ${{ github.actor }}
@@ -131,19 +131,19 @@ jobs:
          - platform: arm64
            runner: ubuntu-24.04-arm
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: resolve source date
        id: source
        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
        with:
          context: .
          file: fluxer_app_proxy/Dockerfile
@@ -173,15 +173,15 @@ jobs:
      contents: write
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -43,13 +43,13 @@ jobs:
    outputs:
      build_version: ${{ steps.vars.outputs.build_version }}
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: set variables
        id: vars
        run: >-
@@ -67,18 +67,18 @@ jobs:
      contents: read
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: prepare docker config
        run: >-
          tools/ci/run.sh build-app-proxy
          --step prepare_docker_config
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
      - name: configure ghcr auth
        env:
          GHCR_USERNAME: ${{ github.actor }}
@@ -131,13 +131,13 @@ jobs:
      contents: read
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: resolve source date
        id: source
        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
@@ -145,7 +145,7 @@ jobs:
        run: >-
          tools/ci/run.sh build-app-proxy
          --step prepare_docker_config
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
      - name: configure ghcr auth
        env:
          GHCR_USERNAME: ${{ github.actor }}
@@ -178,19 +178,19 @@ jobs:
      contents: read
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: resolve source date
        id: source
        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
        with:
          context: .
          file: fluxer_app_proxy/Dockerfile
@@ -219,15 +219,15 @@ jobs:
      contents: write
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -58,14 +58,14 @@ jobs:
      source_sha: ${{ steps.meta.outputs.source_sha }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: main

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Create token
        id: create-token
@@ -98,12 +98,12 @@ jobs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Build platform matrix
        id: set-matrix
@@ -151,27 +151,27 @@ jobs:
      ELECTRON_ARCH: ${{ matrix.electron_arch }}
    steps:
      - name: Checkout CI helpers
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}
          path: _ci

      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}
          path: source

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Set up Python (Windows)
        if: runner.os == 'Windows'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
-          python-version: "3.13"
+          python-version: "3.14"

      - name: Ensure python3 command (Windows)
        if: runner.os == 'Windows'
@@ -196,14 +196,14 @@ jobs:
          --step set_workdir_unix

      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: 24
+          node-version: 26

-      - name: Set up pnpm via corepack
+      - name: Set up pnpm
        run: >-
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
-          --step setup_pnpm_corepack
+          --step setup_pnpm

      - name: Resolve pnpm store path (Windows)
        if: runner.os == 'Windows'
@@ -247,9 +247,9 @@ jobs:

      - name: Set up Rust toolchain (Unix)
        if: matrix.platform != 'windows'
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: ${{ matrix.platform == 'macos' && 'aarch64-apple-darwin,x86_64-apple-darwin' || (matrix.arch == 'arm64' && 'aarch64-unknown-linux-gnu' || 'x86_64-unknown-linux-gnu') }}

      - name: Install MSVC ARM64 build tools
@@ -260,7 +260,7 @@ jobs:

      - name: Set up MSVC env (Windows)
        if: matrix.platform == 'windows'
-        uses: TheMrMilchmann/setup-msvc-dev@79dac248aac9d0059f86eae9d8b5bfab4e95e97c
+        uses: TheMrMilchmann/setup-msvc-dev@368ef7d1ee4d1171b31d4a7f67f4d954f903f5a9
        with:
          arch: ${{ matrix.arch == 'arm64' && 'amd64_arm64' || 'amd64' }}

@@ -302,9 +302,9 @@ jobs:

      - name: Set up .NET SDK (Windows)
        if: matrix.platform == 'windows'
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
        with:
-          dotnet-version: "8.0.x"
+          dotnet-version: "10.0.x"

      - name: Install Velopack CLI
        if: matrix.platform == 'windows'
@@ -363,7 +363,7 @@ jobs:

      - name: Azure login for Artifact Signing
        if: matrix.platform == 'windows'
-        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -533,14 +533,14 @@ jobs:
      AWS_SECRET_ACCESS_KEY: ${{ secrets.DOWNLOADS_AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Download S3 handoff artifacts
        run: >-
@@ -612,14 +612,14 @@ jobs:
      AWS_SECRET_ACCESS_KEY: ${{ secrets.DOWNLOADS_AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Download GitHub release assets
        run: >-
@@ -1,36 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-name: build recon
-
-on:
-  workflow_dispatch:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-
-permissions:
-  actions: read
-  contents: write
-  packages: write
-
-jobs:
-  approve:
-    name: approve build release
-    permissions: {}
-    runs-on: ubuntu-24.04
-    environment: builds
-    timeout-minutes: 5
-    steps:
-      - name: approved
-        run: echo "Build release approved."
-
-  image:
-    needs: approve
-    uses: ./.github/workflows/_build-image.yaml
-    secrets: inherit
-    with:
-      image: fluxer-recon
-      dockerfile: fluxer_recon/Dockerfile
-      build-version: ${{ inputs['build-version'] }}
@@ -19,22 +19,22 @@ jobs:
    timeout-minutes: 15
    steps:
      - name: Checkout fluxer
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -35,24 +35,24 @@ jobs:
          permission-pull-requests: write

      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          token: ${{ steps.create-token.outputs.token }}
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: "24"
+          node-version: "26"
          cache: "pnpm"

      - name: Install dependencies
@@ -40,7 +40,7 @@ jobs:
          permission-pull-requests: write

      - name: Checkout Weblate branch
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          token: ${{ steps.create-token.outputs.token }}
          ref: ${{ env.WEBLATE_BRANCH }}
@@ -48,17 +48,17 @@ jobs:
          persist-credentials: false

      - name: Set up Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: "24"
+          node-version: "26"
          cache: "pnpm"

      - name: Install dependencies
@@ -19,7 +19,7 @@ jobs:
          permission-pull-requests: write

      - name: Label pull request
-        uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213
+        uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13
        with:
          repo-token: ${{ steps.create-token.outputs.token }}
          configuration-path: .github/labeller.yaml
@@ -56,15 +56,15 @@ jobs:
      contents: write
      packages: read
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -28,12 +28,12 @@ jobs:
      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

      - name: Restore ci helper
@@ -42,7 +42,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -55,16 +55,16 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -83,12 +83,12 @@ jobs:
      PNPM_TEST_WORKSPACE_CONCURRENCY: '2'
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

      - name: Restore ci helper
@@ -97,7 +97,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -105,12 +105,12 @@ jobs:
        run: cargo build --locked --package fluxer-ci

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -125,7 +125,7 @@ jobs:
            fluxer_app/pkgs/libfluxcore
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
@@ -144,7 +144,7 @@ jobs:
            fluxer_app/pkgs/libfluxcore
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
@@ -156,21 +156,21 @@ jobs:
    timeout-minutes: 45
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          components: clippy, rustfmt

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Cache cargo
@@ -185,7 +185,7 @@ jobs:
            rust-${{ runner.os }}-${{ hashFiles('fluxer_media_proxy/tools/install-native-deps.sh') }}-

      - name: Install cargo-deny
-        run: cargo install cargo-deny --version 0.19.6 --locked
+        run: cargo install cargo-deny --version 0.20.2 --locked

      - name: Check Rust dependencies
        run: cargo deny --locked check -D warnings
@@ -273,12 +273,12 @@ jobs:
      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Cache cargo (gateway NIFs)
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
@@ -294,7 +294,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -305,7 +305,7 @@ jobs:
        uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124
        with:
          otp-version: '28'
-          rebar3-version: '3.24.0'
+          rebar3-version: '3.27.0'

      - name: Restore rebar3 dependencies
        id: rebar3-cache
@@ -317,10 +317,10 @@ jobs:
            !fluxer_gateway/_build/default/lib/fluxer_gateway/**
            !fluxer_gateway/_build/test/lib/fluxer_gateway/**
          key: >-
-            rebar3-${{ runner.os }}-otp28-rebar3.24.0-${{ hashFiles('fluxer_gateway/rebar.lock',
+            rebar3-${{ runner.os }}-otp28-rebar3.27.0-${{ hashFiles('fluxer_gateway/rebar.lock',
            'fluxer_gateway/rebar.config') }}
          restore-keys: |
-            rebar3-${{ runner.os }}-otp28-rebar3.24.0-
+            rebar3-${{ runner.os }}-otp28-rebar3.27.0-

      - name: Check formatting
        run: |
@@ -348,7 +348,7 @@ jobs:
            !fluxer_gateway/_build/default/lib/fluxer_gateway/**
            !fluxer_gateway/_build/test/lib/fluxer_gateway/**
          key: >-
-            rebar3-${{ runner.os }}-otp28-rebar3.24.0-${{ hashFiles('fluxer_gateway/rebar.lock',
+            rebar3-${{ runner.os }}-otp28-rebar3.27.0-${{ hashFiles('fluxer_gateway/rebar.lock',
            'fluxer_gateway/rebar.config') }}

  knip:
@@ -358,12 +358,12 @@ jobs:
      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

      - name: Restore ci helper
@@ -372,7 +372,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -380,12 +380,12 @@ jobs:
        run: cargo build --locked --package fluxer-ci

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -400,7 +400,7 @@ jobs:
            fluxer_app/pkgs/libfluxcore
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
@@ -419,7 +419,7 @@ jobs:
            fluxer_app/pkgs/libfluxcore
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
@@ -431,15 +431,15 @@ jobs:
    timeout-minutes: 15
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -456,15 +456,15 @@ jobs:
    timeout-minutes: 25
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -490,15 +490,15 @@ jobs:
    timeout-minutes: 15
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -515,12 +515,12 @@ jobs:
    timeout-minutes: 10
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
-          python-version: "3.13"
+          python-version: "3.14"

      - name: Install font tooling
        run: python3 -m pip install -r tools/fonts/requirements.txt
@@ -15,7 +15,6 @@ members = [
 	"fluxer_users",
 	"fluxer_unfurl",
 	"packages/markdown_parser/rust",
-	"fluxer_recon",
 ]
 exclude = [
 	"packages/markdown_parser/rust/fuzz",
@@ -48,7 +48,7 @@
 	"linter": {
 		"enabled": true,
 		"rules": {
-			"recommended": true,
+			"preset": "recommended",
 			"complexity": {
 				"noForEach": "off",
 				"noImportantStyles": "off",
@@ -83,6 +83,7 @@
 					}
 				},
 				"useConst": "error",
+				"noDescendingSpecificity": "off",
 				"noNonNullAssertion": "off",
 				"noParameterAssign": "off",
 				"noRestrictedImports": {
@@ -98,7 +99,7 @@
 				}
 			},
 			"a11y": {
-				"recommended": true,
+				"preset": "recommended",
 				"useAriaPropsForRole": "error",
 				"useValidAriaRole": "error",
 				"useValidAriaValues": "error",
@@ -65,11 +65,6 @@ FLUXER_LIVEKIT_API_SECRET=fluxer-livekit-development-secret
 FLUXER_LIVEKIT_WEBHOOK_URL=http://localhost:8088/api/webhooks/livekit
 FLUXER_LIVEKIT_DEFAULT_REGION={"id":"local","name":"Local","emoji":"LC","latitude":59.3293,"longitude":18.0686}

-FLUXER_RECON_MODE=observing
-FLUXER_RECON_EXPECTED_ROOMS=64
-FLUXER_RECON_WARMUP_SECONDS=15
-FLUXER_RECON_MAX_HOT_ROOMS=8
-
 FLUXER_API_PORT=8080
 FLUXER_API_PRESIGNED_ATTACHMENT_UPLOADS_ENABLED=true
 FLUXER_API_WORKER_MODE=all_lanes
@@ -135,6 +130,7 @@ PUBLIC_RELEASE_CHANNEL=canary
 PUBLIC_BOOTSTRAP_API_ENDPOINT=/api
 PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT=http://localhost:8088/api
 FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64=Zmx1eGVyLWRldi11cGxvYWQtcmVsYXktc2VjcmV0LTAwMDA=
+FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64=Zmx1eGVyLWRldi1hdHRhY2htZW50LXVybC1zZWNyZXQ=
 AWS_EC2_METADATA_DISABLED=true
 AWS_ACCESS_KEY_ID=fluxer
 AWS_SECRET_ACCESS_KEY=fluxer-secret
@@ -79,34 +79,42 @@ deny = [
    { crate = "fuse-sys", reason = "libfuse2 FFI crate; Fluxer AppImages must not reintroduce libfuse2 through native Rust dependencies" },
 ]
 skip = [
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older crypto API" },
-    { crate = "[email protected].7", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected].6", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
-    { crate = "[email protected]", reason = "transitive dependency requires the older hashbrown API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older hashbrown API" },
-    { crate = "[email protected]", reason = "transitive dependency requires the older hashbrown API" },
-    { crate = "[email protected]", reason = "transitive dependency requires the prior hashbrown API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
    { crate = "[email protected]", reason = "transitive dependency requires the older HTTP API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older HTTP body API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
    { crate = "[email protected]", reason = "transitive dependency requires the older WASI API" },
-    { crate = "[email protected].6", reason = "transitive dependency requires the older randomness API" },
-    { crate = "[email protected].4", reason = "transitive dependency requires the prior randomness API" },
+    { crate = "[email protected].8", reason = "transitive dependency requires the older randomness API" },
+    { crate = "[email protected].5", reason = "transitive dependency requires the prior randomness API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
-    { crate = "[email protected].6", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected].7", reason = "transitive dependency requires the older digest API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
-    { crate = "s[email protected]0", reason = "transitive dependency requires the older socket API" },
+    { crate = "s[email protected].0", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
    { crate = "[email protected]+wasi-snapshot-preview1", reason = "transitive dependency requires the legacy WASI API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
    { crate = "[email protected]", reason = "transitive dependency requires the older Windows API" },
-    { crate = "[email protected]", reason = "transitive dependency requires the prior Windows API" },
-    { crate = "[email protected]", reason = "transitive dependency requires the older WASI binding API" },
 ]
 skip-tree = []

@@ -198,6 +198,36 @@ FLUXER_VAPID_PRIVATE_KEY=CHANGE_ME
 #FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS=https://chat.example.com
 #FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS=http://chat.example.com:19080

+# Two optional media policies, both off unless you turn them on. Nothing below is
+# needed for a working instance, and an upgrade never adds any of it.
+#
+# The first limits which web origins may read media through CORS. A request with
+# no Origin header is always served, so direct links, image tags and native
+# clients keep working. The allowlist defaults to the public origin above, which
+# is where this instance serves its web app. The hosted web client and the
+# desktop app run on https://web.fluxer.app, so add that origin, as in the second
+# allowlist line, if people use them with this instance.
+#
+# The second makes an attachment read need a signed URL, which stops a copied
+# link working forever elsewhere. Turning it on takes two settings: a secret, and
+# the mode. Generate the secret with openssl rand -base64 32. It is a comma
+# separated list, the first entry signs and every entry verifies. To rotate, add
+# the new secret second and run docker compose up -d, then move it first and run
+# again. Remove the old secret no sooner than a day after that, because an
+# ordinary URL it signed stays valid for up to a day. A data package URL inside a
+# harvest export never expires, so removing a secret ends every data package URL
+# it signed and those exports have to be rebuilt.
+#
+# Each mode is off, report or enforce on its own. Set a mode to report first to
+# log what enforce would refuse while refusing nothing. media-proxy reads these
+# at container start, so apply a change with docker compose up -d media-proxy.
+# docker compose restart media-proxy keeps the old environment.
+#FLUXER_MEDIA_PROXY_CORS_MODE=enforce
+#FLUXER_MEDIA_PROXY_CORS_ALLOWED_ORIGINS=https://chat.example.com
+#FLUXER_MEDIA_PROXY_CORS_ALLOWED_ORIGINS=https://chat.example.com,https://web.fluxer.app
+#FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64=
+#FLUXER_MEDIA_PROXY_ATTACHMENT_SIGNATURE_MODE=enforce
+
 # Extra Content-Security-Policy sources, appended to the built-in ones. Set these
 # only when a browser must reach an origin the defaults do not cover, such as a
 # voice server hosted on a domain other than FLUXER_DOMAIN. Separate several
@@ -97,6 +97,7 @@ x-fluxer-env: &fluxer-env
  FLUXER_GATEWAY_RPC_AUTH_TOKEN: ${FLUXER_GATEWAY_RPC_AUTH_TOKEN:?set FLUXER_GATEWAY_RPC_AUTH_TOKEN in .env}
  FLUXER_MEDIA_PROXY_SECRET_KEY: ${FLUXER_MEDIA_PROXY_SECRET_KEY:?set FLUXER_MEDIA_PROXY_SECRET_KEY in .env}
  FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64:?set FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64 in .env}
+  FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64: ${FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64:-}
  FLUXER_ADMIN_SECRET_KEY_BASE: ${FLUXER_ADMIN_SECRET_KEY_BASE:?set FLUXER_ADMIN_SECRET_KEY_BASE in .env}
  FLUXER_ADMIN_OAUTH_CLIENT_SECRET: ${FLUXER_ADMIN_OAUTH_CLIENT_SECRET:?set FLUXER_ADMIN_OAUTH_CLIENT_SECRET in .env}

@@ -122,7 +123,7 @@ x-fluxer-svc-healthcheck: &fluxer-svc-healthcheck

 services:
  edge:
-    image: caddy:2.10-alpine
+    image: caddy:2.11-alpine
    deploy:
      resources:
        limits:
@@ -200,7 +201,7 @@ services:
      retries: 10

  valkey:
-    image: valkey/valkey:8.1-alpine
+    image: valkey/valkey:9.1-alpine
    deploy:
      resources:
        limits:
@@ -236,7 +237,7 @@ services:
      retries: 10

  meilisearch:
-    image: getmeili/meilisearch:v1.12
+    image: getmeili/meilisearch:v1.53
    deploy:
      resources:
        limits:
@@ -246,6 +247,7 @@ services:
    environment:
      MEILI_ENV: production
      MEILI_NO_ANALYTICS: "true"
+      MEILI_UPGRADE_DB: "true"
      MEILI_MAX_INDEXING_MEMORY: ${FLUXER_MEILISEARCH_MAX_INDEXING_MEMORY:-384mb}
      MEILI_MASTER_KEY: ${MEILI_MASTER_KEY:?set MEILI_MASTER_KEY in .env}
    volumes:
@@ -257,7 +259,7 @@ services:
      retries: 10

  seaweedfs:
-    image: chrislusf/seaweedfs:4.34
+    image: chrislusf/seaweedfs:4.47
    deploy:
      resources:
        limits:
@@ -266,7 +268,7 @@ services:
    networks: [fluxer]
    environment:
      GOMEMLIMIT: ${FLUXER_SEAWEEDFS_GOMEMLIMIT:-1536MiB}
-    command: ["server", "-s3", "-dir=/data"]
+    command: ["server", "-s3", "-dir=/data", "-master.telemetry=false"]
    volumes:
      - seaweedfs-data:/data
    healthcheck:
@@ -277,7 +279,7 @@ services:
      start_period: 60s

  seaweedfs-init:
-    image: chrislusf/seaweedfs:4.34
+    image: chrislusf/seaweedfs:4.47
    deploy:
      resources:
        limits:
@@ -413,7 +415,6 @@ services:
      NODE_OPTIONS: --enable-source-maps${FLUXER_WORKER_NODE_HEAP_MB:+ --max-old-space-size=$FLUXER_WORKER_NODE_HEAP_MB}
      FLUXER_API_WORKER_MODE: all_lanes
      FLUXER_API_WORKER_ENABLE_CRON_SCHEDULER: "true"
-      FLUXER_API_WORKER_ENABLE_VOICE_RECONCILIATION: "true"
      FLUXER_POSTGRES_MAX_CONNECTIONS: "25"
    healthcheck:
      test: ["CMD", "node", "-e", "const age=Date.now()-require('node:fs').statSync('/tmp/fluxer-worker-heartbeat').mtimeMs;if(age>30000){console.error('worker heartbeat is '+Math.round(age)+'ms old');process.exit(1)}"]
@@ -473,6 +474,9 @@ services:
      FLUXER_MEDIA_PROXY_MODE: upload
      FLUXER_MEDIA_PROXY_STORAGE_BACKEND: s3
      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+      FLUXER_MEDIA_PROXY_CORS_MODE: ${FLUXER_MEDIA_PROXY_CORS_MODE:-off}
+      FLUXER_MEDIA_PROXY_CORS_ALLOWED_ORIGINS: ${FLUXER_MEDIA_PROXY_CORS_ALLOWED_ORIGINS:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}:${FLUXER_PUBLIC_PORT:-443}}}
+      FLUXER_MEDIA_PROXY_ATTACHMENT_SIGNATURE_MODE: ${FLUXER_MEDIA_PROXY_ATTACHMENT_SIGNATURE_MODE:-off}
      FLUXER_S3_READ_SIGNED: "true"
    depends_on:
      seaweedfs-init: {condition: service_completed_successfully}
@@ -9,32 +9,32 @@ build = "build.rs"
 [dependencies]
 anyhow = "1.0.104"
 axum = { version = "0.8.9", features = ["macros"] }
-base64 = "0.22.1"
+base64 = "0.23.1"
 chrono = { version = "0.4", default-features = false, features = ["serde"] }
-cookie = "0.18.1"
+cookie = "0.18.2"
 fluxer_common = { path = "../fluxer_common" }
 hmac = "0.13.0"
 maud = { version = "0.27.0", features = ["axum"] }
 rand = "0.10"
-regress = "0.11"
-reqwest = { version = "0.13.4", default-features = false, features = ["json", "rustls"] }
-serde = { version = "1.0.228", features = ["derive"] }
-serde_json = "1.0.150"
+regress = "0.12"
+reqwest = { version = "0.13.5", default-features = false, features = ["json", "rustls"] }
+serde = { version = "1.0.229", features = ["derive"] }
+serde_json = "1.0.151"
 sha2 = "0.11.0"
-time = { version = "0.3.47", features = ["formatting", "parsing"] }
-tokio = { version = "1.52.3", features = ["macros", "net", "rt-multi-thread", "signal"] }
+time = { version = "0.3.55", features = ["formatting", "parsing"] }
+tokio = { version = "1.53.1", features = ["macros", "net", "rt-multi-thread", "signal"] }
 tower = { version = "0.5.3", features = ["util"] }
-tower-http = { version = "0.6.11", features = ["compression-gzip", "trace"] }
+tower-http = { version = "0.7.1", features = ["compression-gzip", "trace"] }
 tracing = "0.1.44"
 tracing-subscriber = { version = "0.3.23", features = ["env-filter"] }
 url = "2.5"
 urlencoding = "2.1.3"
-progenitor-client = { version = "0.14.0", default-features = false }
+progenitor-client = { version = "0.15.0", default-features = false }

 [build-dependencies]
 openapiv3 = "2.2.0"
-prettyplease = "0.2"
-progenitor = { version = "0.14.0", default-features = false }
+prettyplease = "0.3"
+progenitor = { version = "0.15.0", default-features = false }
 serde_json = "1"
 sha2 = "0.11.0"
-syn = "2"
+syn = "3"
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later

-FROM rust:1-bookworm AS builder
+FROM rust:1-trixie AS builder

 ARG BUILD_VERSION=""
 ARG TARGETARCH
@@ -9,7 +9,7 @@ WORKDIR /usr/src/app

 RUN apt-get update \
 	&& apt-get install -y --no-install-recommends ca-certificates nodejs npm pkg-config \
-	&& npm install -g pnpm@10.29.3 \
+	&& npm install -g pnpm@12.4.2 \
 	&& rm -rf /var/lib/apt/lists/*

 RUN npm install --no-audit --no-fund @tailwindcss/[email protected] [email protected]
@@ -57,7 +57,7 @@ RUN test "$(ls target/release/build/fluxer_admin-*/out/static/fonts/*.woff2 | wc
 	&& ls target/release/build/fluxer_admin-*/out/static/fonts/fonts.*.css \
 	&& echo "Latin-core fonts bundled successfully"

-FROM debian:bookworm-slim AS runtime
+FROM debian:trixie-slim AS runtime

 ARG BUILD_VERSION=""
 ARG SOURCE_SHA=""
@@ -54,9 +54,9 @@ fn generate_admin_api(manifest_dir: &Path, out_dir: &Path) {
        .generate_tokens(&spec)
        .expect("failed to generate admin API client");

-    let content = prettyplease::unparse(
+    let content = relax_required_nullable_fields(&prettyplease::unparse(
        &syn::parse2::<syn::File>(tokens).expect("failed to parse generated tokens"),
-    );
+    ));

    let output_path = out_dir.join("admin_api_generated.rs");
    fs::write(&output_path, content).expect("failed to write generated API code");
@@ -190,6 +190,16 @@ fn object_schema_mut<'a>(

 const MAX_SCHEMA_REFERENCE_DEPTH: usize = 32;

+fn relax_required_nullable_fields(generated: &str) -> String {
+    const PRESENCE_CHECK: &str =
+        "#[serde(deserialize_with = \"::std::option::Option::deserialize\")]";
+    generated
+        .lines()
+        .filter(|line| line.trim() != PRESENCE_CHECK)
+        .flat_map(|line| [line, "\n"])
+        .collect()
+}
+
 fn relax_progenitor_schema_strictness(spec: &mut openapiv3::OpenAPI) {
    let registry = spec.components.clone().unwrap_or_default();

@@ -933,6 +933,22 @@
 						},
 						"description": "Filter by target entity ID (user, channel, role, invite code, etc.)"
 					},
+					{
+						"name": "access",
+						"in": "query",
+						"required": false,
+						"schema": {
+							"description": "Only return entries recorded by reads or only entries recorded by writes",
+							"x-enumNames": ["read", "write"],
+							"x-enumDescriptions": [
+								"An entry recorded by an operation that only reads data",
+								"An entry recorded by an operation that changes data or triggers work"
+							],
+							"enum": ["read", "write"],
+							"type": "string"
+						},
+						"description": "Only return entries recorded by reads or only entries recorded by writes"
+					},
 					{
 						"name": "sort_by",
 						"in": "query",
@@ -5427,59 +5443,6 @@
 				}
 			}
 		},
-		"/admin/system/heap-snapshots": {
-			"post": {
-				"operationId": "create_admin_system_heap_snapshot",
-				"summary": "Create a V8 heap snapshot",
-				"tags": ["Admin"],
-				"responses": {
-					"200": {
-						"description": "Success",
-						"content": {"application/octet-stream": {"schema": {"$ref": "#/components/schemas/HeapSnapshotResponse"}}}
-					},
-					"400": {
-						"description": "Bad Request - The request was malformed or contained invalid data",
-						"content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}}}
-					},
-					"401": {
-						"description": "Unauthorized - Authentication is required or the token is invalid",
-						"content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}}}
-					},
-					"403": {
-						"description": "Forbidden - You do not have permission to perform this action",
-						"content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}}}
-					},
-					"429": {
-						"description": "Too Many Requests - You are being rate limited",
-						"content": {"application/json": {"schema": {"$ref": "#/components/schemas/ThrottledError"}}},
-						"headers": {
-							"Retry-After": {
-								"description": "Number of seconds to wait before retrying (only on 429)",
-								"schema": {"type": "integer"}
-							},
-							"X-RateLimit-Limit": {
-								"description": "The number of requests that can be made in the current window",
-								"schema": {"type": "integer"}
-							},
-							"X-RateLimit-Remaining": {
-								"description": "The number of remaining requests that can be made",
-								"schema": {"type": "integer"}
-							},
-							"X-RateLimit-Reset": {
-								"description": "Unix timestamp when the rate limit resets",
-								"schema": {"type": "integer"}
-							}
-						}
-					},
-					"500": {
-						"description": "Internal Server Error - An unexpected error occurred",
-						"content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}}}
-					}
-				},
-				"description": "Writes a V8 heap snapshot of the current process and returns the snapshot file. Used for diagnosing memory leaks. Requires SYSTEM_HEAP_SNAPSHOT permission.",
-				"security": [{"adminApiKey": []}]
-			}
-		},
 		"/admin/users": {
 			"get": {
 				"operationId": "list_admin_users",
@@ -9874,7 +9837,7 @@
 				"type": "object",
 				"properties": {
 					"acls": {
-						"maxItems": 112,
+						"maxItems": 111,
 						"type": "array",
 						"items": {"$ref": "#/components/schemas/AdminAclType"},
 						"description": "List of access control permissions to assign"
@@ -9904,7 +9867,6 @@
 				"required": ["users", "total"],
 				"additionalProperties": false
 			},
-			"HeapSnapshotResponse": {"type": "string", "format": "binary", "description": "V8 heap snapshot file"},
 			"SendSystemDmRequest": {
 				"type": "object",
 				"properties": {
@@ -10579,13 +10541,13 @@
 										"created_at": {
 											"type": "string",
 											"format": "date-time",
-											"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+											"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 										},
 										"expires_at": {
 											"nullable": true,
 											"type": "string",
 											"format": "date-time",
-											"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+											"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 										},
 										"max_uses": {"nullable": true, "type": "integer", "minimum": 1, "maximum": 9007199254740991},
 										"use_count": {"type": "integer", "minimum": 0, "maximum": 9007199254740991},
@@ -10593,14 +10555,14 @@
 											"nullable": true,
 											"type": "string",
 											"format": "date-time",
-											"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+											"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 										},
 										"approval_required": {"type": "boolean"},
 										"last_used_at": {
 											"nullable": true,
 											"type": "string",
 											"format": "date-time",
-											"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+											"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 										},
 										"last_used_by_user_id": {
 											"nullable": true,
@@ -10636,7 +10598,7 @@
 										"requested_at": {
 											"type": "string",
 											"format": "date-time",
-											"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+											"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 										},
 										"registration_url_id": {"nullable": true, "type": "string", "minLength": 1, "maxLength": 128},
 										"client_ip": {"nullable": true, "type": "string"}
@@ -10671,7 +10633,9 @@
 									"logo_url": {"nullable": true, "type": "string"},
 									"wordmark_url": {"nullable": true, "type": "string"},
 									"favicon_url": {"nullable": true, "type": "string"},
-									"theme_color": {"nullable": true, "type": "string"}
+									"theme_color": {"nullable": true, "type": "string"},
+									"status_page_url": {"nullable": true, "type": "string"},
+									"status_page_incident_history_url": {"nullable": true, "type": "string"}
 								},
 								"required": [
 									"product_name",
@@ -10680,7 +10644,9 @@
 									"logo_url",
 									"wordmark_url",
 									"favicon_url",
-									"theme_color"
+									"theme_color",
+									"status_page_url",
+									"status_page_incident_history_url"
 								],
 								"additionalProperties": false
 							},
@@ -10889,12 +10855,14 @@
 									"min_lifetime_days": {
 										"nullable": true,
 										"type": "integer",
+										"minimum": 0,
 										"exclusiveMinimum": true,
 										"maximum": 9007199254740991
 									},
 									"max_lifetime_days": {
 										"nullable": true,
 										"type": "integer",
+										"minimum": 0,
 										"exclusiveMinimum": true,
 										"maximum": 9007199254740991
 									},
@@ -10902,12 +10870,14 @@
 									"renew_threshold_days": {
 										"nullable": true,
 										"type": "integer",
+										"minimum": 0,
 										"exclusiveMinimum": true,
 										"maximum": 9007199254740991
 									},
 									"renew_window_days": {
 										"nullable": true,
 										"type": "integer",
+										"minimum": 0,
 										"exclusiveMinimum": true,
 										"maximum": 9007199254740991
 									},
@@ -10918,15 +10888,31 @@
 											"min_size_mb": {"type": "number", "minimum": 0, "exclusiveMinimum": true},
 											"max_size_mb": {"type": "number", "minimum": 0, "exclusiveMinimum": true},
 											"max_eligible_size_mb": {"type": "number", "minimum": 0, "exclusiveMinimum": true},
-											"min_lifetime_days": {"type": "integer", "exclusiveMinimum": true, "maximum": 9007199254740991},
-											"max_lifetime_days": {"type": "integer", "exclusiveMinimum": true, "maximum": 9007199254740991},
-											"curve": {"type": "number", "minimum": 0, "maximum": 1},
-											"renew_threshold_days": {
+											"min_lifetime_days": {
 												"type": "integer",
+												"minimum": 0,
 												"exclusiveMinimum": true,
 												"maximum": 9007199254740991
 											},
-											"renew_window_days": {"type": "integer", "exclusiveMinimum": true, "maximum": 9007199254740991}
+											"max_lifetime_days": {
+												"type": "integer",
+												"minimum": 0,
+												"exclusiveMinimum": true,
+												"maximum": 9007199254740991
+											},
+											"curve": {"type": "number", "minimum": 0, "maximum": 1},
+											"renew_threshold_days": {
+												"type": "integer",
+												"minimum": 0,
+												"exclusiveMinimum": true,
+												"maximum": 9007199254740991
+											},
+											"renew_window_days": {
+												"type": "integer",
+												"minimum": 0,
+												"exclusiveMinimum": true,
+												"maximum": 9007199254740991
+											}
 										},
 										"required": [
 											"enabled",
@@ -10983,7 +10969,7 @@
 						"nullable": true,
 						"type": "string",
 						"format": "date-time",
-						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 					},
 					"max_uses": {"nullable": true, "type": "integer", "minimum": 1, "maximum": 1000000},
 					"approval_required": {"default": false, "type": "boolean"}
@@ -11001,13 +10987,13 @@
 							"created_at": {
 								"type": "string",
 								"format": "date-time",
-								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 							},
 							"expires_at": {
 								"nullable": true,
 								"type": "string",
 								"format": "date-time",
-								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 							},
 							"max_uses": {"nullable": true, "type": "integer", "minimum": 1, "maximum": 9007199254740991},
 							"use_count": {"type": "integer", "minimum": 0, "maximum": 9007199254740991},
@@ -11015,14 +11001,14 @@
 								"nullable": true,
 								"type": "string",
 								"format": "date-time",
-								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 							},
 							"approval_required": {"type": "boolean"},
 							"last_used_at": {
 								"nullable": true,
 								"type": "string",
 								"format": "date-time",
-								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 							},
 							"last_used_by_user_id": {
 								"nullable": true,
@@ -11144,7 +11130,9 @@
 									"logo_url": {"nullable": true, "type": "string", "maxLength": 2048},
 									"wordmark_url": {"nullable": true, "type": "string", "maxLength": 2048},
 									"favicon_url": {"nullable": true, "type": "string", "maxLength": 2048},
-									"theme_color": {"nullable": true, "type": "string", "maxLength": 64}
+									"theme_color": {"nullable": true, "type": "string", "maxLength": 64},
+									"status_page_url": {"nullable": true, "type": "string", "maxLength": 2048},
+									"status_page_incident_history_url": {"nullable": true, "type": "string", "maxLength": 2048}
 								}
 							},
 							"setup": {"nullable": true, "type": "object", "properties": {"configured": {"type": "boolean"}}},
@@ -11254,12 +11242,14 @@
 									"min_lifetime_days": {
 										"nullable": true,
 										"type": "integer",
+										"minimum": 0,
 										"exclusiveMinimum": true,
 										"maximum": 9007199254740991
 									},
 									"max_lifetime_days": {
 										"nullable": true,
 										"type": "integer",
+										"minimum": 0,
 										"exclusiveMinimum": true,
 										"maximum": 9007199254740991
 									},
@@ -11267,12 +11257,14 @@
 									"renew_threshold_days": {
 										"nullable": true,
 										"type": "integer",
+										"minimum": 0,
 										"exclusiveMinimum": true,
 										"maximum": 9007199254740991
 									},
 									"renew_window_days": {
 										"nullable": true,
 										"type": "integer",
+										"minimum": 0,
 										"exclusiveMinimum": true,
 										"maximum": 9007199254740991
 									}
@@ -11304,7 +11296,7 @@
 								"properties": {
 									"enabled": {"type": "boolean"},
 									"window_hours": {"type": "number", "minimum": 0, "exclusiveMinimum": true, "maximum": 8760},
-									"member_threshold": {"type": "integer", "exclusiveMinimum": true, "maximum": 1000000}
+									"member_threshold": {"type": "integer", "minimum": 0, "exclusiveMinimum": true, "maximum": 1000000}
 								}
 							}
 						}
@@ -12621,6 +12613,16 @@
 						}
 					},
 					"action": {"type": "string", "minLength": 1, "maxLength": 256},
+					"access": {
+						"description": "Whether the recorded operation read data or changed it",
+						"x-enumNames": ["read", "write"],
+						"x-enumDescriptions": [
+							"An entry recorded by an operation that only reads data",
+							"An entry recorded by an operation that changes data or triggers work"
+						],
+						"enum": ["read", "write"],
+						"type": "string"
+					},
 					"audit_log_reason": {"nullable": true, "type": "string", "minLength": 1, "maxLength": 4000},
 					"metadata": {"type": "object", "additionalProperties": {"type": "string", "maxLength": 4000}},
 					"created_at": {"type": "string"}
@@ -12638,6 +12640,7 @@
 					"related_guilds",
 					"related_channels",
 					"action",
+					"access",
 					"audit_log_reason",
 					"metadata",
 					"created_at"
@@ -12726,7 +12729,7 @@
 					},
 					"acls": {
 						"description": "Replacement list of access control permissions for the key",
-						"maxItems": 112,
+						"maxItems": 111,
 						"type": "array",
 						"items": {"$ref": "#/components/schemas/AdminAclType"}
 					}
@@ -12744,7 +12747,7 @@
 						"type": "string"
 					},
 					"acls": {
-						"maxItems": 112,
+						"maxItems": 111,
 						"type": "array",
 						"items": {"type": "string"},
 						"description": "List of access control permissions for the key"
@@ -12774,7 +12777,7 @@
 						"maximum": 365
 					},
 					"acls": {
-						"maxItems": 112,
+						"maxItems": 111,
 						"type": "array",
 						"items": {"$ref": "#/components/schemas/AdminAclType"},
 						"description": "List of access control permissions for the key"
@@ -12795,7 +12798,7 @@
 						"type": "string"
 					},
 					"acls": {
-						"maxItems": 112,
+						"maxItems": 111,
 						"type": "array",
 						"items": {"type": "string"},
 						"description": "List of access control permissions for the key"
@@ -12808,7 +12811,7 @@
 				"type": "object",
 				"properties": {
 					"acls": {
-						"maxItems": 112,
+						"maxItems": 111,
 						"type": "array",
 						"items": {"type": "string", "minLength": 1, "maxLength": 64},
 						"description": "Every admin access control permission the admin API recognises"
@@ -12899,7 +12902,6 @@
 					"report:view",
 					"report:view:reporter_pii",
 					"system_dm:send",
-					"system:heap_snapshot",
 					"user:cancel:bulk_message_deletion",
 					"user:delete",
 					"user:disable:suspicious",
@@ -13011,14 +13013,14 @@
 						"description": "ISO 8601 timestamp when the bot token was created",
 						"type": "string",
 						"format": "date-time",
-						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 					},
 					"client_secret_created_at": {
 						"nullable": true,
 						"description": "ISO 8601 timestamp when the client secret was created",
 						"type": "string",
 						"format": "date-time",
-						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 					},
 					"version": {
 						"description": "The optimistic locking version of the application record",
@@ -13446,7 +13448,7 @@
 					"timestamp": {
 						"type": "string",
 						"format": "date-time",
-						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$",
 						"description": "The ISO 8601 timestamp of when the message was created"
 					},
 					"edited_timestamp": {
@@ -13454,7 +13456,7 @@
 						"nullable": true,
 						"type": "string",
 						"format": "date-time",
-						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 					},
 					"pinned": {"type": "boolean", "description": "Whether the message is pinned"},
 					"mention_everyone": {"type": "boolean", "description": "Whether the message mentions @everyone"},
@@ -13554,7 +13556,7 @@
 								"nullable": true,
 								"type": "string",
 								"format": "date-time",
-								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 							}
 						},
 						"required": ["participants"],
@@ -13591,7 +13593,7 @@
 							"timestamp": {
 								"type": "string",
 								"format": "date-time",
-								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
+								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$",
 								"description": "The ISO 8601 timestamp of when the message was created"
 							},
 							"edited_timestamp": {
@@ -13599,7 +13601,7 @@
 								"nullable": true,
 								"type": "string",
 								"format": "date-time",
-								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 							},
 							"pinned": {"type": "boolean", "description": "Whether the message is pinned"},
 							"mention_everyone": {"type": "boolean", "description": "Whether the message mentions @everyone"},
@@ -13699,7 +13701,7 @@
 										"nullable": true,
 										"type": "string",
 										"format": "date-time",
-										"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+										"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 									}
 								},
 								"required": ["participants"],
@@ -13863,7 +13865,7 @@
 					"timestamp": {
 						"type": "string",
 						"format": "date-time",
-						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$",
 						"description": "The ISO 8601 timestamp of when the original message was created"
 					},
 					"edited_timestamp": {
@@ -13871,7 +13873,7 @@
 						"nullable": true,
 						"type": "string",
 						"format": "date-time",
-						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 					},
 					"mentions": {
 						"description": "The user IDs mentioned in the snapshot",
@@ -14040,7 +14042,7 @@
 						"nullable": true,
 						"type": "string",
 						"format": "date-time",
-						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 					},
 					"description": {"description": "The description of the embed", "nullable": true, "type": "string"},
 					"author": {
@@ -14252,7 +14254,7 @@
 						"nullable": true,
 						"type": "string",
 						"format": "date-time",
-						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 					},
 					"description": {"description": "The description of the embed", "nullable": true, "type": "string"},
 					"author": {
@@ -15124,7 +15126,7 @@
 					"joined_at": {
 						"type": "string",
 						"format": "date-time",
-						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$",
 						"description": "ISO8601 timestamp of when the user joined the guild"
 					},
 					"mute": {"type": "boolean", "description": "Whether the member is muted in voice channels"},
@@ -15134,7 +15136,7 @@
 						"nullable": true,
 						"type": "string",
 						"format": "date-time",
-						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 					},
 					"profile_flags": {"nullable": true, "allOf": [{"$ref": "#/components/schemas/GuildMemberProfileFlags"}]},
 					"mention_flags": {
@@ -15438,7 +15440,7 @@
 					"pending_bulk_message_deletion_at": {"nullable": true, "type": "string"},
 					"deletion_reason_code": {"nullable": true, "allOf": [{"$ref": "#/components/schemas/Int32Type"}]},
 					"deletion_public_reason": {"nullable": true, "type": "string"},
-					"acls": {"maxItems": 112, "type": "array", "items": {"type": "string"}},
+					"acls": {"maxItems": 111, "type": "array", "items": {"type": "string"}},
 					"traits": {"maxItems": 100, "type": "array", "items": {"type": "string"}},
 					"has_totp": {"type": "boolean"},
 					"authenticator_types": {"maxItems": 10, "type": "array", "items": {"$ref": "#/components/schemas/Int32Type"}},
@@ -79,7 +79,6 @@ pub const REPORT_RESOLVE: &str = "report:resolve";
 pub const REPORT_VIEW: &str = "report:view";
 pub const REPORT_VIEW_REPORTER_PII: &str = "report:view:reporter_pii";
 pub const SYSTEM_DM_SEND: &str = "system_dm:send";
-pub const SYSTEM_HEAP_SNAPSHOT: &str = "system:heap_snapshot";
 pub const USER_CANCEL_BULK_MESSAGE_DELETION: &str = "user:cancel:bulk_message_deletion";
 pub const USER_DELETE: &str = "user:delete";
 pub const USER_DISABLE_SUSPICIOUS: &str = "user:disable:suspicious";
@@ -192,7 +191,6 @@ pub const ALL_ACLS: &[&str] = &[
    REPORT_VIEW,
    REPORT_VIEW_REPORTER_PII,
    SYSTEM_DM_SEND,
-    SYSTEM_HEAP_SNAPSHOT,
    USER_CANCEL_BULK_MESSAGE_DELETION,
    USER_DELETE,
    USER_DISABLE_SUSPICIOUS,
@@ -10,6 +10,7 @@ pub struct SearchAuditLogsParams {
    pub admin_user_id: Option<String>,
    pub target_id: Option<String>,
    pub target_type: Option<String>,
+    pub access: Option<String>,
    pub sort_by: Option<String>,
    pub sort_order: Option<String>,
    pub limit: u32,
@@ -21,6 +22,12 @@ impl AdminApiClient {
        &self,
        params: &SearchAuditLogsParams,
    ) -> ApiResult<AuditLogsListResponse> {
+        let access = params
+            .access
+            .as_deref()
+            .map(audit_access)
+            .transpose()?
+            .map(|value| value.to_string());
        let sort_by = params
            .sort_by
            .as_deref()
@@ -46,6 +53,7 @@ impl AdminApiClient {
                params.target_type.as_deref().unwrap_or_default(),
            ),
            ("target_id", params.target_id.as_deref().unwrap_or_default()),
+            ("access", access.as_deref().unwrap_or_default()),
            ("sort_by", sort_by.as_deref().unwrap_or_default()),
            ("sort_order", sort_order.as_deref().unwrap_or_default()),
            ("limit", limit.as_str()),
@@ -55,6 +63,11 @@ impl AdminApiClient {
    }
 }

+fn audit_access(value: &str) -> ApiResult<generated_types::ListAdminAuditLogsAccess> {
+    generated_types::ListAdminAuditLogsAccess::try_from(value)
+        .map_err(|e| ApiError::Parse(e.to_string()))
+}
+
 fn audit_sort_by(value: &str) -> ApiResult<generated_types::ListAdminAuditLogsSortBy> {
    let value = match value {
        "created_at" => "createdAt",
@@ -83,6 +96,13 @@ mod tests {
        assert_eq!(audit_sort_order("desc").unwrap().to_string(), "desc");
    }

+    #[test]
+    fn accepts_only_known_access_filters() {
+        assert_eq!(audit_access("read").unwrap().to_string(), "read");
+        assert_eq!(audit_access("write").unwrap().to_string(), "write");
+        assert!(audit_access("all").is_err());
+    }
+
    #[test]
    fn rejects_lossy_audit_totals() {
        for total in [serde_json::json!(1.5), serde_json::json!(-1)] {
@@ -99,6 +119,7 @@ mod tests {
                "admin_user_id": "234567890123456789",
                "admin_user": null,
                "action": "USER_UPDATE",
+                "access": "write",
                "target_id": "345678901234567890",
                "target_type": "user",
                "target_user": null,
@@ -118,6 +139,26 @@ mod tests {
        assert_eq!(generated.logs[0].action.to_string(), "USER_UPDATE");

        let response: AuditLogsListResponse = serde_json::from_value(json.clone()).unwrap();
+        assert_eq!(response.logs[0].access.as_deref(), Some("write"));
        assert_eq!(serde_json::to_value(response).unwrap(), json);
    }
+
+    #[test]
+    fn deserializes_audit_entries_from_an_api_without_access() {
+        let json = serde_json::json!({
+            "logs": [{
+                "log_id": "123456789012345678",
+                "admin_user_id": "234567890123456789",
+                "action": "USER_UPDATE",
+                "target_id": "345678901234567890",
+                "target_type": "user",
+                "audit_log_reason": null,
+                "metadata": {},
+                "created_at": "2026-09-11T12:00:00.000Z"
+            }],
+            "total": 1
+        });
+        let response: AuditLogsListResponse = serde_json::from_value(json).unwrap();
+        assert_eq!(response.logs[0].access, None);
+    }
 }
@@ -14,8 +14,8 @@ impl AdminApiClient {
        audit_log_reason: Option<&str>,
    ) -> ApiResult<BulkJobResponse> {
        let body = generated_types::AdminBulkJobCreateRequest::UpdateUserFlags {
-            add_flags: user_flags(add_flags),
-            remove_flags: user_flags(remove_flags),
+            add_flags: user_flags(add_flags)?,
+            remove_flags: user_flags(remove_flags)?,
            user_ids: snowflakes(user_ids),
        };
        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
@@ -112,11 +112,13 @@ fn snowflakes(values: &[String]) -> Vec<generated_types::SnowflakeType> {
    values.iter().map(|value| snowflake(value)).collect()
 }

-fn user_flags(values: &[String]) -> Vec<generated_types::UserFlags> {
+fn user_flags(values: &[String]) -> ApiResult<Vec<generated_types::UserFlags>> {
    values
        .iter()
-        .cloned()
-        .map(generated_types::UserFlags::from)
+        .map(|value| {
+            generated_types::UserFlags::try_from(value.as_str())
+                .map_err(|error| ApiError::Parse(error.to_string()))
+        })
        .collect()
 }

@@ -9,6 +9,8 @@ pub struct AuditLogEntry {
    #[serde(default)]
    pub admin_user: Option<AuditLogUserSummary>,
    pub action: String,
+    #[serde(default)]
+    pub access: Option<String>,
    pub target_id: String,
    pub target_type: String,
    #[serde(default)]
@@ -326,6 +326,8 @@ pub struct AppBrandingConfigResponse {
    pub wordmark_url: Option<String>,
    pub favicon_url: Option<String>,
    pub theme_color: Option<String>,
+    pub status_page_url: Option<String>,
+    pub status_page_incident_history_url: Option<String>,
 }

 impl Default for AppBrandingConfigResponse {
@@ -338,6 +340,8 @@ impl Default for AppBrandingConfigResponse {
            wordmark_url: None,
            favicon_url: None,
            theme_color: None,
+            status_page_url: None,
+            status_page_incident_history_url: None,
        }
    }
 }
@@ -858,6 +862,10 @@ pub struct AppBrandingConfigUpdateRequest {
    pub favicon_url: Option<Option<String>>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub theme_color: Option<Option<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status_page_url: Option<Option<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status_page_incident_history_url: Option<Option<String>>,
 }

 #[derive(Clone, Debug, Default, Serialize)]
@@ -95,8 +95,8 @@ impl AdminApiClient {
        remove_flags: &[String],
    ) -> ApiResult<AdminUser> {
        let body = generated_types::AdminUserFlagsUpdateRequest {
-            add_flags: user_flags(add_flags),
-            remove_flags: user_flags(remove_flags),
+            add_flags: user_flags(add_flags)?,
+            remove_flags: user_flags(remove_flags)?,
        };
        let response = self
            .generated()
@@ -567,11 +567,13 @@ fn bool_param(value: bool) -> &'static str {
    if value { "true" } else { "false" }
 }

-fn user_flags(values: &[String]) -> Vec<generated_types::UserFlags> {
+fn user_flags(values: &[String]) -> ApiResult<Vec<generated_types::UserFlags>> {
    values
        .iter()
-        .cloned()
-        .map(generated_types::UserFlags::from)
+        .map(|value| {
+            generated_types::UserFlags::try_from(value.as_str())
+                .map_err(|error| ApiError::Parse(error.to_string()))
+        })
        .collect()
 }

@@ -121,6 +121,7 @@ pub async fn render(
                    admin_user_id: None,
                    target_id: Some(guild_id.to_owned()),
                    target_type: Some("guild".to_owned()),
+                    access: Some("write".to_owned()),
                    sort_by: Some("created_at".to_owned()),
                    sort_order: Some("desc".to_owned()),
                    limit: 50,
@@ -134,7 +135,7 @@ pub async fn render(
                    @if let Some(resp) = resp {
                        @if resp.logs.is_empty() {
                            p class="text-sm text-neutral-500" {
-                                "No admin audit log entries for this guild."
+                                "No admin write actions have been recorded for this guild."
                            }
                        } @else {
                            (table_container(table(maud::html! {
@@ -28,6 +28,7 @@ struct AuditLogsQuery {
    admin_user_id: Option<String>,
    target_id: Option<String>,
    target_type: Option<String>,
+    access: Option<String>,
    sort_by: Option<String>,
    sort_order: Option<String>,
    limit: Option<u32>,
@@ -119,6 +120,7 @@ async fn audit_logs_page(
        admin_user_id: query.admin_user_id.as_deref().unwrap_or(""),
        target_id: query.target_id.as_deref().unwrap_or(""),
        target_type: query.target_type.as_deref().unwrap_or(""),
+        access: query.access.as_deref().unwrap_or(""),
        sort_by: query.sort_by.as_deref().unwrap_or("createdAt"),
        sort_order: query.sort_order.as_deref().unwrap_or("desc"),
        limit,
@@ -131,6 +133,7 @@ async fn audit_logs_page(
        admin_user_id: nonempty(params.admin_user_id),
        target_id: nonempty(params.target_id),
        target_type: nonempty(params.target_type),
+        access: nonempty(params.access),
        sort_by: Some(params.sort_by.to_owned()),
        sort_order: Some(params.sort_order.to_owned()),
        limit,
@@ -683,6 +683,8 @@ fn build_app_public_update(form: &MultiValueForm) -> InstanceConfigUpdateRequest
                wordmark_url: optional("app_wordmark_url"),
                favicon_url: optional("app_favicon_url"),
                theme_color: optional("app_theme_color"),
+                status_page_url: optional("app_status_page_url"),
+                status_page_incident_history_url: optional("app_status_page_incident_history_url"),
            }),
            setup: Some(AppSetupConfigUpdateRequest {
                configured: Some(form.bool_value("app_setup_configured")),
@@ -245,6 +245,7 @@ pub async fn render(
                    admin_user_id: None,
                    target_id: Some(user_id.to_owned()),
                    target_type: None,
+                    access: Some("write".to_owned()),
                    sort_by: Some("created_at".to_owned()),
                    sort_order: Some("desc".to_owned()),
                    limit,
@@ -72,7 +72,7 @@ pub fn audit_logs_for_target(
    let total_pages = total.div_ceil(u64::from(PAGE_SIZE)).max(1);
    let page_number = u64::from(current_page) + 1;
    let all_logs_href = format!(
-        "{base_path}/audit-logs?target_id={}",
+        "{base_path}/audit-logs?target_id={}&access=write",
        urlencoding::encode(target_id)
    );

@@ -94,7 +94,7 @@ pub fn audit_logs_for_target(
                    }
                }
                @if entries.is_empty() {
-                    (empty_state("No admin actions have been recorded against this entity."))
+                    (empty_state("No admin write actions have been recorded against this entity."))
                } @else {
                    (table_container(html! {
                        (table(html! {
@@ -22,6 +22,7 @@ pub struct AuditLogsParams<'a> {
    pub admin_user_id: &'a str,
    pub target_id: &'a str,
    pub target_type: &'a str,
+    pub access: &'a str,
    pub sort_by: &'a str,
    pub sort_order: &'a str,
    pub limit: u32,
@@ -42,6 +43,11 @@ fn filters_section(base: &str, params: &AuditLogsParams<'_>) -> Markup {
        ("file_sha", "File SHA"),
        ("email", "Email"),
    ];
+    let access_options: &[(&str, &str)] = &[
+        ("", "All entries"),
+        ("write", "Writes only"),
+        ("read", "Reads only"),
+    ];
    let sort_options: &[(&str, &str)] = &[("createdAt", "Created at"), ("relevance", "Relevance")];
    let order_options: &[(&str, &str)] = &[("desc", "Newest first"), ("asc", "Oldest first")];
    let limit_options: &[(&str, &str)] =
@@ -60,6 +66,7 @@ fn filters_section(base: &str, params: &AuditLogsParams<'_>) -> Markup {
                    "Filter by admin user ID..."))
                (select_input("target_type", "Target type",
                    target_type_options, params.target_type))
+                (select_input("access", "Access", access_options, params.access))
                (select_input("sort_by", "Sort by", sort_options, params.sort_by))
                (select_input("sort_order", "Order", order_options, params.sort_order))
                (select_input("limit", "Page size", limit_options, &limit_str))
@@ -81,6 +88,7 @@ fn build_pagination_url(base: &str, page: u32, params: &AuditLogsParams<'_>) ->
            ("admin_user_id", params.admin_user_id),
            ("target_id", params.target_id),
            ("target_type", params.target_type),
+            ("access", params.access),
            ("sort_by", params.sort_by),
            ("sort_order", params.sort_order),
        ]
@@ -169,6 +177,7 @@ mod tests {
            admin_user_id: "",
            target_id: "",
            target_type: "bulk_job",
+            access: "",
            sort_by: "createdAt",
            sort_order: "desc",
            limit: 50,
@@ -176,5 +185,28 @@ mod tests {
        };
        let markup = filters_section("/admin", &params).into_string();
        assert!(markup.contains(r#"<option value="bulk_job" selected>Bulk job</option>"#));
+        assert!(markup.contains(r#"<option value="" selected>All entries</option>"#));
+    }
+
+    #[test]
+    fn access_filter_survives_form_and_pagination() {
+        let params = AuditLogsParams {
+            query: "",
+            admin_user_id: "",
+            target_id: "1500000000000000001",
+            target_type: "",
+            access: "read",
+            sort_by: "createdAt",
+            sort_order: "desc",
+            limit: 50,
+            current_page: 0,
+        };
+        let markup = filters_section("/admin", &params).into_string();
+        assert!(markup.contains(r#"<select id="access" name="access""#));
+        assert!(markup.contains(r#"<option value="read" selected>Reads only</option>"#));
+        assert_eq!(
+            build_pagination_url("/admin", 1, &params),
+            "/admin/audit-logs?page=1&target_id=1500000000000000001&access=read&sort_by=createdAt&sort_order=desc&limit=50"
+        );
    }
 }
@@ -848,6 +848,18 @@ fn app_public_config_section(
                                app_public.branding.favicon_url.as_deref().unwrap_or(""),
                                "https://example.com/favicon.ico",
                            ))
+                            (text_input(
+                                "app_status_page_url",
+                                "Status page URL",
+                                app_public.branding.status_page_url.as_deref().unwrap_or(""),
+                                "https://fluxerstatus.com",
+                            ))
+                            (text_input(
+                                "app_status_page_incident_history_url",
+                                "Status page history URL",
+                                app_public.branding.status_page_incident_history_url.as_deref().unwrap_or(""),
+                                "https://fluxerstatus.com/history",
+                            ))
                        }
                        div class="space-y-2" {
                            (checkbox(
@@ -230,6 +230,7 @@ fn deserialize_audit_logs_response() {
                "target_type": "user",
                "target_id": "1130958221824557056",
                "action": "list_user_sessions",
+                "access": "read",
                "audit_log_reason": null,
                "metadata": {"session_count": "3"},
                "created_at": "2026-05-26T13:21:47.138Z"
@@ -243,6 +244,7 @@ fn deserialize_audit_logs_response() {
    assert_eq!(resp.logs.len(), 1);
    assert_eq!(resp.logs[0].log_id, "1508822460457747580");
    assert_eq!(resp.logs[0].action, "list_user_sessions");
+    assert_eq!(resp.logs[0].access.as_deref(), Some("read"));
    assert_eq!(resp.logs[0].target_type, "user");
    assert!(resp.logs[0].audit_log_reason.is_none());
    assert_eq!(resp.logs[0].metadata.get("session_count").unwrap(), "3");
@@ -168,6 +168,39 @@ async fn detail_tab_routes_return_layout_or_fragments_by_route_shape() {
    }
 }

+#[tokio::test]
+async fn target_audit_log_tabs_request_write_entries_only() {
+    let app = setup().await;
+    for path in [
+        "/users/1500000000000000001/tabs/audit_logs",
+        "/guilds/1600000000000000001/tabs/audit_logs",
+    ] {
+        let fragment = get(&app, path, &[]).await;
+        assert!(fragment.contains("Temp ban"), "{path}\n{fragment}");
+        assert!(!fragment.contains("Get user"), "{path}\n{fragment}");
+    }
+}
+
+#[tokio::test]
+async fn audit_log_page_forwards_the_access_filter() {
+    let app = setup().await;
+    let all = get(&app, "/audit-logs", &[]).await;
+    assert!(all.contains("Temp ban"), "{all}");
+    assert!(all.contains("Get user"), "{all}");
+    assert!(
+        all.contains(r#"<option value="" selected>All entries</option>"#),
+        "{all}"
+    );
+
+    let reads = get(&app, "/audit-logs?access=read", &[]).await;
+    assert!(reads.contains("Get user"), "{reads}");
+    assert!(!reads.contains("Temp ban"), "{reads}");
+    assert!(
+        reads.contains(r#"<option value="read" selected>Reads only</option>"#),
+        "{reads}"
+    );
+}
+
 #[tokio::test]
 async fn report_routes_keep_layout_and_fragment_contract() {
    let app = setup().await;
@@ -844,6 +877,25 @@ async fn mock_api(method: Method, uri: Uri) -> Response {
            json_response(instance_config_without_pending_registrations())
        }
        (Method::GET, "/admin/limit-config") => json_response(limit_config()),
+        (Method::GET, "/admin/audit-logs") => {
+            let access = uri.query().and_then(|query| {
+                url::form_urlencoded::parse(query.as_bytes())
+                    .find(|(key, _)| key == "access")
+                    .map(|(_, value)| value.into_owned())
+            });
+            let logs = [
+                audit_log_entry("1900000000000000101", "get_user", "read"),
+                audit_log_entry("1900000000000000102", "temp_ban", "write"),
+            ]
+            .into_iter()
+            .filter(|entry| {
+                access
+                    .as_deref()
+                    .is_none_or(|access| entry.access.to_string() == access)
+            })
+            .collect::<Vec<_>>();
+            json_response(json!({ "total": logs.len(), "logs": logs }))
+        }
        _ => (StatusCode::NOT_FOUND, Json(json!({ "error": "not found" }))).into_response(),
    }
 }
@@ -975,6 +1027,32 @@ fn guild_fixtures_match_generated_response_contracts() {
    assert_eq!(detail.member_count, 12);
 }

+fn audit_log_entry(
+    log_id: &str,
+    action: &str,
+    access: &str,
+) -> generated_types::AdminAuditLogResponseSchema {
+    serde_json::from_value(json!({
+        "log_id": log_id,
+        "admin_user_id": "1500000000000000000",
+        "admin_user": null,
+        "target_type": "user",
+        "target_id": "1500000000000000001",
+        "target_user": null,
+        "target_guild": null,
+        "target_channel": null,
+        "related_users": {},
+        "related_guilds": {},
+        "related_channels": {},
+        "action": action,
+        "access": access,
+        "audit_log_reason": null,
+        "metadata": {},
+        "created_at": "2026-09-16T12:00:00.000Z"
+    }))
+    .expect("audit log fixture must match the generated response contract")
+}
+
 fn searched_application() -> Value {
    json!({
        "id": "1700000000000000001",
@@ -1,11 +1,11 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later
 ARG BUILD_VERSION

-FROM node:24-bookworm-slim AS base
+FROM node:26-trixie-slim AS base

 WORKDIR /usr/src/app

-RUN corepack enable && corepack prepare [email protected] --activate
+RUN npm install -g [email protected]

 FROM base AS deploy

@@ -23,9 +23,9 @@ COPY . .

 RUN pnpm install --frozen-lockfile
 RUN pnpm --filter fluxer_api run build
-RUN pnpm deploy --legacy --filter=fluxer_api --prod --config.allowUnusedPatches=true /out
+RUN pnpm deploy --legacy --filter=fluxer_api --prod --config.allow-unused-patches=true /out

-FROM node:24-bookworm-slim
+FROM node:26-trixie-slim

 ARG BUILD_VERSION
 ARG SOURCE_SHA
@@ -45,32 +45,28 @@ LABEL app.fluxer.build-version="${BUILD_VERSION}"

 WORKDIR /usr/src/app/fluxer_api

-RUN echo 'deb http://deb.debian.org/debian bookworm-backports main' > /etc/apt/sources.list.d/backports.list && \
-	apt-get update && apt-get install -y --no-install-recommends \
+RUN apt-get update && apt-get install -y --no-install-recommends \
 		ca-certificates \
 		ffmpeg \
 		libimage-exiftool-perl \
 		libwebp7 \
 		libwebpmux3 \
 		libheif1 \
-		libvips42 && \
-	apt-get install -y --no-install-recommends -t bookworm-backports \
 		libheif-plugin-libde265 \
-		libheif-plugin-dav1d && \
+		libheif-plugin-dav1d \
+		libvips42t64 && \
 	rm -rf /var/lib/apt/lists/*

-RUN corepack enable && corepack prepare [email protected] --activate
+RUN npm install -g [email protected]

 COPY --from=deploy /out ./
 COPY --from=deploy /usr/src/app/fluxer_api/dist ./dist
 COPY --from=deploy /usr/src/app/tsconfigs /usr/src/app/tsconfigs

 RUN rm -rf pkgs && \
-	mkdir -p /usr/src/app/.cache/corepack && \
 	chown -R 65532:65532 /usr/src/app

 ENV HOME=/usr/src/app
-ENV COREPACK_HOME=/usr/src/app/.cache/corepack
 ENV NODE_ENV=production
 ENV NODE_OPTIONS="--enable-source-maps"
 ENV NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt
@@ -5,19 +5,19 @@
 	"scripts": {
 		"build": "node scripts/build.mjs",
 		"test": "vitest run",
-		"typecheck": "tsgo --noEmit",
+		"typecheck": "tsc --noEmit",
 		"dev": "tsx watch --clear-screen=false src/AppEntrypoint.ts",
 		"start": "tsx src/AppEntrypoint.ts",
 		"start:worker": "tsx src/WorkerEntrypoint.ts"
 	},
 	"dependencies": {
 		"@atproto/api": "catalog:",
+		"@atproto/jwk-jose": "catalog:",
+		"@atproto/oauth-client-node": "catalog:",
 		"@aws-sdk/client-s3": "catalog:",
 		"@aws-sdk/lib-storage": "catalog:",
 		"@aws-sdk/s3-request-presigner": "catalog:",
-		"@bluesky-social/jwk-jose": "catalog:",
-		"@bluesky-social/oauth-client-node": "catalog:",
-		"@bufbuild/protobuf": "^2.12.0",
+		"@bufbuild/protobuf": "^2.15.0",
 		"@elastic/elasticsearch": "catalog:",
 		"@fluxer/config": "workspace:*",
 		"@fluxer/constants": "workspace:*",
@@ -34,6 +34,8 @@
 		"@hono/node-server": "catalog:",
 		"@messageformat/core": "catalog:",
 		"@messageformat/parser": "catalog:",
+		"@nats-io/jetstream": "catalog:",
+		"@nats-io/transport-node": "catalog:",
 		"@pkgs/cache": "workspace:*",
 		"@pkgs/captcha": "workspace:*",
 		"@pkgs/cassandra": "workspace:*",
@@ -71,7 +73,6 @@
 		"lodash": "catalog:",
 		"maxmind": "catalog:",
 		"mime": "catalog:",
-		"nats": "catalog:",
 		"nodemailer": "catalog:",
 		"pg": "catalog:",
 		"pino": "catalog:",
@@ -88,10 +89,10 @@
 	"devDependencies": {
 		"@types/archiver": "catalog:",
 		"@types/lodash": "catalog:",
-		"@typescript/native-preview": "catalog:",
 		"esbuild": "catalog:",
 		"msw": "catalog:",
+		"typescript": "catalog:ts7",
 		"vitest": "catalog:"
 	},
-	"packageManager": "pnpm@10.29.3"
+	"packageManager": "pnpm@12.4.2"
 }
@@ -9,14 +9,14 @@
 	"scripts": {
 		"test": "vitest run",
 		"test:watch": "vitest",
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@pkgs/kv_client": "workspace:*"
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:",
+		"typescript": "catalog:ts7",
 		"vitest": "catalog:"
 	}
 }
@@ -7,7 +7,7 @@
 		"./*": "./*"
 	},
 	"scripts": {
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@fluxer/logger": "workspace:*",
@@ -15,6 +15,6 @@
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:"
+		"typescript": "catalog:ts7"
 	}
 }
@@ -7,13 +7,13 @@
 		"./*": "./*"
 	},
 	"scripts": {
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"cassandra-driver": "catalog:"
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:"
+		"typescript": "catalog:ts7"
 	}
 }
@@ -7,7 +7,7 @@
 		"./*": "./*"
 	},
 	"scripts": {
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@elastic/elasticsearch": "catalog:",
@@ -15,6 +15,6 @@
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:"
+		"typescript": "catalog:ts7"
 	}
 }
@@ -6,7 +6,7 @@ import type {AuditLogSearchFilters, SearchableAuditLog} from '@fluxer/schema/src
 import type {ElasticsearchDistributedLock} from '@pkgs/elasticsearch_search/src/adapters/ElasticsearchIndexAdapter';
 import {ElasticsearchIndexAdapter} from '@pkgs/elasticsearch_search/src/adapters/ElasticsearchIndexAdapter';
 import type {ElasticsearchFilter} from '@pkgs/elasticsearch_search/src/ElasticsearchFilterUtils';
-import {compactFilters, esTermFilter} from '@pkgs/elasticsearch_search/src/ElasticsearchFilterUtils';
+import {compactFilters, esTermFilter, esTermsFilter} from '@pkgs/elasticsearch_search/src/ElasticsearchFilterUtils';
 import {ELASTICSEARCH_INDEX_DEFINITIONS} from '@pkgs/elasticsearch_search/src/ElasticsearchIndexDefinitions';

 function buildAuditLogFilters(filters: AuditLogSearchFilters): Array<ElasticsearchFilter | undefined> {
@@ -15,6 +15,10 @@ function buildAuditLogFilters(filters: AuditLogSearchFilters): Array<Elasticsear
 	if (filters.targetType) clauses.push(esTermFilter('targetType', filters.targetType));
 	if (filters.targetId) clauses.push(esTermFilter('targetId', filters.targetId));
 	if (filters.action) clauses.push(esTermFilter('action', filters.action));
+	if (filters.actions && filters.actions.length > 0) clauses.push(esTermsFilter('action.keyword', filters.actions));
+	if (filters.excludeActions && filters.excludeActions.length > 0) {
+		clauses.push({bool: {must_not: [esTermsFilter('action.keyword', filters.excludeActions)]}});
+	}
 	return compactFilters(clauses);
 }

@@ -9,7 +9,7 @@
 	"scripts": {
 		"test": "vitest run",
 		"test:watch": "vitest",
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@fluxer/i18n": "workspace:*",
@@ -19,8 +19,7 @@
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@types/nodemailer": "catalog:",
-		"@typescript/native-preview": "catalog:",
+		"typescript": "catalog:ts7",
 		"vitest": "catalog:"
 	}
 }
@@ -2,7 +2,7 @@

 import {createLogger} from '@fluxer/logger/src/Logger';
 import type {EmailMessage, IEmailProvider} from '@pkgs/email/src/EmailProviderTypes';
-import nodemailer from 'nodemailer';
+import nodemailer, {type Transporter} from 'nodemailer';

 const logger = createLogger('@pkgs/email/src/SmtpEmailProvider');

@@ -18,7 +18,7 @@ interface SmtpEmailConfig {
 }

 export class SmtpEmailProvider implements IEmailProvider {
-	private readonly transporter: nodemailer.Transporter;
+	private readonly transporter: Transporter;

 	constructor(config: SmtpEmailConfig) {
 		this.transporter = nodemailer.createTransport({
@@ -7,7 +7,7 @@
 		"./*": "./*"
 	},
 	"scripts": {
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@aws-sdk/client-s3": "catalog:",
@@ -21,6 +21,6 @@
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:"
+		"typescript": "catalog:ts7"
 	}
 }
@@ -285,6 +285,5 @@ export function formatGeoipLocation(result: GeoipResult, locale?: string | null)
 	const localizedCountry = locale && result.countryCode ? countryDisplayName(result.countryCode, locale) : null;
 	const countryLabel = localizedCountry ?? result.countryName ?? result.countryCode;
 	if (countryLabel) parts.push(countryLabel);
-	if (parts.length === 0) return null;
-	return new Intl.ListFormat(locale ?? 'en', {style: 'narrow', type: 'unit'}).format(parts);
+	return parts.length > 0 ? parts.join(', ') : null;
 }
@@ -67,7 +67,7 @@ interface GeoipRuntimePathOptions {
 }

 export function parseGeoipSourceConfig(rawValue: string | undefined): GeoipSourceConfig {
-	if (!rawValue || !rawValue.startsWith('s3://')) {
+	if (!rawValue?.startsWith('s3://')) {
 		return createGeoipFilesystemSourceConfig(rawValue);
 	}
 	return parseGeoipS3SourceConfig(rawValue);
@@ -9,7 +9,7 @@
 	"scripts": {
 		"test": "vitest run",
 		"test:watch": "vitest",
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@fluxer/constants": "workspace:*",
@@ -17,8 +17,7 @@
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:",
-		"undici-types": "catalog:",
+		"typescript": "catalog:ts7",
 		"vitest": "catalog:"
 	}
 }
@@ -16,6 +16,7 @@ import {
 } from '@pkgs/http_client/src/HttpClientRequestInternals';
 import type {HttpClientMetrics, HttpClientTelemetry} from '@pkgs/http_client/src/HttpClientTelemetryTypes';
 import type {
+	FetchDispatcher,
 	HttpClient,
 	HttpClientFactoryOptions,
 	HttpMethod,
@@ -26,7 +27,6 @@ import type {
 	StreamResponse,
 } from '@pkgs/http_client/src/HttpClientTypes';
 import {HttpError} from '@pkgs/http_client/src/HttpError';
-import type {Dispatcher} from 'undici-types';

 const DEFAULT_SERVICE_NAME = 'unknown';

@@ -79,7 +79,7 @@ function createFetchInit(
 	headers: Headers,
 	body: string | undefined,
 	signal: AbortSignal,
-	dispatcher: Dispatcher | undefined,
+	dispatcher: FetchDispatcher | undefined,
 ): RequestInit {
 	return {
 		method,
@@ -1,9 +1,9 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

 import type {HttpClientTelemetry} from '@pkgs/http_client/src/HttpClientTelemetryTypes';
-import type {Dispatcher} from 'undici-types';

 export type ResponseStream = ReadableStream<Uint8Array> | null;
+export type FetchDispatcher = NonNullable<RequestInit['dispatcher']>;
 export type HttpMethod = 'GET' | 'POST' | 'HEAD' | 'PUT' | 'PATCH' | 'DELETE' | 'OPTIONS';
 export type RequestUrlValidationPhase = 'initial' | 'redirect';

@@ -14,7 +14,7 @@ export interface RequestUrlValidationContext {
 }

 export interface RequestUrlPolicy {
-	readonly dispatcher?: Dispatcher;
+	readonly dispatcher?: FetchDispatcher;
 	validate(url: URL, context: RequestUrlValidationContext): Promise<void>;
 }

@@ -5,10 +5,13 @@ import dns from 'node:dns';
 import type {LookupFunction} from 'node:net';
 import {BlockList, isIP} from 'node:net';
 import {formatUrlForDiagnostics} from '@pkgs/http_client/src/HttpClientDiagnostics';
-import type {RequestUrlPolicy, RequestUrlValidationContext} from '@pkgs/http_client/src/HttpClientTypes';
+import type {
+	FetchDispatcher,
+	RequestUrlPolicy,
+	RequestUrlValidationContext,
+} from '@pkgs/http_client/src/HttpClientTypes';
 import {HttpError} from '@pkgs/http_client/src/HttpError';
-import {Agent} from 'undici';
-import type {Dispatcher} from 'undici-types';
+import {Agent, Dispatcher1Wrapper} from 'undici';

 const DEFAULT_DNS_CACHE_TTL_MS = 60000;
 const DNS_CACHE_MAX_ENTRIES = 10000;
@@ -223,7 +226,7 @@ async function defaultLookupHost(hostname: string): Promise<Array<string>> {
 	return addresses.map((addressEntry) => addressEntry.address);
 }

-function createBlocklistDispatcher(allowPrivateAddresses: boolean): Dispatcher {
+function createBlocklistDispatcher(allowPrivateAddresses: boolean): FetchDispatcher {
 	const lookup: LookupFunction = (hostname, options, callback) => {
 		dns.lookup(hostname, {...options, all: true, order: options.order ?? 'verbatim'}, (error, addresses) => {
 			if (error) {
@@ -246,15 +249,18 @@ function createBlocklistDispatcher(allowPrivateAddresses: boolean): Dispatcher {
 			callback(null, primary.address, primary.family);
 		});
 	};
-	return new Agent({
-		connect: {
-			lookup,
-		},
-	}) as unknown as Dispatcher;
+	return new Dispatcher1Wrapper(
+		new Agent({
+			allowH2: false,
+			connect: {
+				lookup,
+			},
+		}),
+	) as unknown as FetchDispatcher;
 }

 interface PublicInternetRequestUrlPolicy extends RequestUrlPolicy {
-	readonly dispatcher: Dispatcher;
+	readonly dispatcher: FetchDispatcher;
 }

 export function createPublicInternetRequestUrlPolicy(
@@ -9,7 +9,7 @@
 	"scripts": {
 		"test": "vitest run",
 		"test:watch": "vitest",
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@fluxer/constants": "workspace:*",
@@ -18,7 +18,7 @@
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:",
+		"typescript": "catalog:ts7",
 		"vitest": "catalog:"
 	}
 }
@@ -29,7 +29,7 @@ export interface IKVSubscription {
 }

 export interface KVPurgeBatchResult {
-	urls: Array<string>;
+	entries: Array<string>;
 	tokensConsumed: number;
 }

@@ -217,7 +217,7 @@ local refillIntervalMs = tonumber(ARGV[5])

 local queueSize = redis.call('SCARD', queueKey)
 if queueSize == 0 then
-	return '{"urls":[],"tokens":0}'
+	return '{"entries":[],"tokens":0}'
 end

 local tokens = maxTokens
@@ -237,14 +237,14 @@ end
 local toPop = math.min(maxItems, math.floor(tokens), queueSize)
 if toPop <= 0 then
 	redis.call('SET', bucketKey, cjson.encode({tokens = tokens, lastRefill = lastRefill}), 'EX', 3600)
-	return '{"urls":[],"tokens":0}'
+	return '{"entries":[],"tokens":0}'
 end

-local urls = redis.call('SPOP', queueKey, toPop)
-tokens = tokens - #urls
+local entries = redis.call('SPOP', queueKey, toPop)
+tokens = tokens - #entries

 redis.call('SET', bucketKey, cjson.encode({tokens = tokens, lastRefill = lastRefill}), 'EX', 3600)
-return cjson.encode({urls = urls, tokens = #urls})
+return cjson.encode({entries = entries, tokens = #entries})
 `;
 const CLAIM_BULK_DELETION_SCRIPT = `
 local score = redis.call('ZSCORE', KEYS[1], ARGV[1])
@@ -295,6 +295,7 @@ export class KVClient implements IKVProvider {
 				connectTimeout: this.timeoutMs,
 				commandTimeout: this.timeoutMs,
 				maxRetriesPerRequest: 1,
+				protocol: 2,
 				retryStrategy: createRetryStrategy(),
 			});
 		}
@@ -311,6 +312,7 @@ export class KVClient implements IKVProvider {
 				connectTimeout: clusterConfig.timeoutMs,
 				commandTimeout: clusterConfig.timeoutMs,
 				maxRetriesPerRequest: 1,
+				protocol: 2,
 			},
 			scaleReads: 'master',
 			...(hasNatMap ? {natMap} : {}),
@@ -902,17 +904,17 @@ function parseRateLimitResult(value: unknown): KVRateLimitResult {
 function parsePurgeBatchResult(value: unknown, maxItems: number): KVPurgeBatchResult {
 	const command = 'dequeuePurgeBatch';
 	if (!isJsonObject(value)) throw createInvalidResponseError(command, 'a purge batch object');
-	const {urls, tokens} = value;
+	const {entries, tokens} = value;
 	if (
-		!Array.isArray(urls) ||
-		!urls.every((url): url is string => typeof url === 'string') ||
+		!Array.isArray(entries) ||
+		!entries.every((entry): entry is string => typeof entry === 'string') ||
 		!isNonNegativeSafeInteger(tokens) ||
-		tokens !== urls.length ||
-		urls.length > maxItems
+		tokens !== entries.length ||
+		entries.length > maxItems
 	) {
 		throw createInvalidResponseError(command, 'a bounded string array and matching token count');
 	}
-	return {urls, tokensConsumed: tokens};
+	return {entries, tokensConsumed: tokens};
 }

 function isJsonObject(value: unknown): value is Record<string, unknown> {
@@ -72,6 +72,7 @@ export class KVSubscription implements IKVSubscription {
 			connectTimeout: this.timeoutMs,
 			commandTimeout: this.timeoutMs,
 			maxRetriesPerRequest: 1,
+			protocol: 2,
 			retryStrategy: createRetryStrategy(),
 		};
 		const connection = this.mode === 'cluster' ? resolveKVClusterConnection(this.url, this.clusterNodes) : null;
@@ -153,7 +153,7 @@ describe('KVClient script execution', () => {
 				},
 				{
 					name: 'dequeuePurgeBatch',
-					reply: JSON.stringify({urls: ['https://fluxer.test/a.png'], tokens: 1}),
+					reply: JSON.stringify({entries: ['/attachments/1/2/a'], tokens: 1}),
 					keyCount: 2,
 					run: async (client) => client.dequeuePurgeBatch('queue:key', 'bucket:key', 10, 10, 1, 1000),
 				},
@@ -9,14 +9,14 @@
 	"scripts": {
 		"test": "vitest run",
 		"test:watch": "vitest",
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@fluxer/constants": "workspace:*"
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:",
+		"typescript": "catalog:ts7",
 		"vitest": "catalog:"
 	}
 }
@@ -24,6 +24,10 @@
 			"import": "./src/MediaProxySigner.ts",
 			"types": "./src/MediaProxySigner.ts"
 		},
+		"./src/AttachmentUrlSignature": {
+			"import": "./src/AttachmentUrlSignature.ts",
+			"types": "./src/AttachmentUrlSignature.ts"
+		},
 		"./*": "./*"
 	},
 	"main": "./src/MediaProxyUtils.ts",
@@ -31,13 +35,13 @@
 	"scripts": {
 		"test": "vitest run",
 		"test:watch": "vitest",
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@types/node": "catalog:"
 	},
 	"devDependencies": {
-		"@typescript/native-preview": "catalog:",
+		"typescript": "catalog:ts7",
 		"vitest": "catalog:"
 	}
 }
@@ -0,0 +1,211 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import crypto from 'node:crypto';
+
+export const ATTACHMENT_URL_TTL_SECS = 86_400;
+export const ATTACHMENT_URL_BUCKET_SECS = 43_200;
+
+export const ORDINARY_USAGE = '';
+export const DATA_PACKAGE_USAGE = 'dp';
+
+export type AttachmentUrlUsage = typeof ORDINARY_USAGE | typeof DATA_PACKAGE_USAGE;
+export type SignatureParameterName = 'ex' | 'is' | 'hm' | 'uc';
+
+const SIGNATURE_DOMAIN = 'fluxer-attachment-url-v1';
+const ATTACHMENT_PATH_PREFIX = '/attachments/';
+const SIGNATURE_PARAMETER_NAMES: ReadonlyArray<SignatureParameterName> = ['ex', 'is', 'hm', 'uc'];
+const DATA_PACKAGE_EXPIRES = '0';
+const WINDOW_HEX_LENGTH = 8;
+const MAX_WINDOW_SECS = 0xff_ff_ff_ff;
+const LEADING_SLASHES_REGEX = /^\/+/u;
+const TRAILING_SLASHES_REGEX = /\/+$/u;
+
+const textEncoder = new TextEncoder();
+const strictTextDecoder = new TextDecoder('utf-8', {fatal: true, ignoreBOM: true});
+
+export interface AttachmentUrlWindow {
+	issued: number;
+	expires: number;
+}
+
+export interface SignAttachmentUrlOptions {
+	mediaEndpoint: string;
+	secret: Uint8Array;
+	nowSecs: number;
+	anchorSecs: number;
+}
+
+function hexNibble(byte: number): number {
+	if (byte >= 0x30 && byte <= 0x39) return byte - 0x30;
+	if (byte >= 0x41 && byte <= 0x46) return byte - 0x41 + 10;
+	if (byte >= 0x61 && byte <= 0x66) return byte - 0x61 + 10;
+	return -1;
+}
+
+function percentDecodeBytes(value: string, plusAsSpace: boolean): Uint8Array {
+	const bytes = textEncoder.encode(value);
+	const decoded = new Uint8Array(bytes.length);
+	let length = 0;
+	let index = 0;
+	while (index < bytes.length) {
+		const byte = bytes[index] as number;
+		if (byte === 0x25 && index + 2 < bytes.length) {
+			const high = hexNibble(bytes[index + 1] as number);
+			const low = hexNibble(bytes[index + 2] as number);
+			if (high >= 0 && low >= 0) {
+				decoded[length] = (high << 4) | low;
+				length += 1;
+				index += 3;
+				continue;
+			}
+		}
+		decoded[length] = plusAsSpace && byte === 0x2b ? 0x20 : byte;
+		length += 1;
+		index += 1;
+	}
+	return decoded.subarray(0, length);
+}
+
+export function percentDecodeStorageKey(path: string): string | null {
+	try {
+		return strictTextDecoder.decode(percentDecodeBytes(path.replace(LEADING_SLASHES_REGEX, ''), false));
+	} catch {
+		return null;
+	}
+}
+
+export function signatureParameterName(name: string): SignatureParameterName | null {
+	const decoded = percentDecodeBytes(name, true);
+	if (decoded.length !== 2) return null;
+	const candidate = String.fromCharCode(decoded[0] as number, decoded[1] as number);
+	return SIGNATURE_PARAMETER_NAMES.find((entry) => entry === candidate) ?? null;
+}
+
+export function isSignatureParameterName(name: string): boolean {
+	return signatureParameterName(name) !== null;
+}
+
+function isSafeStorageKey(key: string): boolean {
+	if (key.length === 0 || key.startsWith('/')) return false;
+	return key
+		.split('/')
+		.every((component) => component.length > 0 && component !== '.' && component !== '..' && !component.includes('\0'));
+}
+
+function firstIndexOf(value: string, characters: ReadonlyArray<string>): number {
+	let found = -1;
+	for (const character of characters) {
+		const index = value.indexOf(character);
+		if (index >= 0 && (found < 0 || index < found)) {
+			found = index;
+		}
+	}
+	return found;
+}
+
+function rawPathFromUrl(url: string): string | null {
+	const schemeIndex = url.indexOf('://');
+	if (schemeIndex < 0) return null;
+	const afterAuthority = url.slice(schemeIndex + 3);
+	const boundary = firstIndexOf(afterAuthority, ['/', '?', '#']);
+	if (boundary < 0 || afterAuthority[boundary] !== '/') return '';
+	const path = afterAuthority.slice(boundary);
+	const queryIndex = firstIndexOf(path, ['?', '#']);
+	return queryIndex < 0 ? path : path.slice(0, queryIndex);
+}
+
+function parseWebUrl(value: string): URL | null {
+	try {
+		const parsed = new URL(value);
+		return parsed.protocol === 'http:' || parsed.protocol === 'https:' ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+
+export function attachmentStorageKeyFromUrl(url: string, mediaEndpoint: string): string | null {
+	const target = parseWebUrl(url);
+	const endpoint = parseWebUrl(mediaEndpoint);
+	if (!target || !endpoint || target.origin !== endpoint.origin) return null;
+	const path = rawPathFromUrl(url);
+	if (path === null) return null;
+	const endpointPath = (rawPathFromUrl(mediaEndpoint) ?? '').replace(TRAILING_SLASHES_REGEX, '');
+	if (!path.startsWith(`${endpointPath}${ATTACHMENT_PATH_PREFIX}`)) return null;
+	const storageKey = percentDecodeStorageKey(path.slice(endpointPath.length));
+	if (storageKey === null || !isSafeStorageKey(storageKey)) return null;
+	return storageKey;
+}
+
+interface SplitUrl {
+	base: string;
+	query: string;
+	fragment: string;
+}
+
+function splitUrl(url: string): SplitUrl {
+	const fragmentIndex = url.indexOf('#');
+	const head = fragmentIndex < 0 ? url : url.slice(0, fragmentIndex);
+	const fragment = fragmentIndex < 0 ? '' : url.slice(fragmentIndex);
+	const queryIndex = head.indexOf('?');
+	if (queryIndex < 0) return {base: head, query: '', fragment};
+	return {base: head.slice(0, queryIndex), query: head.slice(queryIndex + 1), fragment};
+}
+
+function preservedFields(query: string): Array<string> {
+	if (query.length === 0) return [];
+	return query.split('&').filter((field) => {
+		if (field.length === 0 || field === '=') return false;
+		const separator = field.indexOf('=');
+		return !isSignatureParameterName(separator < 0 ? field : field.slice(0, separator));
+	});
+}
+
+export function stripAttachmentSignature(url: string): string {
+	const {base, query, fragment} = splitUrl(url);
+	const preserved = preservedFields(query);
+	if (preserved.length === 0) return `${base}${fragment}`;
+	return `${base}?${preserved.join('&')}${fragment}`;
+}
+
+export function issueWindow(anchorSecs: number, nowSecs: number): AttachmentUrlWindow {
+	const elapsed = Math.max(0, nowSecs - anchorSecs);
+	const issued = anchorSecs + Math.floor(elapsed / ATTACHMENT_URL_BUCKET_SECS) * ATTACHMENT_URL_BUCKET_SECS;
+	return {issued, expires: issued + ATTACHMENT_URL_TTL_SECS};
+}
+
+export function canonicalInput(storageKey: string, exHex: string, isHex: string, usage: AttachmentUrlUsage): string {
+	return `${SIGNATURE_DOMAIN}\n${exHex}\n${isHex}\n${usage}\n${storageKey}`;
+}
+
+function windowHex(value: number): string {
+	return value.toString(16).padStart(WINDOW_HEX_LENGTH, '0');
+}
+
+function signUsage(url: string, options: SignAttachmentUrlOptions, usage: AttachmentUrlUsage): string {
+	const storageKey = attachmentStorageKeyFromUrl(url, options.mediaEndpoint);
+	if (storageKey === null) return url;
+	const {issued, expires} = issueWindow(options.anchorSecs, options.nowSecs);
+	if (!Number.isSafeInteger(issued) || issued < 0 || expires > MAX_WINDOW_SECS) return url;
+	const isDataPackage = usage === DATA_PACKAGE_USAGE;
+	const exHex = windowHex(isDataPackage ? 0 : expires);
+	const isHex = windowHex(issued);
+	const signature = crypto
+		.createHmac('sha256', options.secret)
+		.update(canonicalInput(storageKey, exHex, isHex, usage))
+		.digest('hex');
+	const signatureFields = isDataPackage
+		? `ex=${DATA_PACKAGE_EXPIRES}&is=${isHex}&hm=${signature}&uc=${DATA_PACKAGE_USAGE}`
+		: `ex=${exHex}&is=${isHex}&hm=${signature}`;
+	const {base, query, fragment} = splitUrl(url);
+	const preserved = preservedFields(query);
+	const fields = preserved.length === 0 ? signatureFields : `${signatureFields}&${preserved.join('&')}`;
+	return `${base}?${fields}${fragment}`;
+}
+
+export function signAttachmentUrl(url: string, options: SignAttachmentUrlOptions): string {
+	return signUsage(url, options, ORDINARY_USAGE);
+}
+
+export function signDataPackageAttachmentUrl(url: string, options: SignAttachmentUrlOptions): string {
+	return signUsage(url, options, DATA_PACKAGE_USAGE);
+}
@@ -10,13 +10,13 @@
 		"./*": "./*"
 	},
 	"scripts": {
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"mime": "catalog:"
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:"
+		"typescript": "catalog:ts7"
 	}
 }
@@ -7,13 +7,14 @@
 		"./*": "./*"
 	},
 	"scripts": {
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
-		"nats": "catalog:"
+		"@nats-io/jetstream": "catalog:",
+		"@nats-io/transport-node": "catalog:"
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:"
+		"typescript": "catalog:ts7"
 	}
 }
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-import type {NatsConnection} from 'nats';
+import type {NatsConnection} from '@nats-io/transport-node';

 export interface INatsConnectionManager {
 	connect(): Promise<void>;
@@ -1,14 +1,14 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+import {type JetStreamClient, type JetStreamManager, jetstream, jetstreamManager} from '@nats-io/jetstream';
 import {NatsConnectionManager} from '@pkgs/nats/src/NatsConnectionManager';
-import type {JetStreamClient, JetStreamManager} from 'nats';

 export class JetStreamConnectionManager extends NatsConnectionManager {
 	getJetStreamClient(): JetStreamClient {
-		return this.getConnection().jetstream();
+		return jetstream(this.getConnection());
 	}

 	async getJetStreamManager(): Promise<JetStreamManager> {
-		return this.getConnection().jetstreamManager();
+		return jetstreamManager(this.getConnection());
 	}
 }
@@ -1,8 +1,8 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+import {connect, DrainingConnectionError, type NatsConnection} from '@nats-io/transport-node';
 import type {INatsConnectionManager} from '@pkgs/nats/src/INatsConnectionManager';
 import type {NatsConnectionOptions} from '@pkgs/nats/src/NatsConnectionOptions';
-import {connect, ErrorCode, type NatsConnection, NatsError} from 'nats';

 const DEFAULT_MAX_RECONNECT_ATTEMPTS = -1;
 const DEFAULT_RECONNECT_TIME_WAIT_MS = 500;
@@ -46,7 +46,7 @@ export class NatsConnectionManager implements INatsConnectionManager {
 		});
 		await this.connectPromise;
 		if (generation !== this.drainGeneration) {
-			throw NatsError.errorForCode(ErrorCode.ConnectionDraining);
+			throw new DrainingConnectionError();
 		}
 	}

@@ -139,7 +139,7 @@ export class NatsConnectionManager implements INatsConnectionManager {

 	private assertNotDraining(): void {
 		if (this.drainPromise !== null) {
-			throw NatsError.errorForCode(ErrorCode.ConnectionDraining);
+			throw new DrainingConnectionError();
 		}
 	}

@@ -7,7 +7,7 @@
 		"./*": "./*"
 	},
 	"scripts": {
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"pg": "catalog:"
@@ -15,6 +15,6 @@
 	"devDependencies": {
 		"@types/node": "catalog:",
 		"@types/pg": "catalog:",
-		"@typescript/native-preview": "catalog:"
+		"typescript": "catalog:ts7"
 	}
 }
@@ -7,16 +7,13 @@
 		"./*": "./*"
 	},
 	"scripts": {
-		"test": "vitest run",
-		"test:watch": "vitest",
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@pkgs/kv_client": "workspace:*"
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:",
-		"vitest": "catalog:"
+		"typescript": "catalog:ts7"
 	}
 }
@@ -1,14 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-interface KVRequiredErrorOptions {
-	serviceName: string;
-	configPath: string;
-}
-
-export function throwKVRequiredError(options: KVRequiredErrorOptions): never {
-	const {serviceName, configPath} = options;
-	throw new Error(
-		`${serviceName} requires KV-backed rate limiting. ${configPath} is not set. ` +
-			`internal.kv must be configured for distributed rate limiting.`,
-	);
-}
@@ -1,63 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-import {throwKVRequiredError} from '@pkgs/rate_limit/src/KVRequiredError';
-import {describe, expect, it} from 'vitest';
-
-describe('throwKVRequiredError', () => {
-	it('should throw an error with the service name', () => {
-		expect(() =>
-			throwKVRequiredError({
-				serviceName: 'fluxer_api',
-				configPath: 'internal.kv.url',
-			}),
-		).toThrow('fluxer_api requires KV-backed rate limiting');
-	});
-	it('should include the config path in the error message', () => {
-		expect(() =>
-			throwKVRequiredError({
-				serviceName: 'TestService',
-				configPath: 'config.kv.connection_string',
-			}),
-		).toThrow('config.kv.connection_string is not set');
-	});
-	it('should construct complete error message with all parts', () => {
-		let errorMessage = '';
-		try {
-			throwKVRequiredError({
-				serviceName: 'fluxer_admin',
-				configPath: 'admin.kv.endpoint',
-			});
-		} catch (error) {
-			if (error instanceof Error) {
-				errorMessage = error.message;
-			}
-		}
-		expect(errorMessage).toContain('fluxer_admin requires KV-backed rate limiting');
-		expect(errorMessage).toContain('admin.kv.endpoint is not set');
-		expect(errorMessage).toContain('internal.kv must be configured for distributed rate limiting');
-	});
-	it('should always throw (never return)', () => {
-		const fn = () =>
-			throwKVRequiredError({
-				serviceName: 'test',
-				configPath: 'test.path',
-			});
-		expect(fn).toThrow(Error);
-	});
-	it('should handle empty service name', () => {
-		expect(() =>
-			throwKVRequiredError({
-				serviceName: '',
-				configPath: 'internal.kv',
-			}),
-		).toThrow('requires KV-backed rate limiting');
-	});
-	it('should handle empty config path', () => {
-		expect(() =>
-			throwKVRequiredError({
-				serviceName: 'TestService',
-				configPath: '',
-			}),
-		).toThrow('is not set');
-	});
-});
@@ -1,18 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-import {defineConfig} from 'vitest/config';
-
-export default defineConfig({
-	resolve: {tsconfigPaths: true},
-	test: {
-		globals: true,
-		environment: 'node',
-		include: ['**/*.{test,spec}.{ts,tsx}'],
-		exclude: ['node_modules', 'dist'],
-		coverage: {
-			provider: 'v8',
-			reporter: ['text', 'json', 'html'],
-			exclude: ['**/*.test.tsx', '**/*.spec.tsx', 'node_modules/'],
-		},
-	},
-});
@@ -9,7 +9,7 @@
 	"scripts": {
 		"test": "vitest run",
 		"test:watch": "vitest",
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@fluxer/constants": "workspace:*",
@@ -18,7 +18,7 @@
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:",
+		"typescript": "catalog:ts7",
 		"vitest": "catalog:"
 	}
 }
@@ -1,40 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-import {SmsVerificationUnavailableError} from '@fluxer/errors/src/domains/auth/SmsVerificationUnavailableError';
-import {createMockLogger} from '@fluxer/logger/src/mock';
-import {createSmsProvider} from '@pkgs/sms/src/providers/SmsProviderFactory';
-import {describe, expect, it} from 'vitest';
-
-describe('createSmsProvider', () => {
-	it('creates a test provider that accepts the configured code', async () => {
-		const provider = createSmsProvider({
-			mode: 'test',
-			logger: createMockLogger(),
-			verificationCode: '654321',
-		});
-		await expect(provider.startVerification('+15551234567')).resolves.toBeUndefined();
-		await expect(provider.checkVerification('+15551234567', '654321')).resolves.toBe(true);
-		await expect(provider.checkVerification('+15551234567', '123456')).resolves.toBe(false);
-	});
-	it('creates an unavailable provider that throws on verification checks', async () => {
-		const provider = createSmsProvider({
-			mode: 'unavailable',
-			logger: createMockLogger(),
-		});
-		await expect(provider.startVerification('+15551234567')).resolves.toBeUndefined();
-		await expect(provider.checkVerification('+15551234567', '123456')).rejects.toThrow(SmsVerificationUnavailableError);
-	});
-	it('creates a Twilio provider in twilio mode', async () => {
-		const provider = createSmsProvider({
-			mode: 'twilio',
-			config: {
-				accountSid: 'AC123',
-				authToken: 'twilio-secret',
-				verifyServiceSid: 'VA123',
-			},
-			logger: createMockLogger(),
-			fetchFn: async () => new Response(JSON.stringify({status: 'pending'}), {status: 200}),
-		});
-		await expect(provider.startVerification('+15551234567')).resolves.toBeUndefined();
-	});
-});
@@ -1,46 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-import {createMockLogger} from '@fluxer/logger/src/mock';
-import {TestSmsProvider} from '@pkgs/sms/src/providers/TestSmsProvider';
-import {describe, expect, it} from 'vitest';
-
-describe('TestSmsProvider', () => {
-	describe('startVerification', () => {
-		it('completes without error', async () => {
-			const logger = createMockLogger();
-			const provider = new TestSmsProvider({logger});
-			await expect(provider.startVerification('+15551234567')).resolves.toBeUndefined();
-		});
-		it('supports different phone number formats', async () => {
-			const logger = createMockLogger();
-			const provider = new TestSmsProvider({logger});
-			await expect(provider.startVerification('+14155552671')).resolves.toBeUndefined();
-			await expect(provider.startVerification('+447911123456')).resolves.toBeUndefined();
-			await expect(provider.startVerification('+81312345678')).resolves.toBeUndefined();
-		});
-	});
-	describe('checkVerification', () => {
-		it('returns true for the default valid code', async () => {
-			const logger = createMockLogger();
-			const provider = new TestSmsProvider({logger});
-			await provider.startVerification('+15551234567');
-			const result = await provider.checkVerification('+15551234567', '123456');
-			expect(result).toBe(true);
-		});
-		it('returns false for invalid codes', async () => {
-			const logger = createMockLogger();
-			const provider = new TestSmsProvider({logger});
-			await provider.startVerification('+15551234567');
-			expect(await provider.checkVerification('+15551234567', '000000')).toBe(false);
-			expect(await provider.checkVerification('+15551234567', '654321')).toBe(false);
-			expect(await provider.checkVerification('+15551234567', 'abcdef')).toBe(false);
-			expect(await provider.checkVerification('+15551234567', '')).toBe(false);
-		});
-		it('supports custom verification code overrides', async () => {
-			const logger = createMockLogger();
-			const provider = new TestSmsProvider({logger, verificationCode: '654321'});
-			expect(await provider.checkVerification('+15551111111', '123456')).toBe(false);
-			expect(await provider.checkVerification('+15551111111', '654321')).toBe(true);
-		});
-	});
-});
@@ -38,7 +38,7 @@ describe('TwilioSmsProvider', () => {
 		const fetchStub: typeof fetch = async (_input, init) => {
 			capturedRequest = {
 				url: String(_input),
-				authHeader: (init?.headers as Record<string, string>).Authorization,
+				authHeader: (init?.headers as Record<string, string>)?.Authorization,
 				body: init?.body as string,
 			};
 			return new Response(JSON.stringify({success: true}), {status: 200});
@@ -65,7 +65,7 @@ describe('TwilioSmsProvider', () => {
 		const fetchStub: typeof fetch = async (_input, init) => {
 			capturedRequest = {
 				url: String(_input),
-				authHeader: (init?.headers as Record<string, string>).Authorization,
+				authHeader: (init?.headers as Record<string, string>)?.Authorization,
 				body: init?.body as string,
 			};
 			return new Response(JSON.stringify({channel: 'auto'}), {status: 200});
@@ -232,7 +232,7 @@ describe('TwilioSmsProvider', () => {
 					capturedRequest = {
 						url: String(input),
 						method: init?.method,
-						authHeader: (init?.headers as Record<string, string>).Authorization,
+						authHeader: (init?.headers as Record<string, string>)?.Authorization,
 					};
 					return new Response(
 						JSON.stringify({
@@ -1,7 +1,6 @@
 {
 	"extends": "../../../tsconfigs/package.json",
 	"compilerOptions": {
-		"types": ["node"],
 		"paths": {
 			"@fluxer/*": ["../../../packages/*", "../../../packages/*/src/index.ts"],
 			"@pkgs/*": ["../*"]
@@ -7,7 +7,7 @@
 		"./*": "./*"
 	},
 	"scripts": {
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@fluxer/logger": "workspace:*",
@@ -15,6 +15,6 @@
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:"
+		"typescript": "catalog:ts7"
 	}
 }
@@ -51,7 +51,7 @@
 		"./*": "./*"
 	},
 	"scripts": {
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@fluxer/constants": "workspace:*",
@@ -60,6 +60,6 @@
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:"
+		"typescript": "catalog:ts7"
 	}
 }
@@ -263,6 +263,9 @@ export function buildAPIConfigFromMaster(master: MasterConfig): APIConfig {
 				tokenTtlSecs: uploadRelayConfig.token_ttl_secs,
 				keepDirectCountries: uploadRelayConfig.keep_direct_countries,
 			},
+			attachmentUrls: {
+				secretsBase64: master.services.media_proxy.attachment_urls.secrets_base64,
+			},
 		},
 		geoip: geoipSourceConfig,
 		proxy: {
@@ -479,6 +482,8 @@ export function buildAPIConfigFromMaster(master: MasterConfig): APIConfig {
 				wordmarkUrl: master.instance.branding.wordmark_url,
 				faviconUrl: master.instance.branding.favicon_url,
 				themeColor: master.instance.branding.theme_color,
+				statusPageUrl: master.instance.branding.status_page_url,
+				statusPageIncidentHistoryUrl: master.instance.branding.status_page_incident_history_url,
 			},
 			setup: {
 				configured: master.instance.setup.configured,
@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {ValueOf} from '@fluxer/constants/src/ValueOf';
+import type {AdminAuditAccess} from '@fluxer/schema/src/domains/admin/AdminSchemas';
+
+export const AdminAuditReadActions = {
+	CHECK_BLOCKLIST_ENTRY: 'check_blocklist_entry',
+	GET_ADMIN_API_KEY: 'get_admin_api_key',
+	GET_APPLICATION: 'get_application',
+	GET_ARCHIVE: 'get_archive',
+	GET_ARCHIVE_DOWNLOAD_URL: 'get_archive_download_url',
+	GET_AUDIT_LOG: 'get_audit_log',
+	GET_GATEWAY_STATS: 'get_gateway_stats',
+	GET_GUILD: 'get_guild',
+	GET_INSTANCE_CONFIG: 'get_instance_config',
+	GET_LIMIT_CONFIG: 'get_limit_config',
+	GET_MESSAGE: 'get_message',
+	GET_MESSAGE_SHRED_STATUS: 'get_message_shred_status',
+	GET_REPORT: 'get_report',
+	GET_USER: 'get_user',
+	GET_VOICE_REGION: 'get_voice_region',
+	GET_VOICE_SERVER: 'get_voice_server',
+	GET_VOICE_STATE_COUNTS: 'get_voice_state_counts',
+	LIST_ADMIN_ACLS: 'list_admin_acls',
+	LIST_ADMIN_API_KEYS: 'list_admin_api_keys',
+	LIST_ARCHIVES: 'list_archives',
+	LIST_AUDIT_LOGS: 'list_audit_logs',
+	LIST_BLOCKLIST_ENTRIES: 'list_blocklist_entries',
+	LIST_BLOCKLISTS: 'list_blocklists',
+	LIST_CHANNEL_MESSAGES: 'list_channel_messages',
+	LIST_DISCOVERY_APPLICATIONS: 'list_discovery_applications',
+	LIST_DISCOVERY_CATEGORIES: 'list_discovery_categories',
+	LIST_DISCOVERY_CATEGORY_LISTINGS: 'list_discovery_category_listings',
+	LIST_DISCOVERY_LISTINGS: 'list_discovery_listings',
+	LIST_GUILD_APPLICATIONS: 'list_guild_applications',
+	LIST_GUILD_AUDIT_LOGS: 'list_guild_audit_logs',
+	LIST_GUILD_EMOJIS: 'list_guild_emojis',
+	LIST_GUILD_MEMBERS: 'list_guild_members',
+	LIST_GUILD_MEMORY_STATS: 'list_guild_memory_stats',
+	LIST_GUILD_STICKERS: 'list_guild_stickers',
+	LIST_USER_APPLICATIONS: 'list_user_applications',
+	LIST_USER_CHANGE_LOG: 'list_user_change_log',
+	LIST_USER_DM_CHANNELS: 'list_user_dm_channels',
+	LIST_USER_GUILDS: 'list_user_guilds',
+	LIST_USER_RELATIONSHIPS: 'list_user_relationships',
+	LIST_USER_SESSIONS: 'list_user_sessions',
+	LIST_VOICE_REGIONS: 'list_voice_regions',
+	LIST_VOICE_SERVERS: 'list_voice_servers',
+	LIST_WEBAUTHN_CREDENTIALS: 'list_webauthn_credentials',
+	SEARCH_AUDIT_LOGS: 'search_audit_logs',
+	SEARCH_GUILDS: 'search_guilds',
+	SEARCH_MESSAGES: 'search_messages',
+	SEARCH_REPORTS: 'search_reports',
+	SEARCH_USERS: 'search_users',
+} as const;
+
+export type AdminAuditReadAction = ValueOf<typeof AdminAuditReadActions>;
+
+export const ADMIN_AUDIT_READ_ACTIONS: ReadonlyArray<AdminAuditReadAction> = Object.values(AdminAuditReadActions);
+
+const READ_ACTION_SET: ReadonlySet<string> = new Set(ADMIN_AUDIT_READ_ACTIONS);
+
+export function getAdminAuditAccess(action: string): AdminAuditAccess {
+	return READ_ACTION_SET.has(action) ? 'read' : 'write';
+}
@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {AdminAuditReadAction} from '@app/api/admin/AdminAuditActions';
+import type {HonoEnv} from '@app/api/types/HonoEnv';
+import type {Context} from 'hono';
+
+type AdminAuditMetadataValue = string | number | bigint | boolean | null | undefined;
+
+type AdminAuditMetadataInput = Readonly<Record<string, AdminAuditMetadataValue>>;
+
+interface AdminAuditEntryInput<TAction extends string> {
+	targetType: string;
+	targetId: bigint;
+	action: TAction;
+	metadata?: AdminAuditMetadataInput;
+}
+
+const SNOWFLAKE_PATTERN = /^(0|[1-9][0-9]{0,19})$/;
+
+export function snowflakeOrUndefined(value: string | undefined): string | undefined {
+	return value !== undefined && SNOWFLAKE_PATTERN.test(value) ? value : undefined;
+}
+
+function toAdminAuditMetadata(input: AdminAuditMetadataInput = {}): Map<string, string> {
+	const metadata = new Map<string, string>();
+	for (const [key, value] of Object.entries(input)) {
+		if (value === undefined || value === null) continue;
+		metadata.set(key, String(value));
+	}
+	return metadata;
+}
+
+async function recordAdminAuditEntry(ctx: Context<HonoEnv>, entry: AdminAuditEntryInput<string>): Promise<void> {
+	await ctx.get('adminService').auditService.createAuditLog({
+		adminUserId: ctx.get('adminUserId'),
+		targetType: entry.targetType,
+		targetId: entry.targetId,
+		action: entry.action,
+		auditLogReason: ctx.get('auditLogReason'),
+		metadata: toAdminAuditMetadata(entry.metadata),
+	});
+}
+
+export async function recordAdminRead(
+	ctx: Context<HonoEnv>,
+	entry: AdminAuditEntryInput<AdminAuditReadAction>,
+): Promise<void> {
+	await recordAdminAuditEntry(ctx, entry);
+}
+
+export async function recordAdminWrite(ctx: Context<HonoEnv>, entry: AdminAuditEntryInput<string>): Promise<void> {
+	await recordAdminAuditEntry(ctx, entry);
+}
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead, recordAdminWrite} from '@app/api/admin/AdminAuditRecorder';
 import type {AdminApiKeyView} from '@app/api/admin/services/AdminApiKeyService';
 import {requireAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
@@ -62,6 +64,15 @@ export function AdminApiKeyAdminController(app: HonoApp) {
 				expires_at: result.apiKey.expiresAt?.toISOString() ?? null,
 				acls: Array.from(result.apiKey.acls),
 			};
+			await recordAdminWrite(ctx, {
+				targetType: 'admin_api_key',
+				targetId: BigInt(result.apiKey.keyId),
+				action: 'create_admin_api_key',
+				metadata: {
+					acls: response.acls.join(','),
+					expires_in_days: request.expires_in_days,
+				},
+			});
 			return ctx.json(response);
 		},
 	);
@@ -84,6 +95,12 @@ export function AdminApiKeyAdminController(app: HonoApp) {
 			const user = ctx.get('user');
 			const keys = await adminApiKeyService.listKeys(user.id);
 			const response: Array<ListAdminApiKeyResponseType> = keys.map(toApiKeyResponse);
+			await recordAdminRead(ctx, {
+				targetType: 'admin_api_key',
+				targetId: 0n,
+				action: AdminAuditReadActions.LIST_ADMIN_API_KEYS,
+				metadata: {result_count: response.length},
+			});
 			return ctx.json(response);
 		},
 	);
@@ -107,6 +124,11 @@ export function AdminApiKeyAdminController(app: HonoApp) {
 			const user = ctx.get('user');
 			const keyId = ctx.req.valid('param').key_id;
 			const key = await adminApiKeyService.getKey(keyId, user.id);
+			await recordAdminRead(ctx, {
+				targetType: 'admin_api_key',
+				targetId: keyId,
+				action: AdminAuditReadActions.GET_ADMIN_API_KEY,
+			});
 			return ctx.json(toApiKeyResponse(key));
 		},
 	);
@@ -131,8 +153,19 @@ export function AdminApiKeyAdminController(app: HonoApp) {
 			const user = ctx.get('user');
 			const adminUserAcls = ctx.get('adminUserAcls');
 			const keyId = ctx.req.valid('param').key_id;
-			const key = await adminApiKeyService.updateKey(keyId, user.id, ctx.req.valid('json'), adminUserAcls);
-			return ctx.json(toApiKeyResponse(key));
+			const request = ctx.req.valid('json');
+			const key = await adminApiKeyService.updateKey(keyId, user.id, request, adminUserAcls);
+			const response = toApiKeyResponse(key);
+			await recordAdminWrite(ctx, {
+				targetType: 'admin_api_key',
+				targetId: keyId,
+				action: 'update_admin_api_key',
+				metadata: {
+					fields: (['name', 'acls'] as const).filter((field) => request[field] !== undefined).join(','),
+					acls: request.acls !== undefined ? response.acls.join(',') : undefined,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.delete(
@@ -155,6 +188,11 @@ export function AdminApiKeyAdminController(app: HonoApp) {
 			const user = ctx.get('user');
 			const keyId = ctx.req.valid('param').key_id;
 			await adminApiKeyService.revokeKey(keyId, user.id);
+			await recordAdminWrite(ctx, {
+				targetType: 'admin_api_key',
+				targetId: keyId,
+				action: 'revoke_admin_api_key',
+			});
 			return ctx.json({success: true}, 200);
 		},
 	);
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead} from '@app/api/admin/AdminAuditRecorder';
 import {createApplicationID, createGuildID, createUserID} from '@app/api/BrandedTypes';
 import {requireAdminACL, requireAnyAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
@@ -50,11 +52,25 @@ export function ApplicationAdminController(app: HonoApp) {
 			}
 			if (guildId != null) {
 				requireRequestAdminACL(ctx.get('adminUserAcls'), AdminACLs.APPLICATION_LOOKUP);
-				return ctx.json(await adminService.applicationService.listGuildApplications(createGuildID(guildId)));
+				const response = await adminService.applicationService.listGuildApplications(createGuildID(guildId));
+				await recordAdminRead(ctx, {
+					targetType: 'guild',
+					targetId: guildId,
+					action: AdminAuditReadActions.LIST_GUILD_APPLICATIONS,
+					metadata: {application_count: response.applications.length},
+				});
+				return ctx.json(response);
 			}
 			if (ownerId != null) {
 				requireRequestAdminACL(ctx.get('adminUserAcls'), AdminACLs.APPLICATION_LIST_BY_OWNER);
-				return ctx.json(await adminService.applicationService.listUserApplications(createUserID(ownerId)));
+				const response = await adminService.applicationService.listUserApplications(createUserID(ownerId));
+				await recordAdminRead(ctx, {
+					targetType: 'user',
+					targetId: ownerId,
+					action: AdminAuditReadActions.LIST_USER_APPLICATIONS,
+					metadata: {application_count: response.applications.length},
+				});
+				return ctx.json(response);
 			}
 			throw InputValidationError.create('owner_id', 'One of owner_id and guild_id is required');
 		},
@@ -76,7 +92,14 @@ export function ApplicationAdminController(app: HonoApp) {
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
 			const userId = createUserID(ctx.req.valid('param').user_id);
-			return ctx.json(await adminService.applicationService.listUserApplications(userId));
+			const response = await adminService.applicationService.listUserApplications(userId);
+			await recordAdminRead(ctx, {
+				targetType: 'user',
+				targetId: userId,
+				action: AdminAuditReadActions.LIST_USER_APPLICATIONS,
+				metadata: {application_count: response.applications.length},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -97,7 +120,18 @@ export function ApplicationAdminController(app: HonoApp) {
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
 			const applicationId = createApplicationID(ctx.req.valid('param').application_id);
-			return ctx.json(await adminService.applicationService.lookupApplication(applicationId));
+			const response = await adminService.applicationService.lookupApplication(applicationId);
+			await recordAdminRead(ctx, {
+				targetType: 'application',
+				targetId: applicationId,
+				action: AdminAuditReadActions.GET_APPLICATION,
+				metadata: {
+					found: response.application !== null,
+					owner_user_id: response.application?.owner_user_id,
+					bot_user_id: response.application?.bot_user_id,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.patch(
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead, recordAdminWrite} from '@app/api/admin/AdminAuditRecorder';
 import {createGuildID, createUserID} from '@app/api/BrandedTypes';
 import {requireAdminACL, requireAnyAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
@@ -66,11 +68,15 @@ export function ArchiveAdminController(app: HonoApp) {
 		async (ctx) => {
 			const adminArchiveService = ctx.get('adminArchiveService');
 			const adminUserId = ctx.get('adminUserId');
-			const result = await adminArchiveService.triggerUserArchive(
-				createUserID(ctx.req.valid('param').user_id),
-				adminUserId,
-				ctx.req.valid('json').include_attachments,
-			);
+			const userId = createUserID(ctx.req.valid('param').user_id);
+			const includeAttachments = ctx.req.valid('json').include_attachments;
+			const result = await adminArchiveService.triggerUserArchive(userId, adminUserId, includeAttachments);
+			await recordAdminWrite(ctx, {
+				targetType: 'user',
+				targetId: userId,
+				action: 'trigger_user_archive',
+				metadata: {archive_id: result.archive_id, include_attachments: includeAttachments},
+			});
 			return ctx.json(result, 200);
 		},
 	);
@@ -93,11 +99,15 @@ export function ArchiveAdminController(app: HonoApp) {
 		async (ctx) => {
 			const adminArchiveService = ctx.get('adminArchiveService');
 			const adminUserId = ctx.get('adminUserId');
-			const result = await adminArchiveService.triggerGuildArchive(
-				createGuildID(ctx.req.valid('param').guild_id),
-				adminUserId,
-				ctx.req.valid('json').include_attachments,
-			);
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const includeAttachments = ctx.req.valid('json').include_attachments;
+			const result = await adminArchiveService.triggerGuildArchive(guildId, adminUserId, includeAttachments);
+			await recordAdminWrite(ctx, {
+				targetType: 'guild',
+				targetId: guildId,
+				action: 'trigger_guild_archive',
+				metadata: {archive_id: result.archive_id, include_attachments: includeAttachments},
+			});
 			return ctx.json(result, 200);
 		},
 	);
@@ -120,13 +130,28 @@ export function ArchiveAdminController(app: HonoApp) {
 			const adminArchiveService = ctx.get('adminArchiveService');
 			const adminAcls = ctx.get('adminUserAcls');
 			const query = ctx.req.valid('query');
+			const subjectType = resolveListSubjectType(adminAcls, query.subject_type);
 			const result = await adminArchiveService.listArchives({
-				subjectType: resolveListSubjectType(adminAcls, query.subject_type),
+				subjectType,
 				subjectId: query.subject_id ?? undefined,
 				requestedBy: query.requested_by ?? undefined,
 				limit: query.limit,
 				includeExpired: query.include_expired,
 			});
+			await recordAdminRead(ctx, {
+				targetType: 'archive',
+				targetId: 0n,
+				action: AdminAuditReadActions.LIST_ARCHIVES,
+				metadata: {
+					subject_type: subjectType,
+					subject_user_id: subjectType === 'user' ? query.subject_id : undefined,
+					subject_guild_id: subjectType === 'guild' ? query.subject_id : undefined,
+					requested_by_user_id: query.requested_by,
+					limit: query.limit,
+					include_expired: query.include_expired,
+					result_count: result.length,
+				},
+			});
 			return ctx.json({archives: result}, 200);
 		},
 	);
@@ -151,6 +176,12 @@ export function ArchiveAdminController(app: HonoApp) {
 			const params = ctx.req.valid('param');
 			requireArchiveSubjectAccess(adminAcls, params.subject_type);
 			const archive = await adminArchiveService.getArchive(params.subject_type, params.subject_id, params.archive_id);
+			await recordAdminRead(ctx, {
+				targetType: params.subject_type,
+				targetId: params.subject_id,
+				action: AdminAuditReadActions.GET_ARCHIVE,
+				metadata: {archive_id: params.archive_id, found: archive !== null},
+			});
 			return ctx.json({archive}, 200);
 		},
 	);
@@ -179,6 +210,12 @@ export function ArchiveAdminController(app: HonoApp) {
 				params.subject_id,
 				params.archive_id,
 			);
+			await recordAdminRead(ctx, {
+				targetType: params.subject_type,
+				targetId: params.subject_id,
+				action: AdminAuditReadActions.GET_ARCHIVE_DOWNLOAD_URL,
+				metadata: {archive_id: params.archive_id},
+			});
 			return ctx.json(result, 200);
 		},
 	);
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead, snowflakeOrUndefined} from '@app/api/admin/AdminAuditRecorder';
 import {requireAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
 import {OpenAPI} from '@app/api/middleware/ResponseTypeMiddleware';
@@ -16,6 +18,8 @@ import {
 	ListAdminAuditLogsQuery,
 } from '@fluxer/schema/src/domains/admin/AdminSchemas';

+const AUDIT_TARGET_TYPE_PATTERN = /^[a-z][a-z_]{0,63}$/;
+
 export function AuditLogAdminController(app: HonoApp) {
 	app.get(
 		'/admin/audit-logs',
@@ -34,24 +38,50 @@ export function AuditLogAdminController(app: HonoApp) {
 		}),
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
-			const {q, admin_user_id, target_type, target_id, sort_by, sort_order, limit, offset} = ctx.req.valid('query');
-			if (q === undefined) {
-				return ctx.json(
-					await adminService.auditService.listAuditLogs({admin_user_id, target_type, target_id, limit, offset}),
-				);
-			}
-			return ctx.json(
-				await adminService.auditService.searchAuditLogs({
-					query: q,
-					admin_user_id,
-					target_type,
-					target_id,
-					sort_by,
-					sort_order,
+			const {q, admin_user_id, target_type, target_id, access, sort_by, sort_order, limit, offset} =
+				ctx.req.valid('query');
+			const response =
+				q === undefined
+					? await adminService.auditService.listAuditLogs({
+							admin_user_id,
+							target_type,
+							target_id,
+							access,
+							limit,
+							offset,
+						})
+					: await adminService.auditService.searchAuditLogs({
+							query: q,
+							admin_user_id,
+							target_type,
+							target_id,
+							access,
+							sort_by,
+							sort_order,
+							limit,
+							offset,
+						});
+			await recordAdminRead(ctx, {
+				targetType: 'audit_log',
+				targetId: 0n,
+				action: q === undefined ? AdminAuditReadActions.LIST_AUDIT_LOGS : AdminAuditReadActions.SEARCH_AUDIT_LOGS,
+				metadata: {
+					filter_admin_user_id: admin_user_id,
+					filter_target_type:
+						target_type !== undefined && AUDIT_TARGET_TYPE_PATTERN.test(target_type) ? target_type : undefined,
+					has_target_type_filter:
+						target_type !== undefined && !AUDIT_TARGET_TYPE_PATTERN.test(target_type) ? true : undefined,
+					filter_target_id: snowflakeOrUndefined(target_id),
+					access,
+					sort_by: q === undefined ? undefined : sort_by,
+					sort_order: q === undefined ? undefined : sort_order,
 					limit,
 					offset,
-				}),
-			);
+					result_count: response.logs.length,
+					total: response.total,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -76,6 +106,11 @@ export function AuditLogAdminController(app: HonoApp) {
 			if (!log) {
 				throw new NotFoundError({code: APIErrorCodes.NOT_FOUND});
 			}
+			await recordAdminRead(ctx, {
+				targetType: 'audit_log',
+				targetId: log_id,
+				action: AdminAuditReadActions.GET_AUDIT_LOG,
+			});
 			return ctx.json(log);
 		},
 	);
@@ -1,5 +1,8 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead, recordAdminWrite} from '@app/api/admin/AdminAuditRecorder';
+import type {AdminBanManagementService} from '@app/api/admin/services/AdminBanManagementService';
 import {requireAdminACL, requireAnyAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
 import {OpenAPI} from '@app/api/middleware/ResponseTypeMiddleware';
@@ -180,6 +183,18 @@ const BLOCKLIST_TYPE_ACLS: Record<AdminBlocklistListType, {add: string; check: s
 	},
 };

+const BLOCKLIST_AUDIT_TARGET_TYPES: Record<AdminBlocklistListType, string> = {
+	ip: 'ip',
+	email: 'email',
+	'email-domain-suspicious': 'email_domain',
+	phrase: 'phrase',
+	url: 'url',
+	'url-domain': 'url_domain',
+	'file-sha': 'file_sha',
+	'avatar-hash': 'avatar_hash',
+	'profile-substring': 'profile_substring',
+};
+
 type BlocklistVerb = 'add' | 'check' | 'remove';

 const BLOCKLIST_ACLS_BY_VERB: Record<BlocklistVerb, Array<string>> = {
@@ -229,6 +244,37 @@ async function parseBlocklistBody<T>(schema: ZodType<T>, value: unknown): Promis
 	return result.data;
 }

+async function checkBlocklistEntry(
+	bans: AdminBanManagementService,
+	listType: AdminBlocklistListType,
+	entryValue: string,
+	scope: ProfileSubstringScope | undefined,
+): Promise<{banned: boolean}> {
+	switch (listType) {
+		case 'ip':
+			return bans.checkIpBan({ip: entryValue});
+		case 'email':
+			return bans.checkEmailBan({email: entryValue});
+		case 'email-domain-suspicious':
+			return bans.checkSuspiciousEmailDomain({domain: entryValue});
+		case 'phrase':
+			return bans.checkPhraseBan({phrase: entryValue});
+		case 'url':
+			return bans.checkUrlBan({url: entryValue});
+		case 'url-domain':
+			return bans.checkUrlDomainBan({domain: entryValue});
+		case 'file-sha':
+			return bans.checkFileShaBan({sha256_hex: entryValue});
+		case 'avatar-hash':
+			return bans.checkAvatarHashBan({hashes: [entryValue]});
+		case 'profile-substring':
+			return bans.checkProfileSubstringBan({
+				scope: requireProfileSubstringScope(scope),
+				substrings: [entryValue],
+			});
+	}
+}
+
 export function BanAdminController(app: HonoApp) {
 	app.get(
 		'/admin/blocklists',
@@ -245,6 +291,12 @@ export function BanAdminController(app: HonoApp) {
 				'List every blocklist this instance maintains, the request field that carries an entry value, the extra fields its entries accept, and which of the bulk and update operations it supports.',
 		}),
 		async (ctx) => {
+			await recordAdminRead(ctx, {
+				targetType: 'blocklist',
+				targetId: 0n,
+				action: AdminAuditReadActions.LIST_BLOCKLISTS,
+				metadata: {result_count: BLOCKLIST_CATALOG.length},
+			});
 			return ctx.json({items: BLOCKLIST_CATALOG});
 		},
 	);
@@ -270,14 +322,26 @@ export function BanAdminController(app: HonoApp) {
 			requireBlocklistACL(ctx.get('adminUserAcls'), listType, 'check');
 			const {limit, after, scope} = ctx.req.valid('query');
 			assertBlocklistScopeAllowed(listType, scope);
-			return ctx.json(
-				await adminService.banManagementService.listBlocklistEntries({
-					listType,
+			const page = await adminService.banManagementService.listBlocklistEntries({
+				listType,
+				limit,
+				after: after ?? null,
+				scope: listType === 'profile-substring' ? requireProfileSubstringScope(scope) : null,
+			});
+			await recordAdminRead(ctx, {
+				targetType: BLOCKLIST_AUDIT_TARGET_TYPES[listType],
+				targetId: 0n,
+				action: AdminAuditReadActions.LIST_BLOCKLIST_ENTRIES,
+				metadata: {
+					list_type: listType,
+					scope,
 					limit,
-					after: after ?? null,
-					scope: listType === 'profile-substring' ? requireProfileSubstringScope(scope) : null,
-				}),
-			);
+					has_after: after === undefined ? undefined : true,
+					result_count: page.items.length,
+					has_more: page.has_more,
+				},
+			});
+			return ctx.json(page);
 		},
 	);
 	app.post(
@@ -379,6 +443,15 @@ export function BanAdminController(app: HonoApp) {
 				},
 				{requestedByUserId: adminUserId, requireLedger: true, ...(auditLogReason && {auditLogReason})},
 			);
+			await recordAdminWrite(ctx, {
+				targetType: 'bulk_job',
+				targetId: jobId,
+				action: 'queue_bulk_job',
+				metadata: {
+					task: 'ban_file_shas',
+					entity_count: body.sha256_list.length,
+				},
+			});
 			return ctx.json({job_id: jobId.toString()});
 		},
 	);
@@ -449,32 +522,18 @@ export function BanAdminController(app: HonoApp) {
 			requireBlocklistACL(ctx.get('adminUserAcls'), listType, 'check');
 			const {scope} = ctx.req.valid('query');
 			assertBlocklistScopeAllowed(listType, scope);
-			const bans = adminService.banManagementService;
-			switch (listType) {
-				case 'ip':
-					return ctx.json(await bans.checkIpBan({ip: entryValue}));
-				case 'email':
-					return ctx.json(await bans.checkEmailBan({email: entryValue}));
-				case 'email-domain-suspicious':
-					return ctx.json(await bans.checkSuspiciousEmailDomain({domain: entryValue}));
-				case 'phrase':
-					return ctx.json(await bans.checkPhraseBan({phrase: entryValue}));
-				case 'url':
-					return ctx.json(await bans.checkUrlBan({url: entryValue}));
-				case 'url-domain':
-					return ctx.json(await bans.checkUrlDomainBan({domain: entryValue}));
-				case 'file-sha':
-					return ctx.json(await bans.checkFileShaBan({sha256_hex: entryValue}));
-				case 'avatar-hash':
-					return ctx.json(await bans.checkAvatarHashBan({hashes: [entryValue]}));
-				case 'profile-substring':
-					return ctx.json(
-						await bans.checkProfileSubstringBan({
-							scope: requireProfileSubstringScope(scope),
-							substrings: [entryValue],
-						}),
-					);
-			}
+			const result = await checkBlocklistEntry(adminService.banManagementService, listType, entryValue, scope);
+			await recordAdminRead(ctx, {
+				targetType: BLOCKLIST_AUDIT_TARGET_TYPES[listType],
+				targetId: 0n,
+				action: AdminAuditReadActions.CHECK_BLOCKLIST_ENTRY,
+				metadata: {
+					list_type: listType,
+					scope,
+					banned: result.banned,
+				},
+			});
+			return ctx.json(result);
 		},
 	);
 	app.patch(
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+import {recordAdminWrite} from '@app/api/admin/AdminAuditRecorder';
 import type {UserID} from '@app/api/BrandedTypes';
 import {requireAnyAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
@@ -136,6 +137,16 @@ export function BulkAdminController(app: HonoApp) {
 				throw new MissingACLError(requiredAcl);
 			}
 			const jobId = await queueBulkJob(body, adminUserId, auditLogReason);
+			await recordAdminWrite(ctx, {
+				targetType: 'bulk_job',
+				targetId: jobId,
+				action: 'queue_bulk_job',
+				metadata: {
+					task: body.task,
+					entity_count: 'guild_ids' in body ? body.guild_ids.length : body.user_ids.length,
+					guild_id: body.task === AdminBulkTaskType.ADD_GUILD_MEMBERS ? body.guild_id : undefined,
+				},
+			});
 			return ctx.json({job_id: jobId.toString()});
 		},
 	);
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead, recordAdminWrite} from '@app/api/admin/AdminAuditRecorder';
 import {createGuildID} from '@app/api/BrandedTypes';
 import type {GuildDiscoveryRow} from '@app/api/database/types/GuildDiscoveryTypes';
 import {mapGuildFeatures} from '@app/api/guild/GuildFeatureUtils';
@@ -30,6 +32,8 @@ import {
 	DiscoveryCategoryListResponse,
 } from '@fluxer/schema/src/domains/guild/GuildDiscoverySchemas';

+const DISCOVERY_LISTING_FIELDS = ['description', 'category_type', 'primary_language', 'custom_tags'] as const;
+
 function mapRowToApplicationResponse(row: GuildDiscoveryRow) {
 	return {
 		guild_id: row.guild_id.toString(),
@@ -149,6 +153,12 @@ export function DiscoveryAdminController(app: HonoApp) {
 			const userRepository = ctx.get('userRepository');
 			const rows = await discoveryService.listByStatus({status: DiscoveryApplicationStatus.PENDING});
 			const enrichment = await enrichGuilds(rows, guildService, userRepository);
+			await recordAdminRead(ctx, {
+				targetType: 'guild',
+				targetId: 0n,
+				action: AdminAuditReadActions.LIST_DISCOVERY_APPLICATIONS,
+				metadata: {result_count: rows.length},
+			});
 			return ctx.json(rows.map((row) => mapPendingResponse(row, enrichment.get(row.guild_id.toString()))));
 		},
 	);
@@ -173,10 +183,16 @@ export function DiscoveryAdminController(app: HonoApp) {
 			const data = ctx.req.valid('json');
 			const adminUserId = ctx.get('adminUserId');
 			const discoveryService = ctx.get('discoveryService');
-			const row =
-				data.status === DiscoveryApplicationStatus.APPROVED
-					? await discoveryService.approve({guildId, adminUserId, reason: data.reason})
-					: await discoveryService.reject({guildId, adminUserId, reason: data.reason});
+			const approved = data.status === DiscoveryApplicationStatus.APPROVED;
+			const row = approved
+				? await discoveryService.approve({guildId, adminUserId, reason: data.reason})
+				: await discoveryService.reject({guildId, adminUserId, reason: data.reason});
+			await recordAdminWrite(ctx, {
+				targetType: 'guild',
+				targetId: guildId,
+				action: approved ? 'approve_discovery_application' : 'reject_discovery_application',
+				metadata: {status: data.status},
+			});
 			return ctx.json(mapRowToApplicationResponse(row));
 		},
 	);
@@ -195,12 +211,17 @@ export function DiscoveryAdminController(app: HonoApp) {
 			tags: 'Admin',
 		}),
 		async (ctx) => {
-			return ctx.json(
-				Object.entries(DiscoveryCategoryLabels).map(([id, name]) => ({
-					id: Number(id),
-					name,
-				})),
-			);
+			const categories = Object.entries(DiscoveryCategoryLabels).map(([id, name]) => ({
+				id: Number(id),
+				name,
+			}));
+			await recordAdminRead(ctx, {
+				targetType: 'discovery_category',
+				targetId: 0n,
+				action: AdminAuditReadActions.LIST_DISCOVERY_CATEGORIES,
+				metadata: {result_count: categories.length},
+			});
+			return ctx.json(categories);
 		},
 	);
 	app.get(
@@ -233,11 +254,20 @@ export function DiscoveryAdminController(app: HonoApp) {
 					(enrichment.get(right.guild_id.toString())?.member_count ?? 0) -
 					(enrichment.get(left.guild_id.toString())?.member_count ?? 0),
 			);
-			return ctx.json(
-				sorted
-					.slice(offset, offset + limit)
-					.map((row) => mapListedResponse(row, enrichment.get(row.guild_id.toString()))),
-			);
+			const page = sorted.slice(offset, offset + limit);
+			await recordAdminRead(ctx, {
+				targetType: 'discovery_category',
+				targetId: 0n,
+				action: AdminAuditReadActions.LIST_DISCOVERY_CATEGORY_LISTINGS,
+				metadata: {
+					category_id,
+					limit,
+					offset,
+					result_count: page.length,
+					total: inCategory.length,
+				},
+			});
+			return ctx.json(page.map((row) => mapListedResponse(row, enrichment.get(row.guild_id.toString()))));
 		},
 	);
 	app.get(
@@ -260,6 +290,12 @@ export function DiscoveryAdminController(app: HonoApp) {
 			const userRepository = ctx.get('userRepository');
 			const rows = await discoveryService.listByStatus({status: DiscoveryApplicationStatus.APPROVED});
 			const enrichment = await enrichGuilds(rows, guildService, userRepository);
+			await recordAdminRead(ctx, {
+				targetType: 'guild',
+				targetId: 0n,
+				action: AdminAuditReadActions.LIST_DISCOVERY_LISTINGS,
+				metadata: {result_count: rows.length},
+			});
 			return ctx.json(rows.map((row) => mapListedResponse(row, enrichment.get(row.guild_id.toString()))));
 		},
 	);
@@ -341,6 +377,18 @@ export function DiscoveryAdminController(app: HonoApp) {
 			const adminUserId = ctx.get('adminUserId');
 			const discoveryService = ctx.get('discoveryService');
 			const row = await discoveryService.editApplication({guildId, userId: adminUserId, data});
+			const fields = DISCOVERY_LISTING_FIELDS.filter((field) => data[field] !== undefined);
+			await recordAdminWrite(ctx, {
+				targetType: 'guild',
+				targetId: guildId,
+				action: 'update_discovery_listing',
+				metadata: {
+					fields: fields.length > 0 ? fields.join(',') : undefined,
+					category_type: data.category_type,
+					primary_language: data.primary_language,
+					status: row.status,
+				},
+			});
 			return ctx.json(mapRowToApplicationResponse(row));
 		},
 	);
@@ -366,6 +414,11 @@ export function DiscoveryAdminController(app: HonoApp) {
 			const adminUserId = ctx.get('adminUserId');
 			const discoveryService = ctx.get('discoveryService');
 			const row = await discoveryService.remove({guildId, adminUserId, reason: data.reason});
+			await recordAdminWrite(ctx, {
+				targetType: 'guild',
+				targetId: guildId,
+				action: 'remove_discovery_listing',
+			});
 			return ctx.json(mapRowToApplicationResponse(row));
 		},
 	);
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead} from '@app/api/admin/AdminAuditRecorder';
 import {createGuildID} from '@app/api/BrandedTypes';
 import {requireAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
@@ -34,7 +36,14 @@ export function GatewayAdminController(app: HonoApp) {
 		}),
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
-			return ctx.json(await adminService.guildServiceAggregate.managementService.getNodeStats());
+			const stats = await adminService.guildServiceAggregate.managementService.getNodeStats();
+			await recordAdminRead(ctx, {
+				targetType: 'gateway',
+				targetId: 0n,
+				action: AdminAuditReadActions.GET_GATEWAY_STATS,
+				metadata: {node_count: stats.node_count},
+			});
+			return ctx.json(stats);
 		},
 	);
 	app.get(
@@ -54,7 +63,14 @@ export function GatewayAdminController(app: HonoApp) {
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
 			const {limit} = ctx.req.valid('query');
-			return ctx.json(await adminService.guildServiceAggregate.managementService.getGuildMemoryStats(limit));
+			const stats = await adminService.guildServiceAggregate.managementService.getGuildMemoryStats(limit);
+			await recordAdminRead(ctx, {
+				targetType: 'guild',
+				targetId: 0n,
+				action: AdminAuditReadActions.LIST_GUILD_MEMORY_STATS,
+				metadata: {limit, result_count: stats.guilds.length},
+			});
+			return ctx.json(stats);
 		},
 	);
 	app.get(
@@ -73,7 +89,18 @@ export function GatewayAdminController(app: HonoApp) {
 		}),
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
-			return ctx.json(await adminService.guildServiceAggregate.managementService.getVoiceStateCounts());
+			const counts = await adminService.guildServiceAggregate.managementService.getVoiceStateCounts();
+			await recordAdminRead(ctx, {
+				targetType: 'gateway',
+				targetId: 0n,
+				action: AdminAuditReadActions.GET_VOICE_STATE_COUNTS,
+				metadata: {
+					total_voice_states: counts.total_voice_states,
+					region_count: counts.regions.length,
+					server_count: counts.servers.length,
+				},
+			});
+			return ctx.json(counts);
 		},
 	);
 	app.post(
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead, recordAdminWrite} from '@app/api/admin/AdminAuditRecorder';
 import {createGuildID} from '@app/api/BrandedTypes';
 import {requireAdminACL, requireAnyAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
@@ -107,13 +109,24 @@ export function GuildAdminController(app: HonoApp) {
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
 			const query = ctx.req.valid('query');
-			return ctx.json(
-				await adminService.searchService.searchGuilds({
-					query: query.q,
+			const response = await adminService.searchService.searchGuilds({
+				query: query.q,
+				limit: query.limit,
+				offset: query.offset,
+			});
+			await recordAdminRead(ctx, {
+				targetType: 'guild',
+				targetId: 0n,
+				action: AdminAuditReadActions.SEARCH_GUILDS,
+				metadata: {
+					has_query: query.q === undefined ? undefined : true,
 					limit: query.limit,
 					offset: query.offset,
-				}),
-			);
+					result_count: response.guilds.length,
+					total: response.total,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -133,11 +146,15 @@ export function GuildAdminController(app: HonoApp) {
 		}),
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
-			return ctx.json(
-				await adminService.guildServiceAggregate.lookupService.lookupGuild({
-					guild_id: ctx.req.valid('param').guild_id,
-				}),
-			);
+			const {guild_id} = ctx.req.valid('param');
+			const response = await adminService.guildServiceAggregate.lookupService.lookupGuild({guild_id});
+			await recordAdminRead(ctx, {
+				targetType: 'guild',
+				targetId: guild_id,
+				action: AdminAuditReadActions.GET_GUILD,
+				metadata: {found: response.guild !== null},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.patch(
@@ -215,6 +232,16 @@ export function GuildAdminController(app: HonoApp) {
 			if (!guild) {
 				throw new UnknownGuildError();
 			}
+			const appliedFieldGroup =
+				body.fields !== undefined ||
+				hasGuildSettingsUpdate(body) ||
+				hasGuildFeatureUpdate(body) ||
+				body.name !== undefined ||
+				body.vanity_url_code !== undefined ||
+				body.new_owner_id !== undefined;
+			if (!appliedFieldGroup) {
+				await recordAdminWrite(ctx, {targetType: 'guild', targetId: guildIdRaw, action: 'update_guild'});
+			}
 			return ctx.json({
 				guild: {
 					id: guild.id,
@@ -275,14 +302,25 @@ export function GuildAdminController(app: HonoApp) {
 		}),
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
+			const {guild_id} = ctx.req.valid('param');
 			const query = ctx.req.valid('query');
-			return ctx.json(
-				await adminService.guildServiceAggregate.lookupService.listGuildMembers({
-					guild_id: ctx.req.valid('param').guild_id,
-					limit: query.limit,
-					offset: query.offset,
-				}),
-			);
+			const response = await adminService.guildServiceAggregate.lookupService.listGuildMembers({
+				guild_id,
+				limit: query.limit,
+				offset: query.offset,
+			});
+			await recordAdminRead(ctx, {
+				targetType: 'guild',
+				targetId: guild_id,
+				action: AdminAuditReadActions.LIST_GUILD_MEMBERS,
+				metadata: {
+					limit: response.limit,
+					offset: response.offset,
+					result_count: response.members.length,
+					total: response.total,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.put(
@@ -391,7 +429,14 @@ export function GuildAdminController(app: HonoApp) {
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
 			const guildId = createGuildID(ctx.req.valid('param').guild_id);
-			return ctx.json(await adminService.guildServiceAggregate.lookupService.listGuildEmojis(guildId));
+			const response = await adminService.guildServiceAggregate.lookupService.listGuildEmojis(guildId);
+			await recordAdminRead(ctx, {
+				targetType: 'guild',
+				targetId: guildId,
+				action: AdminAuditReadActions.LIST_GUILD_EMOJIS,
+				metadata: {result_count: response.emojis.length},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -412,7 +457,14 @@ export function GuildAdminController(app: HonoApp) {
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
 			const guildId = createGuildID(ctx.req.valid('param').guild_id);
-			return ctx.json(await adminService.guildServiceAggregate.lookupService.listGuildStickers(guildId));
+			const response = await adminService.guildServiceAggregate.lookupService.listGuildStickers(guildId);
+			await recordAdminRead(ctx, {
+				targetType: 'guild',
+				targetId: guildId,
+				action: AdminAuditReadActions.LIST_GUILD_STICKERS,
+				metadata: {result_count: response.stickers.length},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -433,17 +485,30 @@ export function GuildAdminController(app: HonoApp) {
 		}),
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
+			const {guild_id} = ctx.req.valid('param');
 			const query = ctx.req.valid('query');
-			return ctx.json(
-				await adminService.guildServiceAggregate.listGuildAuditLogs({
-					guild_id: ctx.req.valid('param').guild_id,
+			const response = await adminService.guildServiceAggregate.listGuildAuditLogs({
+				guild_id,
+				limit: query.limit,
+				before: query.before,
+				after: query.after,
+				user_id: query.user_id,
+				action_type: query.action_type,
+			});
+			await recordAdminRead(ctx, {
+				targetType: 'guild',
+				targetId: guild_id,
+				action: AdminAuditReadActions.LIST_GUILD_AUDIT_LOGS,
+				metadata: {
 					limit: query.limit,
 					before: query.before,
 					after: query.after,
-					user_id: query.user_id,
+					filter_user_id: query.user_id,
 					action_type: query.action_type,
-				}),
-			);
+					result_count: response.audit_log_entries.length,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.post(
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead, recordAdminWrite} from '@app/api/admin/AdminAuditRecorder';
 import {createUserID} from '@app/api/BrandedTypes';
 import {Config} from '@app/api/Config';
 import {
@@ -167,16 +169,25 @@ function completesInitialSetup(data: InstanceConfigUpdateRequest, setupConfigure
 	);
 }

-async function grantSetupCompleterAdminACL(ctx: Context<HonoEnv>): Promise<void> {
+async function grantSetupCompleterAdminACL(ctx: Context<HonoEnv>): Promise<boolean> {
 	const user = ctx.get('user');
 	if (!user || ctx.get('authTokenType') !== 'session' || hasAdminAuthenticationACL(user.acls)) {
-		return;
+		return false;
 	}
 	const nextACLs = new Set(user.acls);
 	nextACLs.add(AdminACLs.WILDCARD);
 	const updatedUser = await ctx.get('userRepository').patchUpsert(user.id, {acls: nextACLs}, user.toRow());
 	ctx.set('user', updatedUser);
 	ctx.set('adminUserAcls', updatedUser.acls);
+	return true;
+}
+
+function listSuppliedSections(data: InstanceConfigUpdateRequest): string | undefined {
+	const sections = Object.entries(data)
+		.filter(([, value]) => value != null)
+		.map(([key]) => key)
+		.sort();
+	return sections.length > 0 ? sections.join(',') : undefined;
 }

 export function InstanceConfigAdminController(app: HonoApp) {
@@ -196,7 +207,17 @@ export function InstanceConfigAdminController(app: HonoApp) {
 			tags: 'Admin',
 		}),
 		async (ctx) => {
-			return ctx.json(await buildInstanceConfigResponse());
+			const response = await buildInstanceConfigResponse();
+			await recordAdminRead(ctx, {
+				targetType: 'instance_config',
+				targetId: 0n,
+				action: AdminAuditReadActions.GET_INSTANCE_CONFIG,
+				metadata: {
+					registration_url_count: response.registration.urls.length,
+					pending_registration_count: response.registration.pending_registrations.length,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.patch(
@@ -305,6 +326,11 @@ export function InstanceConfigAdminController(app: HonoApp) {
 								wordmark_url: readOptionalField(data.app_public.branding, 'wordmark_url'),
 								favicon_url: readOptionalField(data.app_public.branding, 'favicon_url'),
 								theme_color: readOptionalField(data.app_public.branding, 'theme_color'),
+								status_page_url: readOptionalField(data.app_public.branding, 'status_page_url'),
+								status_page_incident_history_url: readOptionalField(
+									data.app_public.branding,
+									'status_page_incident_history_url',
+								),
 							})
 						: undefined,
 					legal: data.app_public.legal
@@ -406,10 +432,20 @@ export function InstanceConfigAdminController(app: HonoApp) {
 					}),
 				});
 			}
+			let grantedSetupCompleterAdmin = false;
 			if (shouldGrantSetupCompleterAdmin) {
-				await grantSetupCompleterAdminACL(ctx);
+				grantedSetupCompleterAdmin = await grantSetupCompleterAdminACL(ctx);
 				await instanceConfigRepository.markAdminBootstrapped();
 			}
+			await recordAdminWrite(ctx, {
+				targetType: 'instance_config',
+				targetId: 0n,
+				action: 'update_instance_config',
+				metadata: {
+					sections: listSuppliedSections(data),
+					granted_acls: grantedSetupCompleterAdmin ? AdminACLs.WILDCARD : undefined,
+				},
+			});
 			return ctx.json(await buildInstanceConfigResponse());
 		},
 	);
@@ -440,6 +476,12 @@ export function InstanceConfigAdminController(app: HonoApp) {
 			});
 			const brandingPatch: Partial<InstanceBranding> = {[`${kind}_url`]: prepared.newCdnUrl};
 			await instanceConfigRepository.setAppPublicConfig({branding: brandingPatch});
+			await recordAdminWrite(ctx, {
+				targetType: 'instance_config',
+				targetId: 0n,
+				action: 'upload_branding_asset',
+				metadata: {kind, cleared: prepared.newCdnUrl === null},
+			});
 			return ctx.json(await buildInstanceConfigResponse());
 		},
 	);
@@ -460,6 +502,7 @@ export function InstanceConfigAdminController(app: HonoApp) {
 		}),
 		async (ctx) => {
 			const data = ctx.req.valid('json');
+			let result: InstanceEmailSmtpTestResponse;
 			try {
 				const provider = new SmtpEmailProvider({
 					host: data.host,
@@ -472,10 +515,17 @@ export function InstanceConfigAdminController(app: HonoApp) {
 					socketTimeoutMs: 10000,
 				});
 				await provider.verify();
-				return ctx.json({ok: true, error: null});
+				result = {ok: true, error: null};
 			} catch (error) {
-				return ctx.json({ok: false, error: error instanceof Error ? error.message : String(error)});
+				result = {ok: false, error: error instanceof Error ? error.message : String(error)};
 			}
+			await recordAdminWrite(ctx, {
+				targetType: 'instance_config',
+				targetId: 0n,
+				action: 'test_smtp_connection',
+				metadata: {port: data.port, secure: data.secure, ok: result.ok},
+			});
+			return ctx.json(result);
 		},
 	);
 	app.post(
@@ -502,6 +552,12 @@ export function InstanceConfigAdminController(app: HonoApp) {
 				maxUses: data.max_uses ?? null,
 				approvalRequired: data.approval_required,
 			});
+			await recordAdminWrite(ctx, {
+				targetType: 'registration_url',
+				targetId: 0n,
+				action: 'create_registration_url',
+				metadata: {approval_required: data.approval_required, max_uses: data.max_uses},
+			});
 			return ctx.json({
 				registration_url: created.registrationUrl,
 				code: created.code,
@@ -526,6 +582,11 @@ export function InstanceConfigAdminController(app: HonoApp) {
 		}),
 		async (ctx) => {
 			await instanceConfigRepository.revokeRegistrationUrl(ctx.req.valid('param').registration_url_id);
+			await recordAdminWrite(ctx, {
+				targetType: 'registration_url',
+				targetId: 0n,
+				action: 'revoke_registration_url',
+			});
 			return ctx.json(await buildInstanceConfigResponse());
 		},
 	);
@@ -642,6 +703,12 @@ async function updatePendingRegistrationUser(
 	const userRepository = ctx.get('userRepository');
 	const user = await userRepository.findUnique(createUserID(BigInt(userId)));
 	if (!user) {
+		await recordAdminWrite(ctx, {
+			targetType: 'user',
+			targetId: BigInt(userId),
+			action: decision === 'approve' ? 'approve_registration' : 'reject_registration',
+			metadata: {account_found: false},
+		});
 		return;
 	}
 	const traits = new Set(user.traits);
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+import {recordAdminWrite} from '@app/api/admin/AdminAuditRecorder';
 import {requireAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
 import {OpenAPI} from '@app/api/middleware/ResponseTypeMiddleware';
@@ -114,7 +115,15 @@ export function JobsAdminController(app: HonoApp) {
 		}),
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
-			return ctx.json(await adminService.jobAdminService.cancelJob(ctx.req.valid('param').job_id));
+			const {job_id} = ctx.req.valid('param');
+			const result = await adminService.jobAdminService.cancelJob(job_id);
+			await recordAdminWrite(ctx, {
+				targetType: 'bulk_job',
+				targetId: job_id,
+				action: 'cancel_job',
+				metadata: {cancelled: result.cancelled},
+			});
+			return ctx.json(result);
 		},
 	);
 }
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead, recordAdminWrite} from '@app/api/admin/AdminAuditRecorder';
 import {Config} from '@app/api/Config';
 import type {LimitConfigService} from '@app/api/limits/LimitConfigService';
 import {requireAdminACL} from '@app/api/middleware/AdminMiddleware';
@@ -10,7 +12,7 @@ import type {HonoApp} from '@app/api/types/HonoEnv';
 import {Validator} from '@app/api/Validator';
 import {AdminACLs} from '@fluxer/constants/src/AdminACLs';
 import {LIMIT_CATEGORY_LABELS, LIMIT_KEY_METADATA, LIMIT_KEYS} from '@fluxer/constants/src/LimitConfigMetadata';
-import type {LimitConfigSnapshot} from '@fluxer/limits/src/LimitTypes';
+import type {LimitConfigSnapshot, LimitRule} from '@fluxer/limits/src/LimitTypes';
 import {LimitConfigGetResponse, LimitConfigUpdateRequest} from '@fluxer/schema/src/domains/admin/AdminSchemas';

 function formatConfig(service: LimitConfigService) {
@@ -27,6 +29,21 @@ function formatConfig(service: LimitConfigService) {
 	};
 }

+function describeLimitRule(rule: LimitRule): string {
+	return JSON.stringify([
+		rule.filters?.traits ?? [],
+		rule.filters?.guildFeatures ?? [],
+		LIMIT_KEYS.map((key) => rule.limits[key] ?? null),
+	]);
+}
+
+function countChangedLimitRules(before: LimitConfigSnapshot, after: LimitConfigSnapshot): number {
+	const previous = new Map(before.rules.map((rule) => [rule.id, describeLimitRule(rule)]));
+	const next = new Map(after.rules.map((rule) => [rule.id, describeLimitRule(rule)]));
+	const ruleIds = new Set([...previous.keys(), ...next.keys()]);
+	return Array.from(ruleIds).filter((ruleId) => previous.get(ruleId) !== next.get(ruleId)).length;
+}
+
 export function LimitConfigAdminController(app: HonoApp) {
 	app.get(
 		'/admin/limit-config',
@@ -44,7 +61,14 @@ export function LimitConfigAdminController(app: HonoApp) {
 		}),
 		async (ctx) => {
 			const limitConfigService = ctx.get('limitConfigService') as LimitConfigService;
-			return ctx.json(formatConfig(limitConfigService));
+			const response = formatConfig(limitConfigService);
+			await recordAdminRead(ctx, {
+				targetType: 'limit_config',
+				targetId: 0n,
+				action: AdminAuditReadActions.GET_LIMIT_CONFIG,
+				metadata: {rule_count: response.limit_config.rules.length},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.put(
@@ -69,8 +93,20 @@ export function LimitConfigAdminController(app: HonoApp) {
 				...data.limit_config,
 				traitDefinitions: data.limit_config.traitDefinitions ?? [],
 			};
+			const previous = limitConfigService.getConfigSnapshot();
 			await limitConfigService.updateConfig(normalized);
-			return ctx.json(formatConfig(limitConfigService));
+			const response = formatConfig(limitConfigService);
+			await recordAdminWrite(ctx, {
+				targetType: 'limit_config',
+				targetId: 0n,
+				action: 'update_limit_config',
+				metadata: {
+					rule_count: response.limit_config.rules.length,
+					changed_rule_count: countChangedLimitRules(previous, response.limit_config),
+					trait_definition_count: response.limit_config.traitDefinitions.length,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 }
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead} from '@app/api/admin/AdminAuditRecorder';
 import {createAttachmentID, createChannelID, createMessageID, createReportID} from '@app/api/BrandedTypes';
 import {requireAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
@@ -57,34 +59,69 @@ export function MessageAdminController(app: HonoApp) {
 			const adminService = ctx.get('adminService');
 			const query = ctx.req.valid('query');
 			if (query.message_id != null) {
-				return ctx.json(
-					await adminService.messageService.lookupMessage({
+				const messageId = query.message_id;
+				const response = await adminService.messageService.lookupMessage({
+					channel_id: query.channel_id,
+					message_id: messageId,
+					context_limit: query.context_limit,
+				});
+				await recordAdminRead(ctx, {
+					targetType: 'message',
+					targetId: messageId,
+					action: AdminAuditReadActions.SEARCH_MESSAGES,
+					metadata: {
+						mode: 'message',
 						channel_id: query.channel_id,
-						message_id: query.message_id,
 						context_limit: query.context_limit,
-					}),
-				);
+						found: response.messages.some((message) => message.id === messageId.toString()),
+						result_count: response.messages.length,
+					},
+				});
+				return ctx.json(response);
 			}
 			if (query.attachment_id != null) {
 				if (query.filename == null) {
 					throw InputValidationError.fromCode('filename', ValidationErrorCodes.INVALID_FORMAT);
 				}
-				return ctx.json(
-					await adminService.messageService.lookupMessageByAttachment({
-						channel_id: query.channel_id,
-						attachment_id: query.attachment_id,
-						filename: query.filename,
-						context_limit: query.context_limit,
-					}),
-				);
-			}
-			return ctx.json(
-				await adminService.messageService.searchChannelMessages({
+				const response = await adminService.messageService.lookupMessageByAttachment({
 					channel_id: query.channel_id,
-					query: query.q ?? '',
+					attachment_id: query.attachment_id,
+					filename: query.filename,
+					context_limit: query.context_limit,
+				});
+				await recordAdminRead(ctx, {
+					targetType: 'channel',
+					targetId: query.channel_id,
+					action: AdminAuditReadActions.SEARCH_MESSAGES,
+					metadata: {
+						mode: 'attachment',
+						attachment_id: query.attachment_id,
+						message_id: response.message_id,
+						context_limit: query.context_limit,
+						found: response.message_id !== null,
+						result_count: response.messages.length,
+					},
+				});
+				return ctx.json(response);
+			}
+			const response = await adminService.messageService.searchChannelMessages({
+				channel_id: query.channel_id,
+				query: query.q ?? '',
+				limit: query.limit,
+			});
+			await recordAdminRead(ctx, {
+				targetType: 'channel',
+				targetId: query.channel_id,
+				action: AdminAuditReadActions.SEARCH_MESSAGES,
+				metadata: {
+					mode: 'search',
+					has_query: query.q === undefined ? undefined : true,
 					limit: query.limit,
-				}),
-			);
+					result_count: response.messages.length,
+					total: response.total,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.post(
@@ -139,7 +176,14 @@ export function MessageAdminController(app: HonoApp) {
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
 			const {job_id} = ctx.req.valid('param');
-			return ctx.json(await adminService.messageShredService.getMessageShredStatus(job_id.toString()));
+			const response = await adminService.messageShredService.getMessageShredStatus(job_id.toString());
+			await recordAdminRead(ctx, {
+				targetType: 'message_shred',
+				targetId: 0n,
+				action: AdminAuditReadActions.GET_MESSAGE_SHRED_STATUS,
+				metadata: {job_id, status: response.status},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -162,14 +206,25 @@ export function MessageAdminController(app: HonoApp) {
 			const adminService = ctx.get('adminService');
 			const {channel_id} = ctx.req.valid('param');
 			const {limit, before, after} = ctx.req.valid('query');
-			return ctx.json(
-				await adminService.messageService.browseChannel({
-					channel_id,
+			const response = await adminService.messageService.browseChannel({
+				channel_id,
+				before,
+				after,
+				limit,
+			});
+			await recordAdminRead(ctx, {
+				targetType: 'channel',
+				targetId: channel_id,
+				action: AdminAuditReadActions.LIST_CHANNEL_MESSAGES,
+				metadata: {
+					limit,
 					before,
 					after,
-					limit,
-				}),
-			);
+					result_count: response.messages.length,
+					has_more: response.has_more,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -192,13 +247,23 @@ export function MessageAdminController(app: HonoApp) {
 			const adminService = ctx.get('adminService');
 			const {channel_id, message_id} = ctx.req.valid('param');
 			const {context_limit} = ctx.req.valid('query');
-			return ctx.json(
-				await adminService.messageService.lookupMessage({
+			const response = await adminService.messageService.lookupMessage({
+				channel_id,
+				message_id,
+				context_limit,
+			});
+			await recordAdminRead(ctx, {
+				targetType: 'message',
+				targetId: message_id,
+				action: AdminAuditReadActions.GET_MESSAGE,
+				metadata: {
 					channel_id,
-					message_id,
 					context_limit,
-				}),
-			);
+					found: response.messages.some((message) => message.id === message_id.toString()),
+					result_count: response.messages.length,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.delete(
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead} from '@app/api/admin/AdminAuditRecorder';
 import {createReportID} from '@app/api/BrandedTypes';
 import {requireAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
@@ -88,15 +90,39 @@ export function ReportAdminController(app: HonoApp) {
 			const adminService = ctx.get('adminService');
 			const adminUserAcls = ctx.get('adminUserAcls');
 			const query = ctx.req.valid('query');
-			if (query.status === undefined || usesReportSearchIndex(query)) {
-				return ctx.json(
-					await adminService.reportServiceAggregate.searchReports(toSearchReportsRequest(query), adminUserAcls),
-				);
-			}
-			const status = REPORT_STATUS_BY_FILTER[query.status];
-			return ctx.json(
-				await adminService.reportServiceAggregate.listReports(status, adminUserAcls, query.limit, query.offset),
-			);
+			const status = query.status;
+			const searched = status === undefined || usesReportSearchIndex(query);
+			const response = searched
+				? await adminService.reportServiceAggregate.searchReports(toSearchReportsRequest(query), adminUserAcls)
+				: await adminService.reportServiceAggregate.listReports(
+						REPORT_STATUS_BY_FILTER[status],
+						adminUserAcls,
+						query.limit,
+						query.offset,
+					);
+			await recordAdminRead(ctx, {
+				targetType: 'report',
+				targetId: 0n,
+				action: AdminAuditReadActions.SEARCH_REPORTS,
+				metadata: {
+					has_query: query.q === undefined ? undefined : true,
+					status,
+					report_type: query.report_type,
+					reporter_user_id: query.reporter_id,
+					reported_user_id: query.reported_user_id,
+					reported_guild_id: query.reported_guild_id,
+					reported_channel_id: query.reported_channel_id,
+					context_guild_id: query.guild_context_id,
+					resolved_by_admin_user_id: query.resolved_by_admin_id,
+					sort_by: searched ? query.sort_by : undefined,
+					sort_order: searched ? query.sort_order : undefined,
+					limit: query.limit,
+					offset: query.offset,
+					result_count: response.reports.length,
+					total: response.total,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -119,6 +145,15 @@ export function ReportAdminController(app: HonoApp) {
 			const adminUserAcls = ctx.get('adminUserAcls');
 			const {report_id} = ctx.req.valid('param');
 			const report = await adminService.reportServiceAggregate.getReport(createReportID(report_id), adminUserAcls);
+			await recordAdminRead(ctx, {
+				targetType: 'report',
+				targetId: report_id,
+				action: AdminAuditReadActions.GET_REPORT,
+				metadata: {
+					report_type: report.report_type,
+					status: report.status,
+				},
+			});
 			return ctx.json(report);
 		},
 	);
@@ -1,55 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import {Readable} from 'node:stream';
-import * as v8 from 'node:v8';
-import {requireAdminACL} from '@app/api/middleware/AdminMiddleware';
-import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
-import {OpenAPI} from '@app/api/middleware/ResponseTypeMiddleware';
-import {RateLimitConfigs} from '@app/api/RateLimitConfig';
-import type {HonoApp} from '@app/api/types/HonoEnv';
-import {AdminACLs} from '@fluxer/constants/src/AdminACLs';
-import {HeapSnapshotResponse} from '@fluxer/schema/src/domains/admin/AdminSchemas';
-
-export function SystemAdminController(app: HonoApp) {
-	app.post(
-		'/admin/system/heap-snapshots',
-		RateLimitMiddleware(RateLimitConfigs.ADMIN_SYSTEM_HEAP_SNAPSHOT),
-		requireAdminACL(AdminACLs.SYSTEM_HEAP_SNAPSHOT),
-		OpenAPI({
-			operationId: 'create_admin_system_heap_snapshot',
-			summary: 'Create a V8 heap snapshot',
-			description:
-				'Writes a V8 heap snapshot of the current process and returns the snapshot file. Used for diagnosing memory leaks. Requires SYSTEM_HEAP_SNAPSHOT permission.',
-			responseSchema: HeapSnapshotResponse,
-			responseContentType: 'application/octet-stream',
-			statusCode: 200,
-			security: 'adminApiKey',
-			tags: 'Admin',
-		}),
-		async () => {
-			const snapshotPath = path.join('/tmp', `heap-${Date.now()}.heapsnapshot`);
-			try {
-				v8.writeHeapSnapshot(snapshotPath);
-				const stat = fs.statSync(snapshotPath);
-				const nodeStream = fs.createReadStream(snapshotPath);
-				const body = Readable.toWeb(nodeStream) as ReadableStream;
-				nodeStream.on('close', () => {
-					fs.unlink(snapshotPath, () => {});
-				});
-				return new Response(body, {
-					status: 200,
-					headers: {
-						'Content-Type': 'application/octet-stream',
-						'Content-Disposition': `attachment; filename="${path.basename(snapshotPath)}"`,
-						'Content-Length': String(stat.size),
-					},
-				});
-			} catch (error) {
-				fs.unlink(snapshotPath, () => {});
-				throw error;
-			}
-		},
-	);
-}
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead} from '@app/api/admin/AdminAuditRecorder';
 import {mapUserToAdminResponse} from '@app/api/admin/models/UserTypes';
 import {createUserID} from '@app/api/BrandedTypes';
 import {requireAdminACL} from '@app/api/middleware/AdminMiddleware';
@@ -72,7 +74,14 @@ export function UserAdminController(app: HonoApp) {
 				'Returns every access control permission the admin API recognises. This is the registry admin accounts and admin API keys draw their permissions from. Requires AUTHENTICATE permission.',
 		}),
 		async (ctx) => {
-			return ctx.json({acls: Object.values(AdminACLs)});
+			const acls = Object.values(AdminACLs);
+			await recordAdminRead(ctx, {
+				targetType: 'admin_acl',
+				targetId: 0n,
+				action: AdminAuditReadActions.LIST_ADMIN_ACLS,
+				metadata: {acl_count: acls.length},
+			});
+			return ctx.json({acls});
 		},
 	);
 	app.get(
@@ -127,25 +136,50 @@ export function UserAdminController(app: HonoApp) {
 					throw inputValidationErrorFromZodIssues(parsed.error.issues);
 				}
 				const {users} = await adminService.userService.lookupService.lookupUser(parsed.data, adminUserAcls);
+				await recordAdminRead(ctx, {
+					targetType: 'user',
+					targetId: 0n,
+					action: AdminAuditReadActions.SEARCH_USERS,
+					metadata: {
+						selector: userIds ? 'user_id' : 'resolve',
+						user_id: userIds?.length === 1 ? userIds[0] : undefined,
+						user_id_count: userIds?.length,
+						result_count: users.length,
+						total: users.length,
+					},
+				});
 				return ctx.json({users, total: users.length});
 			}
-			if (query.email?.trim()) {
+			const selector = query.email?.trim() ? 'email' : query.last_active_ip?.trim() ? 'last_active_ip' : 'search';
+			if (selector === 'email') {
 				requireSelectorACL(adminUserAcls, AdminACLs.USER_VIEW_EMAIL);
-			} else if (query.last_active_ip?.trim()) {
+			} else if (selector === 'last_active_ip') {
 				requireSelectorACL(adminUserAcls, AdminACLs.USER_VIEW_IP);
 			}
-			return ctx.json(
-				await adminService.searchService.searchUsers(
-					{
-						query: query.q,
-						email: query.email,
-						last_active_ip: query.last_active_ip,
-						limit: query.limit,
-						offset: query.offset,
-					},
-					adminUserAcls,
-				),
+			const response = await adminService.searchService.searchUsers(
+				{
+					query: query.q,
+					email: query.email,
+					last_active_ip: query.last_active_ip,
+					limit: query.limit,
+					offset: query.offset,
+				},
+				adminUserAcls,
 			);
+			await recordAdminRead(ctx, {
+				targetType: 'user',
+				targetId: 0n,
+				action: AdminAuditReadActions.SEARCH_USERS,
+				metadata: {
+					selector,
+					has_query: selector === 'search' && query.q?.trim() ? true : undefined,
+					limit: selector === 'email' ? undefined : query.limit,
+					offset: selector === 'email' ? undefined : query.offset,
+					result_count: response.users.length,
+					total: response.total,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -167,7 +201,14 @@ export function UserAdminController(app: HonoApp) {
 			const adminService = ctx.get('adminService');
 			const adminUserAcls = ctx.get('adminUserAcls');
 			const {user_id: userId} = ctx.req.valid('param');
-			return ctx.json(await adminService.userService.lookupService.lookupUser({user_ids: [userId]}, adminUserAcls));
+			const response = await adminService.userService.lookupService.lookupUser({user_ids: [userId]}, adminUserAcls);
+			await recordAdminRead(ctx, {
+				targetType: 'user',
+				targetId: userId,
+				action: AdminAuditReadActions.GET_USER,
+				metadata: {found: response.users.length > 0},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -190,9 +231,23 @@ export function UserAdminController(app: HonoApp) {
 			const adminService = ctx.get('adminService');
 			const {user_id: userId} = ctx.req.valid('param');
 			const query = ctx.req.valid('query');
-			return ctx.json(
-				await adminService.guildServiceAggregate.lookupService.listUserGuilds({user_id: userId, ...query}),
-			);
+			const response = await adminService.guildServiceAggregate.lookupService.listUserGuilds({
+				user_id: userId,
+				...query,
+			});
+			await recordAdminRead(ctx, {
+				targetType: 'user',
+				targetId: userId,
+				action: AdminAuditReadActions.LIST_USER_GUILDS,
+				metadata: {
+					before_guild_id: query.before,
+					after_guild_id: query.after,
+					limit: query.limit,
+					with_counts: query.with_counts,
+					guild_count: response.guilds.length,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -216,9 +271,29 @@ export function UserAdminController(app: HonoApp) {
 			const {user_id: userId} = ctx.req.valid('param');
 			const {type, ...pagination} = ctx.req.valid('query');
 			if (type === 'group_dm') {
-				return ctx.json(await adminService.userService.listUserGroupDmChannels({user_id: userId}));
+				const response = await adminService.userService.listUserGroupDmChannels({user_id: userId});
+				await recordAdminRead(ctx, {
+					targetType: 'user',
+					targetId: userId,
+					action: AdminAuditReadActions.LIST_USER_DM_CHANNELS,
+					metadata: {type, channel_count: response.channels.length},
+				});
+				return ctx.json(response);
 			}
-			return ctx.json(await adminService.userService.listUserDmChannels({user_id: userId, ...pagination}));
+			const response = await adminService.userService.listUserDmChannels({user_id: userId, ...pagination});
+			await recordAdminRead(ctx, {
+				targetType: 'user',
+				targetId: userId,
+				action: AdminAuditReadActions.LIST_USER_DM_CHANNELS,
+				metadata: {
+					type,
+					before_channel_id: pagination.before,
+					after_channel_id: pagination.after,
+					limit: pagination.limit,
+					channel_count: response.channels.length,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -242,7 +317,18 @@ export function UserAdminController(app: HonoApp) {
 			const adminUserAcls = ctx.get('adminUserAcls');
 			const {user_id: userId} = ctx.req.valid('param');
 			const query = ctx.req.valid('query');
-			return ctx.json(await adminService.userService.listUserChangeLog({user_id: userId, ...query}, adminUserAcls));
+			const response = await adminService.userService.listUserChangeLog({user_id: userId, ...query}, adminUserAcls);
+			await recordAdminRead(ctx, {
+				targetType: 'user',
+				targetId: userId,
+				action: AdminAuditReadActions.LIST_USER_CHANGE_LOG,
+				metadata: {
+					limit: query.limit,
+					has_page_token: query.page_token === undefined ? undefined : true,
+					entry_count: response.entries.length,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -263,7 +349,19 @@ export function UserAdminController(app: HonoApp) {
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
 			const {user_id: userId} = ctx.req.valid('param');
-			return ctx.json(await adminService.relationshipService.listRelationships({user_id: userId}));
+			const response = await adminService.relationshipService.listRelationships({user_id: userId});
+			await recordAdminRead(ctx, {
+				targetType: 'user',
+				targetId: userId,
+				action: AdminAuditReadActions.LIST_USER_RELATIONSHIPS,
+				metadata: {
+					friend_count: response.friends.length,
+					incoming_request_count: response.incoming_requests.length,
+					outgoing_request_count: response.outgoing_requests.length,
+					blocked_count: response.blocked.length,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.delete(
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
HampusandGitHub	522cf08e61	feat(media-proxy): sign attachment URLs and gate origins (#2830 )	2026-09-18 15:57:32 +02:00
HampusandGitHub	025c01ab13	fix(api): chunk guild permission batch RPC over 100 guilds (#2829 )	2026-09-18 12:54:03 +02:00
HampusandGitHub	dc41b53d60	fix(desktop): drop redundant casts flagged by clippy 1.98 (#2826 )	2026-09-17 21:28:48 +02:00
HampusandGitHub	3b552e00ef	chore(deps): upgrade all dependencies, toolchains and images (#2825 )	2026-09-17 21:08:56 +02:00
HampusandGitHub	56e04e7b53	test(backend): remove duplicate and useless tests (#2820 )	2026-09-17 15:32:25 +02:00
HampusandGitHub	deac653a9e	test(app): remove useless frontend tests (#2819 )	2026-09-17 15:05:36 +02:00
HampusandGitHub	ed9528834d	fix(gateway): stop dead sessions leaving voice states behind (#2818 )	2026-09-17 14:55:18 +02:00
HampusandGitHub	4cecbf1f43	fix(auth): disable TOTP with one code instead of two (#2816 )	2026-09-17 04:21:50 +02:00
HampusandGitHub	b019f4a91f	fix(gateway): act on voice states in the voice server (#2815 )	2026-09-17 03:59:36 +02:00
HampusandGitHub	34b6ecfbd2	chore(admin): remove the heap snapshot endpoint (#2814 )	2026-09-16 18:56:01 +02:00
HampusandGitHub	4ef9c4c65b	fix(api): restore commas in geoip location labels (#2812 )	2026-09-16 18:27:50 +02:00
HampusandGitHub	3276039e41	feat(admin): audit admin reads and filter the log by access (#2811 )	2026-09-16 17:23:03 +02:00
HampusandGitHub	03d1354562	chore(voice): remove voice reconciliation leftovers (#2810 )	2026-09-16 17:09:57 +02:00
HampusandGitHub	964845d7a7	chore(voice): remove the recon service (#2808 )	2026-09-16 16:53:30 +02:00
HampusandGitHub	3bc5dd8e0f	fix(gateway): always clear expired custom statuses (#2807 )	2026-09-16 16:52:22 +02:00
HampusandGitHub	17292fd6a5	fix(app): stop plain unicode symbols rendering as color emoji (#2806 )	2026-09-16 16:33:13 +02:00
TarekandGitHub	f753659899	feat(instance): make the status page URL configurable (#1159 )	2026-09-16 15:20:37 +02:00
HampusandGitHub	7412ec3395	refactor(api): purge cache by canonical media prefix (#2802 )	2026-09-16 02:32:36 +02:00
HampusandGitHub	570c8776c4	fix(api): require manage messages to remove others' reactions (#2799 )	2026-09-15 18:16:55 +02:00