Merge branch 'main' into dev

Fix inline policy fields in resource update response

.github/dependabot.yml

@@ -1,52 +1,42 @@
 version: 2
+
 updates:
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "daily"
+    open-pull-requests-limit: 1
     groups:
-      dev-patch-updates:
+      npm-dependencies:
-        dependency-type: "development"
+        patterns:
-        update-types:
+          - "*"
-          - "patch"
+
-      dev-minor-updates:
-        dependency-type: "development"
-        update-types:
-          - "minor"
-      prod-patch-updates:
-        dependency-type: "production"
-        update-types:
-          - "patch"
-      prod-minor-updates:
-        dependency-type: "production"
-        update-types:
-          - "minor"
-          
   - package-ecosystem: "docker"
     directory: "/"
     schedule:
       interval: "daily"
+    open-pull-requests-limit: 1
     groups:
-      patch-updates:
+      docker-dependencies:
-        update-types:
+        patterns:
-          - "patch"
+          - "*"
-      minor-updates:
-        update-types:
-          - "minor"
 
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 1
+    groups:
+      github-actions-dependencies:
+        patterns:
+          - "*"
 
   - package-ecosystem: "gomod"
     directory: "/install"
     schedule:
       interval: "daily"
+    open-pull-requests-limit: 1
     groups:
-      patch-updates:
+      go-install-dependencies:
-        update-types:
+        patterns:
-          - "patch"
+          - "*"
-      minor-updates:
-        update-types:
-          - "minor"

.github/workflows/cicd.yml

@@ -62,7 +62,7 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
             - name: Monitor storage space
               run: |
@@ -134,7 +134,7 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
             - name: Monitor storage space
               run: |
@@ -201,7 +201,7 @@ jobs:
         timeout-minutes: 30
         steps:
             - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
             - name: Log in to Docker Hub
               uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
@@ -256,7 +256,7 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
             - name: Extract tag name
               id: get-tag

.github/workflows/linting.yml

@@ -21,7 +21,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
             - name: Set up Node.js
               uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/test.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -62,7 +62,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Build Docker image sqlite
         run: make dev-build-sqlite
@@ -71,7 +71,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Build Docker image pg
         run: make dev-build-pg

install/go.mod

@@ -5,7 +5,7 @@ go 1.25.0
 require (
 	github.com/charmbracelet/huh v1.0.0
 	github.com/charmbracelet/lipgloss v1.1.0
-	golang.org/x/term v0.43.0
+	golang.org/x/term v0.44.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -33,6 +33,6 @@ require (
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	golang.org/x/sync v0.15.0 // indirect
-	golang.org/x/sys v0.44.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
 	golang.org/x/text v0.23.0 // indirect
 )

install/go.sum

@@ -69,10 +69,10 @@ golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
 golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
+golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
-golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
+golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
 golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
 golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=

messages/en-US.json

@@ -2967,6 +2967,7 @@
     "orgOrDomainIdMissing": "Organization or Domain ID is missing",
     "loadingDNSRecords": "Loading DNS records...",
     "olmUpdateAvailableInfo": "An updated version of Olm is available. Please update to the latest version for the best experience.",
+    "updateAvailableInfo": "An updated version is available. Please update to the latest version for the best experience.",
     "client": "Client",
     "proxyProtocol": "Proxy Protocol Settings",
     "proxyProtocolDescription": "Configure Proxy Protocol to preserve client IP addresses for TCP services.",

package-lock.json

@@ -80,7 +80,7 @@
                 "next-themes": "0.4.6",
                 "nextjs-toploader": "3.9.17",
                 "node-cache": "5.1.2",
-                "nodemailer": "8.0.9",
+                "nodemailer": "9.0.1",
                 "oslo": "1.2.1",
                 "pg": "8.21.0",
                 "posthog-node": "5.35.6",
@@ -142,7 +142,7 @@
                 "@types/yargs": "17.0.35",
                 "babel-plugin-react-compiler": "1.0.0",
                 "drizzle-kit": "0.31.10",
-                "esbuild": "0.28.0",
+                "esbuild": "0.28.1",
                 "esbuild-node-externals": "1.22.0",
                 "eslint": "10.4.0",
                 "eslint-config-next": "16.2.6",
@@ -1248,9 +1248,9 @@
             }
         },
         "node_modules/@esbuild/aix-ppc64": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz",
-            "integrity": "sha512-lhRUCeuOyJQURhTxl4WkpFTjIsbDayJHih5kZC1giwE+MhIzAb7mEsQMqMf18rHLsrb5qI1tafG20mLxEWcWlA==",
+            "integrity": "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==",
             "cpu": [
                 "ppc64"
             ],
@@ -1265,9 +1265,9 @@
             }
         },
         "node_modules/@esbuild/android-arm": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.1.tgz",
-            "integrity": "sha512-wqh0ByljabXLKHeWXYLqoJ5jKC4XBaw6Hk08OfMrCRd2nP2ZQ5eleDZC41XHyCNgktBGYMbqnrJKq/K/lzPMSQ==",
+            "integrity": "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==",
             "cpu": [
                 "arm"
             ],
@@ -1282,9 +1282,9 @@
             }
         },
         "node_modules/@esbuild/android-arm64": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.1.tgz",
-            "integrity": "sha512-+WzIXQOSaGs33tLEgYPYe/yQHf0WTU0X42Jca3y8NWMbUVhp7rUnw+vAsRC/QiDrdD31IszMrZy+qwPOPjd+rw==",
+            "integrity": "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==",
             "cpu": [
                 "arm64"
             ],
@@ -1299,9 +1299,9 @@
             }
         },
         "node_modules/@esbuild/android-x64": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.1.tgz",
-            "integrity": "sha512-+VJggoaKhk2VNNqVL7f6S189UzShHC/mR9EE8rDdSkdpN0KflSwWY/gWjDrNxxisg8Fp1ZCD9jLMo4m0OUfeUA==",
+            "integrity": "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==",
             "cpu": [
                 "x64"
             ],
@@ -1316,9 +1316,9 @@
             }
         },
         "node_modules/@esbuild/darwin-arm64": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.1.tgz",
-            "integrity": "sha512-0T+A9WZm+bZ84nZBtk1ckYsOvyA3x7e2Acj1KdVfV4/2tdG4fzUp91YHx+GArWLtwqp77pBXVCPn2We7Letr0Q==",
+            "integrity": "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==",
             "cpu": [
                 "arm64"
             ],
@@ -1333,9 +1333,9 @@
             }
         },
         "node_modules/@esbuild/darwin-x64": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.1.tgz",
-            "integrity": "sha512-fyzLm/DLDl/84OCfp2f/XQ4flmORsjU7VKt8HLjvIXChJoFFOIL6pLJPH4Yhd1n1gGFF9mPwtlN5Wf82DZs+LQ==",
+            "integrity": "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==",
             "cpu": [
                 "x64"
             ],
@@ -1350,9 +1350,9 @@
             }
         },
         "node_modules/@esbuild/freebsd-arm64": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.1.tgz",
-            "integrity": "sha512-l9GeW5UZBT9k9brBYI+0WDffcRxgHQD8ShN2Ur4xWq/NFzUKm3k5lsH4PdaRgb2w7mI9u61nr2gI2mLI27Nh3Q==",
+            "integrity": "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==",
             "cpu": [
                 "arm64"
             ],
@@ -1367,9 +1367,9 @@
             }
         },
         "node_modules/@esbuild/freebsd-x64": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.1.tgz",
-            "integrity": "sha512-BXoQai/A0wPO6Es3yFJ7APCiKGc1tdAEOgeTNy3SsB491S3aHn4S4r3e976eUnPdU+NbdtmBuLncYir2tMU9Nw==",
+            "integrity": "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==",
             "cpu": [
                 "x64"
             ],
@@ -1384,9 +1384,9 @@
             }
         },
         "node_modules/@esbuild/linux-arm": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.1.tgz",
-            "integrity": "sha512-CjaaREJagqJp7iTaNQjjidaNbCKYcd4IDkzbwwxtSvjI7NZm79qiHc8HqciMddQ6CKvJT6aBd8lO9kN/ZudLlw==",
+            "integrity": "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==",
             "cpu": [
                 "arm"
             ],
@@ -1401,9 +1401,9 @@
             }
         },
         "node_modules/@esbuild/linux-arm64": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.1.tgz",
-            "integrity": "sha512-RVyzfb3FWsGA55n6WY0MEIEPURL1FcbhFE6BffZEMEekfCzCIMtB5yyDcFnVbTnwk+CLAgTujmV/Lgvih56W+A==",
+            "integrity": "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==",
             "cpu": [
                 "arm64"
             ],
@@ -1418,9 +1418,9 @@
             }
         },
         "node_modules/@esbuild/linux-ia32": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.1.tgz",
-            "integrity": "sha512-KBnSTt1kxl9x70q+ydterVdl+Cn0H18ngRMRCEQfrbqdUuntQQ0LoMZv47uB97NljZFzY6HcfqEZ2SAyIUTQBQ==",
+            "integrity": "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==",
             "cpu": [
                 "ia32"
             ],
@@ -1435,9 +1435,9 @@
             }
         },
         "node_modules/@esbuild/linux-loong64": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.1.tgz",
-            "integrity": "sha512-zpSlUce1mnxzgBADvxKXX5sl8aYQHo2ezvMNI8I0lbblJtp8V4odlm3Yzlj7gPyt3T8ReksE6bK+pT3WD+aJRg==",
+            "integrity": "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==",
             "cpu": [
                 "loong64"
             ],
@@ -1452,9 +1452,9 @@
             }
         },
         "node_modules/@esbuild/linux-mips64el": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.1.tgz",
-            "integrity": "sha512-2jIfP6mmjkdmeTlsX/9vmdmhBmKADrWqN7zcdtHIeNSCH1SqIoNI63cYsjQR8J+wGa4Y5izRcSHSm8K3QWmk3w==",
+            "integrity": "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==",
             "cpu": [
                 "mips64el"
             ],
@@ -1469,9 +1469,9 @@
             }
         },
         "node_modules/@esbuild/linux-ppc64": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.1.tgz",
-            "integrity": "sha512-bc0FE9wWeC0WBm49IQMPSPILRocGTQt3j5KPCA8os6VprfuJ7KD+5PzESSrJ6GmPIPJK965ZJHTUlSA6GNYEhg==",
+            "integrity": "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==",
             "cpu": [
                 "ppc64"
             ],
@@ -1486,9 +1486,9 @@
             }
         },
         "node_modules/@esbuild/linux-riscv64": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.1.tgz",
-            "integrity": "sha512-SQPZOwoTTT/HXFXQJG/vBX8sOFagGqvZyXcgLA3NhIqcBv1BJU1d46c0rGcrij2B56Z2rNiSLaZOYW5cUk7yLQ==",
+            "integrity": "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==",
             "cpu": [
                 "riscv64"
             ],
@@ -1503,9 +1503,9 @@
             }
         },
         "node_modules/@esbuild/linux-s390x": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.1.tgz",
-            "integrity": "sha512-SCfR0HN8CEEjnYnySJTd2cw0k9OHB/YFzt5zgJEwa+wL/T/raGWYMBqwDNAC6dqFKmJYZoQBRfHjgwLHGSrn3Q==",
+            "integrity": "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==",
             "cpu": [
                 "s390x"
             ],
@@ -1520,9 +1520,9 @@
             }
         },
         "node_modules/@esbuild/linux-x64": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.1.tgz",
-            "integrity": "sha512-us0dSb9iFxIi8srnpl931Nvs65it/Jd2a2K3qs7fz2WfGPHqzfzZTfec7oxZJRNPXPnNYZtanmRc4AL/JwVzHQ==",
+            "integrity": "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==",
             "cpu": [
                 "x64"
             ],
@@ -1537,9 +1537,9 @@
             }
         },
         "node_modules/@esbuild/netbsd-arm64": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.1.tgz",
-            "integrity": "sha512-CR/RYotgtCKwtftMwJlUU7xCVNg3lMYZ0RzTmAHSfLCXw3NtZtNpswLEj/Kkf6kEL3Gw+BpOekRX0BYCtklhUw==",
+            "integrity": "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==",
             "cpu": [
                 "arm64"
             ],
@@ -1554,9 +1554,9 @@
             }
         },
         "node_modules/@esbuild/netbsd-x64": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.1.tgz",
-            "integrity": "sha512-nU1yhmYutL+fQ71Kxnhg8uEOdC0pwEW9entHykTgEbna2pw2dkbFSMeqjjyHZoCmt8SBkOSvV+yNmm94aUrrqw==",
+            "integrity": "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==",
             "cpu": [
                 "x64"
             ],
@@ -1571,9 +1571,9 @@
             }
         },
         "node_modules/@esbuild/openbsd-arm64": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.1.tgz",
-            "integrity": "sha512-cXb5vApOsRsxsEl4mcZ1XY3D4DzcoMxR/nnc4IyqYs0rTI8ZKmW6kyyg+11Z8yvgMfAEldKzP7AdP64HnSC/6g==",
+            "integrity": "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==",
             "cpu": [
                 "arm64"
             ],
@@ -1588,9 +1588,9 @@
             }
         },
         "node_modules/@esbuild/openbsd-x64": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.1.tgz",
-            "integrity": "sha512-8wZM2qqtv9UP3mzy7HiGYNH/zjTA355mpeuA+859TyR+e+Tc08IHYpLJuMsfpDJwoLo1ikIJI8jC3GFjnRClzA==",
+            "integrity": "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==",
             "cpu": [
                 "x64"
             ],
@@ -1605,9 +1605,9 @@
             }
         },
         "node_modules/@esbuild/openharmony-arm64": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.1.tgz",
-            "integrity": "sha512-FLGfyizszcef5C3YtoyQDACyg95+dndv79i2EekILBofh5wpCa1KuBqOWKrEHZg3zrL3t5ouE5jgr94vA+Wb2w==",
+            "integrity": "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==",
             "cpu": [
                 "arm64"
             ],
@@ -1622,9 +1622,9 @@
             }
         },
         "node_modules/@esbuild/sunos-x64": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.1.tgz",
-            "integrity": "sha512-1ZgjUoEdHZZl/YlV76TSCz9Hqj9h9YmMGAgAPYd+q4SicWNX3G5GCyx9uhQWSLcbvPW8Ni7lj4gDa1T40akdlw==",
+            "integrity": "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==",
             "cpu": [
                 "x64"
             ],
@@ -1639,9 +1639,9 @@
             }
         },
         "node_modules/@esbuild/win32-arm64": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.1.tgz",
-            "integrity": "sha512-Q9StnDmQ/enxnpxCCLSg0oo4+34B9TdXpuyPeTedN/6+iXBJ4J+zwfQI28u/Jl40nOYAxGoNi7mFP40RUtkmUA==",
+            "integrity": "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==",
             "cpu": [
                 "arm64"
             ],
@@ -1656,9 +1656,9 @@
             }
         },
         "node_modules/@esbuild/win32-ia32": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.1.tgz",
-            "integrity": "sha512-zF3ag/gfiCe6U2iczcRzSYJKH1DCI+ByzSENHlM2FcDbEeo5Zd2C86Aq0tKUYAJJ1obRP84ymxIAksZUcdztHA==",
+            "integrity": "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==",
             "cpu": [
                 "ia32"
             ],
@@ -1673,9 +1673,9 @@
             }
         },
         "node_modules/@esbuild/win32-x64": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.1.tgz",
-            "integrity": "sha512-pEl1bO9mfAmIC+tW5btTmrKaujg3zGtUmWNdCw/xs70FBjwAL3o9OEKNHvNmnyylD6ubxUERiEhdsL0xBQ9efw==",
+            "integrity": "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==",
             "cpu": [
                 "x64"
             ],
@@ -2076,9 +2076,6 @@
             "cpu": [
                 "arm"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "LGPL-3.0-or-later",
             "optional": true,
             "os": [
@@ -2095,9 +2092,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "LGPL-3.0-or-later",
             "optional": true,
             "os": [
@@ -2114,9 +2108,6 @@
             "cpu": [
                 "ppc64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "LGPL-3.0-or-later",
             "optional": true,
             "os": [
@@ -2133,9 +2124,6 @@
             "cpu": [
                 "riscv64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "LGPL-3.0-or-later",
             "optional": true,
             "os": [
@@ -2152,9 +2140,6 @@
             "cpu": [
                 "s390x"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "LGPL-3.0-or-later",
             "optional": true,
             "os": [
@@ -2187,9 +2172,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "musl"
-            ],
             "license": "LGPL-3.0-or-later",
             "optional": true,
             "os": [
@@ -2222,9 +2204,6 @@
             "cpu": [
                 "arm"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "Apache-2.0",
             "optional": true,
             "os": [
@@ -2247,9 +2226,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "Apache-2.0",
             "optional": true,
             "os": [
@@ -2272,9 +2248,6 @@
             "cpu": [
                 "ppc64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "Apache-2.0",
             "optional": true,
             "os": [
@@ -2297,9 +2270,6 @@
             "cpu": [
                 "riscv64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "Apache-2.0",
             "optional": true,
             "os": [
@@ -2322,9 +2292,6 @@
             "cpu": [
                 "s390x"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "Apache-2.0",
             "optional": true,
             "os": [
@@ -2369,9 +2336,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "musl"
-            ],
             "license": "Apache-2.0",
             "optional": true,
             "os": [
@@ -2664,9 +2628,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2683,9 +2644,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "musl"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2941,9 +2899,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2960,9 +2915,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "musl"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -3200,9 +3152,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -3219,9 +3168,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "musl"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -3582,9 +3528,6 @@
             "cpu": [
                 "arm"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -3605,9 +3548,6 @@
             "cpu": [
                 "arm"
             ],
-            "libc": [
-                "musl"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -3628,9 +3568,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -3651,9 +3588,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "musl"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -6873,9 +6807,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "Apache-2.0 AND MIT",
             "optional": true,
             "os": [
@@ -6892,9 +6823,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "musl"
-            ],
             "license": "Apache-2.0 AND MIT",
             "optional": true,
             "os": [
@@ -6911,9 +6839,6 @@
             "cpu": [
                 "ppc64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "Apache-2.0 AND MIT",
             "optional": true,
             "os": [
@@ -6930,9 +6855,6 @@
             "cpu": [
                 "s390x"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "Apache-2.0 AND MIT",
             "optional": true,
             "os": [
@@ -7200,9 +7122,6 @@
                 "arm64"
             ],
             "dev": true,
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -7220,9 +7139,6 @@
                 "arm64"
             ],
             "dev": true,
-            "libc": [
-                "musl"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -7296,6 +7212,72 @@
                 "node": ">=14.0.0"
             }
         },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/core": {
+            "version": "1.10.0",
+            "dev": true,
+            "inBundle": true,
+            "license": "MIT",
+            "optional": true,
+            "dependencies": {
+                "@emnapi/wasi-threads": "1.2.1",
+                "tslib": "^2.4.0"
+            }
+        },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/runtime": {
+            "version": "1.10.0",
+            "dev": true,
+            "inBundle": true,
+            "license": "MIT",
+            "optional": true,
+            "dependencies": {
+                "tslib": "^2.4.0"
+            }
+        },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
+            "version": "1.2.1",
+            "dev": true,
+            "inBundle": true,
+            "license": "MIT",
+            "optional": true,
+            "dependencies": {
+                "tslib": "^2.4.0"
+            }
+        },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@napi-rs/wasm-runtime": {
+            "version": "1.1.4",
+            "dev": true,
+            "inBundle": true,
+            "license": "MIT",
+            "optional": true,
+            "dependencies": {
+                "@tybys/wasm-util": "^0.10.1"
+            },
+            "funding": {
+                "type": "github",
+                "url": "https://github.com/sponsors/Brooooooklyn"
+            },
+            "peerDependencies": {
+                "@emnapi/core": "^1.7.1",
+                "@emnapi/runtime": "^1.7.1"
+            }
+        },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@tybys/wasm-util": {
+            "version": "0.10.1",
+            "dev": true,
+            "inBundle": true,
+            "license": "MIT",
+            "optional": true,
+            "dependencies": {
+                "tslib": "^2.4.0"
+            }
+        },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/tslib": {
+            "version": "2.8.1",
+            "dev": true,
+            "inBundle": true,
+            "license": "0BSD",
+            "optional": true
+        },
         "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
             "version": "4.3.0",
             "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.0.tgz",
@@ -8448,9 +8430,6 @@
                 "arm64"
             ],
             "dev": true,
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -8465,9 +8444,6 @@
                 "arm64"
             ],
             "dev": true,
-            "libc": [
-                "musl"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -8482,9 +8458,6 @@
                 "ppc64"
             ],
             "dev": true,
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -8499,9 +8472,6 @@
                 "riscv64"
             ],
             "dev": true,
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -8516,9 +8486,6 @@
                 "riscv64"
             ],
             "dev": true,
-            "libc": [
-                "musl"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -8533,9 +8500,6 @@
                 "s390x"
             ],
             "dev": true,
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -11261,9 +11225,9 @@
             ]
         },
         "node_modules/esbuild": {
-            "version": "0.28.0",
+            "version": "0.28.1",
-            "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.0.tgz",
+            "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.1.tgz",
-            "integrity": "sha512-sNR9MHpXSUV/XB4zmsFKN+QgVG82Cc7+/aaxJ8Adi8hyOac+EXptIp45QBPaVyX3N70664wRbTcLTOemCAnyqw==",
+            "integrity": "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==",
             "dev": true,
             "hasInstallScript": true,
             "license": "MIT",
@@ -11274,32 +11238,32 @@
                 "node": ">=18"
             },
             "optionalDependencies": {
-                "@esbuild/aix-ppc64": "0.28.0",
+                "@esbuild/aix-ppc64": "0.28.1",
-                "@esbuild/android-arm": "0.28.0",
+                "@esbuild/android-arm": "0.28.1",
-                "@esbuild/android-arm64": "0.28.0",
+                "@esbuild/android-arm64": "0.28.1",
-                "@esbuild/android-x64": "0.28.0",
+                "@esbuild/android-x64": "0.28.1",
-                "@esbuild/darwin-arm64": "0.28.0",
+                "@esbuild/darwin-arm64": "0.28.1",
-                "@esbuild/darwin-x64": "0.28.0",
+                "@esbuild/darwin-x64": "0.28.1",
-                "@esbuild/freebsd-arm64": "0.28.0",
+                "@esbuild/freebsd-arm64": "0.28.1",
-                "@esbuild/freebsd-x64": "0.28.0",
+                "@esbuild/freebsd-x64": "0.28.1",
-                "@esbuild/linux-arm": "0.28.0",
+                "@esbuild/linux-arm": "0.28.1",
-                "@esbuild/linux-arm64": "0.28.0",
+                "@esbuild/linux-arm64": "0.28.1",
-                "@esbuild/linux-ia32": "0.28.0",
+                "@esbuild/linux-ia32": "0.28.1",
-                "@esbuild/linux-loong64": "0.28.0",
+                "@esbuild/linux-loong64": "0.28.1",
-                "@esbuild/linux-mips64el": "0.28.0",
+                "@esbuild/linux-mips64el": "0.28.1",
-                "@esbuild/linux-ppc64": "0.28.0",
+                "@esbuild/linux-ppc64": "0.28.1",
-                "@esbuild/linux-riscv64": "0.28.0",
+                "@esbuild/linux-riscv64": "0.28.1",
-                "@esbuild/linux-s390x": "0.28.0",
+                "@esbuild/linux-s390x": "0.28.1",
-                "@esbuild/linux-x64": "0.28.0",
+                "@esbuild/linux-x64": "0.28.1",
-                "@esbuild/netbsd-arm64": "0.28.0",
+                "@esbuild/netbsd-arm64": "0.28.1",
-                "@esbuild/netbsd-x64": "0.28.0",
+                "@esbuild/netbsd-x64": "0.28.1",
-                "@esbuild/openbsd-arm64": "0.28.0",
+                "@esbuild/openbsd-arm64": "0.28.1",
-                "@esbuild/openbsd-x64": "0.28.0",
+                "@esbuild/openbsd-x64": "0.28.1",
-                "@esbuild/openharmony-arm64": "0.28.0",
+                "@esbuild/openharmony-arm64": "0.28.1",
-                "@esbuild/sunos-x64": "0.28.0",
+                "@esbuild/sunos-x64": "0.28.1",
-                "@esbuild/win32-arm64": "0.28.0",
+                "@esbuild/win32-arm64": "0.28.1",
-                "@esbuild/win32-ia32": "0.28.0",
+                "@esbuild/win32-ia32": "0.28.1",
-                "@esbuild/win32-x64": "0.28.0"
+                "@esbuild/win32-x64": "0.28.1"
             }
         },
         "node_modules/esbuild-node-externals": {
@@ -12191,16 +12155,16 @@
             }
         },
         "node_modules/form-data": {
-            "version": "4.0.5",
+            "version": "4.0.6",
-            "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
+            "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz",
-            "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
+            "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==",
             "license": "MIT",
             "dependencies": {
                 "asynckit": "^0.4.0",
                 "combined-stream": "^1.0.8",
                 "es-set-tostringtag": "^2.1.0",
-                "hasown": "^2.0.2",
+                "hasown": "^2.0.4",
-                "mime-types": "^2.1.12"
+                "mime-types": "^2.1.35"
             },
             "engines": {
                 "node": ">= 6"
@@ -12629,9 +12593,9 @@
             }
         },
         "node_modules/hasown": {
-            "version": "2.0.3",
+            "version": "2.0.4",
-            "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.3.tgz",
+            "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
-            "integrity": "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==",
+            "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
             "license": "MIT",
             "dependencies": {
                 "function-bind": "^1.1.2"
@@ -13767,9 +13731,6 @@
                 "arm64"
             ],
             "dev": true,
-            "libc": [
-                "glibc"
-            ],
             "license": "MPL-2.0",
             "optional": true,
             "os": [
@@ -13791,9 +13752,6 @@
                 "arm64"
             ],
             "dev": true,
-            "libc": [
-                "musl"
-            ],
             "license": "MPL-2.0",
             "optional": true,
             "os": [
@@ -14574,9 +14532,9 @@
             "license": "MIT"
         },
         "node_modules/nodemailer": {
-            "version": "8.0.9",
+            "version": "9.0.1",
-            "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-8.0.9.tgz",
+            "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-9.0.1.tgz",
-            "integrity": "sha512-5ofa7BUN8+C+Hckh5V2GjeeOGRQBx0CJQA6KxrvuZfC8iU4/q7sLn8XrtEEhJkjV6HdyIiQs7Bba6bTao8JhkA==",
+            "integrity": "sha512-Gwv8SQewT616ZM/URn0H54b8PWo/Wum7md3EW2aWy1lO27+WZCX+Xyak3J+NlmHUjDh5ME+uesJUDRbR3Ye8Bw==",
             "license": "MIT-0",
             "engines": {
                 "node": ">=6.0.0"
@@ -15001,9 +14959,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -15020,9 +14975,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "musl"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [

package.json

@@ -103,7 +103,7 @@
         "next-themes": "0.4.6",
         "nextjs-toploader": "3.9.17",
         "node-cache": "5.1.2",
-        "nodemailer": "8.0.9",
+        "nodemailer": "9.0.1",
         "oslo": "1.2.1",
         "pg": "8.21.0",
         "posthog-node": "5.35.6",
@@ -165,7 +165,7 @@
         "@types/yargs": "17.0.35",
         "babel-plugin-react-compiler": "1.0.0",
         "drizzle-kit": "0.31.10",
-        "esbuild": "0.28.0",
+        "esbuild": "0.28.1",
         "esbuild-node-externals": "1.22.0",
         "eslint": "10.4.0",
         "eslint-config-next": "16.2.6",
@@ -179,7 +179,7 @@
         "typescript-eslint": "8.60.0"
     },
     "overrides": {
-        "esbuild": "0.28.0",
+        "esbuild": "0.28.1",
         "dompurify": "3.4.0",
         "postcss": "8.5.15"
     }

server/db/pg/schema/privateSchema.ts

@@ -11,7 +11,7 @@ import {
     primaryKey,
     uniqueIndex
 } from "drizzle-orm/pg-core";
-import { InferSelectModel } from "drizzle-orm";
+import { InferSelectModel, sql } from "drizzle-orm";
 import {
     domains,
     orgs,
@@ -207,17 +207,28 @@ export const remoteExitNodeSessions = pgTable("remoteExitNodeSession", {
     expiresAt: bigint("expiresAt", { mode: "number" }).notNull()
 });
 
-export const loginPage = pgTable("loginPage", {
+export const loginPage = pgTable(
-    loginPageId: serial("loginPageId").primaryKey(),
+    "loginPage",
-    subdomain: varchar("subdomain"),
+    {
-    fullDomain: varchar("fullDomain"),
+        loginPageId: serial("loginPageId").primaryKey(),
-    exitNodeId: integer("exitNodeId").references(() => exitNodes.exitNodeId, {
+        subdomain: varchar("subdomain"),
-        onDelete: "set null"
+        fullDomain: varchar("fullDomain"),
-    }),
+        exitNodeId: integer("exitNodeId").references(
-    domainId: varchar("domainId").references(() => domains.domainId, {
+            () => exitNodes.exitNodeId,
-        onDelete: "set null"
+            {
-    })
+                onDelete: "set null"
-});
+            }
+        ),
+        domainId: varchar("domainId").references(() => domains.domainId, {
+            onDelete: "set null"
+        })
+    },
+    (t) => [
+        index("idx_loginpage_fulldomain")
+            .on(t.fullDomain)
+            .where(sql`${t.fullDomain} IS NOT NULL`)
+    ]
+);
 
 export const loginPageOrg = pgTable("loginPageOrg", {
     loginPageId: integer("loginPageId")

server/db/pg/schema/schema.ts

@@ -1,5 +1,5 @@
 import { randomUUID } from "crypto";
-import { InferSelectModel } from "drizzle-orm";
+import { InferSelectModel, sql } from "drizzle-orm";
 import {
     bigint,
     boolean,
@@ -82,107 +82,130 @@ export const orgDomains = pgTable("orgDomains", {
         .references(() => domains.domainId, { onDelete: "cascade" })
 });
 
-export const sites = pgTable("sites", {
+export const sites = pgTable(
-    siteId: serial("siteId").primaryKey(),
+    "sites",
-    orgId: varchar("orgId")
+    {
-        .references(() => orgs.orgId, {
+        siteId: serial("siteId").primaryKey(),
-            onDelete: "cascade"
+        orgId: varchar("orgId")
-        })
+            .references(() => orgs.orgId, {
-        .notNull(),
+                onDelete: "cascade"
-    niceId: varchar("niceId").notNull(),
+            })
-    exitNodeId: integer("exitNode").references(() => exitNodes.exitNodeId, {
+            .notNull(),
-        onDelete: "set null"
+        niceId: varchar("niceId").notNull(),
-    }),
+        exitNodeId: integer("exitNode").references(() => exitNodes.exitNodeId, {
-    name: varchar("name").notNull(),
+            onDelete: "set null"
-    pubKey: varchar("pubKey"),
+        }),
-    subnet: varchar("subnet"),
+        name: varchar("name").notNull(),
-    megabytesIn: real("bytesIn").default(0),
+        pubKey: varchar("pubKey"),
-    megabytesOut: real("bytesOut").default(0),
+        subnet: varchar("subnet"),
-    lastBandwidthUpdate: varchar("lastBandwidthUpdate"),
+        megabytesIn: real("bytesIn").default(0),
-    type: varchar("type").notNull(), // "newt" or "wireguard"
+        megabytesOut: real("bytesOut").default(0),
-    online: boolean("online").notNull().default(false),
+        lastBandwidthUpdate: varchar("lastBandwidthUpdate"),
-    lastPing: integer("lastPing"),
+        type: varchar("type").notNull(), // "newt" or "wireguard"
-    address: varchar("address"),
+        online: boolean("online").notNull().default(false),
-    endpoint: varchar("endpoint"),
+        lastPing: integer("lastPing"),
-    publicKey: varchar("publicKey"),
+        address: varchar("address"),
-    lastHolePunch: bigint("lastHolePunch", { mode: "number" }),
+        endpoint: varchar("endpoint"),
-    listenPort: integer("listenPort"),
+        publicKey: varchar("publicKey"),
-    dockerSocketEnabled: boolean("dockerSocketEnabled").notNull().default(true),
+        lastHolePunch: bigint("lastHolePunch", { mode: "number" }),
-    autoUpdateEnabled: boolean("autoUpdateEnabled").notNull().default(false),
+        listenPort: integer("listenPort"),
-    autoUpdateOverrideOrg: boolean("autoUpdateOverrideOrg")
+        dockerSocketEnabled: boolean("dockerSocketEnabled")
-        .notNull()
+            .notNull()
-        .default(false),
+            .default(true),
-    status: varchar("status")
+        autoUpdateEnabled: boolean("autoUpdateEnabled")
-        .$type<"pending" | "approved">()
+            .notNull()
-        .default("approved")
+            .default(false),
-});
+        autoUpdateOverrideOrg: boolean("autoUpdateOverrideOrg")
+            .notNull()
+            .default(false),
+        status: varchar("status")
+            .$type<"pending" | "approved">()
+            .default("approved")
+    },
+    (t) => [
+        index("idx_sites_exitnodeid").on(t.exitNodeId),
+        index("idx_sites_exitnode_type_siteid").on(
+            t.exitNodeId,
+            t.type,
+            t.siteId
+        )
+    ]
+);
 
-export const resources = pgTable("resources", {
+export const resources = pgTable(
-    resourceId: serial("resourceId").primaryKey(),
+    "resources",
-    resourcePolicyId: integer("resourcePolicyId").references(
+    {
-        () => resourcePolicies.resourcePolicyId,
+        resourceId: serial("resourceId").primaryKey(),
-        { onDelete: "set null" }
+        resourcePolicyId: integer("resourcePolicyId").references(
-    ),
+            () => resourcePolicies.resourcePolicyId,
-    defaultResourcePolicyId: integer("defaultResourcePolicyId").references(
+            { onDelete: "set null" }
-        () => resourcePolicies.resourcePolicyId,
+        ),
-        {
+        defaultResourcePolicyId: integer("defaultResourcePolicyId").references(
-            onDelete: "restrict"
+            () => resourcePolicies.resourcePolicyId,
-        }
+            {
-    ),
+                onDelete: "restrict"
-    resourceGuid: varchar("resourceGuid", { length: 36 })
+            }
-        .unique()
+        ),
-        .notNull()
+        resourceGuid: varchar("resourceGuid", { length: 36 })
-        .$defaultFn(() => randomUUID()),
+            .unique()
-    orgId: varchar("orgId")
+            .notNull()
-        .references(() => orgs.orgId, {
+            .$defaultFn(() => randomUUID()),
-            onDelete: "cascade"
+        orgId: varchar("orgId")
-        })
+            .references(() => orgs.orgId, {
-        .notNull(),
+                onDelete: "cascade"
-    niceId: text("niceId").notNull(),
+            })
-    name: varchar("name").notNull(),
+            .notNull(),
-    subdomain: varchar("subdomain"),
+        niceId: text("niceId").notNull(),
-    fullDomain: varchar("fullDomain"),
+        name: varchar("name").notNull(),
-    domainId: varchar("domainId").references(() => domains.domainId, {
+        subdomain: varchar("subdomain"),
-        onDelete: "set null"
+        fullDomain: varchar("fullDomain"),
-    }),
+        domainId: varchar("domainId").references(() => domains.domainId, {
-    ssl: boolean("ssl").notNull().default(false),
+            onDelete: "set null"
-    blockAccess: boolean("blockAccess").notNull().default(false),
+        }),
-    proxyPort: integer("proxyPort"),
+        ssl: boolean("ssl").notNull().default(false),
-    sso: boolean("sso"),
+        blockAccess: boolean("blockAccess").notNull().default(false),
-    emailWhitelistEnabled: boolean("emailWhitelistEnabled"),
+        proxyPort: integer("proxyPort"),
-    applyRules: boolean("applyRules"),
+        sso: boolean("sso"),
-    enabled: boolean("enabled").notNull().default(true),
+        emailWhitelistEnabled: boolean("emailWhitelistEnabled"),
-    stickySession: boolean("stickySession").notNull().default(false),
+        applyRules: boolean("applyRules"),
-    tlsServerName: varchar("tlsServerName"),
+        enabled: boolean("enabled").notNull().default(true),
-    setHostHeader: varchar("setHostHeader"),
+        stickySession: boolean("stickySession").notNull().default(false),
-    enableProxy: boolean("enableProxy").default(true),
+        tlsServerName: varchar("tlsServerName"),
-    skipToIdpId: integer("skipToIdpId").references(() => idp.idpId, {
+        setHostHeader: varchar("setHostHeader"),
-        onDelete: "set null"
+        enableProxy: boolean("enableProxy").default(true),
-    }),
+        skipToIdpId: integer("skipToIdpId").references(() => idp.idpId, {
-    headers: text("headers"), // comma-separated list of headers to add to the request
+            onDelete: "set null"
-    proxyProtocol: boolean("proxyProtocol").notNull().default(false),
+        }),
-    proxyProtocolVersion: integer("proxyProtocolVersion").default(1),
+        headers: text("headers"), // comma-separated list of headers to add to the request
-    maintenanceModeEnabled: boolean("maintenanceModeEnabled")
+        proxyProtocol: boolean("proxyProtocol").notNull().default(false),
-        .notNull()
+        proxyProtocolVersion: integer("proxyProtocolVersion").default(1),
-        .default(false),
+        maintenanceModeEnabled: boolean("maintenanceModeEnabled")
-    maintenanceModeType: text("maintenanceModeType", {
+            .notNull()
-        enum: ["forced", "automatic"]
+            .default(false),
-    }).default("forced"), // "forced" = always show, "automatic" = only when down
+        maintenanceModeType: text("maintenanceModeType", {
-    maintenanceTitle: text("maintenanceTitle"),
+            enum: ["forced", "automatic"]
-    maintenanceMessage: text("maintenanceMessage"),
+        }).default("forced"), // "forced" = always show, "automatic" = only when down
-    maintenanceEstimatedTime: text("maintenanceEstimatedTime"),
+        maintenanceTitle: text("maintenanceTitle"),
-    postAuthPath: text("postAuthPath"),
+        maintenanceMessage: text("maintenanceMessage"),
-    health: varchar("health").default("unknown"), // "healthy", "unhealthy", "unknown"
+        maintenanceEstimatedTime: text("maintenanceEstimatedTime"),
-    wildcard: boolean("wildcard").notNull().default(false),
+        postAuthPath: text("postAuthPath"),
-    mode: text("mode").default("http").notNull(), // rdp, ssh, http, vnc
+        health: varchar("health").default("unknown"), // "healthy", "unhealthy", "unknown"
-    pamMode: varchar("pamMode", { length: 32 })
+        wildcard: boolean("wildcard").notNull().default(false),
-        .$type<"passthrough" | "push">()
+        mode: text("mode").default("http").notNull(), // rdp, ssh, http, vnc
-        .default("passthrough"),
+        pamMode: varchar("pamMode", { length: 32 })
-    authDaemonMode: varchar("authDaemonMode", { length: 32 })
+            .$type<"passthrough" | "push">()
-        .$type<"site" | "remote" | "native">()
+            .default("passthrough"),
-        .default("site"),
+        authDaemonMode: varchar("authDaemonMode", { length: 32 })
-    authDaemonPort: integer("authDaemonPort").default(22123)
+            .$type<"site" | "remote" | "native">()
-});
+            .default("site"),
+        authDaemonPort: integer("authDaemonPort").default(22123)
+    },
+    (t) => [
+        index("idx_resources_fulldomain")
+            .on(t.fullDomain)
+            .where(sql`${t.fullDomain} IS NOT NULL`)
+    ]
+);
 
 export const labels = pgTable("labels", {
     labelId: serial("labelId").primaryKey(),
@@ -267,71 +290,84 @@ export const clientLabels = pgTable(
     (t) => [unique("client_label_uniq").on(t.clientId, t.labelId)]
 );
 
-export const targets = pgTable("targets", {
+export const targets = pgTable(
-    targetId: serial("targetId").primaryKey(),
+    "targets",
-    resourceId: integer("resourceId")
+    {
-        .references(() => resources.resourceId, {
+        targetId: serial("targetId").primaryKey(),
-            onDelete: "cascade"
+        resourceId: integer("resourceId")
-        })
+            .references(() => resources.resourceId, {
-        .notNull(),
+                onDelete: "cascade"
-    siteId: integer("siteId")
+            })
-        .references(() => sites.siteId, {
+            .notNull(),
-            onDelete: "cascade"
+        siteId: integer("siteId")
-        })
+            .references(() => sites.siteId, {
-        .notNull(),
+                onDelete: "cascade"
-    ip: varchar("ip").notNull(),
+            })
-    method: varchar("method"),
+            .notNull(),
-    port: integer("port").notNull(),
+        ip: varchar("ip").notNull(),
-    internalPort: integer("internalPort"),
+        method: varchar("method"),
-    enabled: boolean("enabled").notNull().default(true),
+        port: integer("port").notNull(),
-    path: text("path"),
+        internalPort: integer("internalPort"),
-    pathMatchType: text("pathMatchType"), // exact, prefix, regex
+        enabled: boolean("enabled").notNull().default(true),
-    rewritePath: text("rewritePath"), // if set, rewrites the path to this value before sending to the target
+        path: text("path"),
-    rewritePathType: text("rewritePathType"), // exact, prefix, regex, stripPrefix
+        pathMatchType: text("pathMatchType"), // exact, prefix, regex
-    priority: integer("priority").notNull().default(100),
+        rewritePath: text("rewritePath"), // if set, rewrites the path to this value before sending to the target
-    mode: varchar("mode")
+        rewritePathType: text("rewritePathType"), // exact, prefix, regex, stripPrefix
-        .$type<"http" | "tcp" | "udp" | "ssh" | "rdp" | "vnc">()
+        priority: integer("priority").notNull().default(100),
-        .notNull()
+        mode: varchar("mode")
-        .default("http"),
+            .$type<"http" | "tcp" | "udp" | "ssh" | "rdp" | "vnc">()
-    authToken: varchar("authToken")
+            .notNull()
-});
+            .default("http"),
+        authToken: varchar("authToken")
+    },
+    (t) => [
+        index("idx_targets_resourceid_siteid").on(t.resourceId, t.siteId),
+        index("idx_targets_site_enabled_priority_target_resource")
+            .on(t.siteId, t.priority.desc(), t.targetId, t.resourceId)
+            .where(sql`${t.enabled} = true`)
+    ]
+);
 
-export const targetHealthCheck = pgTable("targetHealthCheck", {
+export const targetHealthCheck = pgTable(
-    targetHealthCheckId: serial("targetHealthCheckId").primaryKey(),
+    "targetHealthCheck",
-    targetId: integer("targetId").references(() => targets.targetId, {
+    {
-        onDelete: "cascade"
+        targetHealthCheckId: serial("targetHealthCheckId").primaryKey(),
-    }),
+        targetId: integer("targetId").references(() => targets.targetId, {
-    orgId: varchar("orgId")
-        .references(() => orgs.orgId, {
             onDelete: "cascade"
-        })
+        }),
-        .notNull(),
+        orgId: varchar("orgId")
-    siteId: integer("siteId")
+            .references(() => orgs.orgId, {
-        .references(() => sites.siteId, {
+                onDelete: "cascade"
-            onDelete: "cascade"
+            })
-        })
+            .notNull(),
-        .notNull(),
+        siteId: integer("siteId")
-    name: varchar("name"),
+            .references(() => sites.siteId, {
-    hcEnabled: boolean("hcEnabled").notNull().default(false),
+                onDelete: "cascade"
-    hcPath: varchar("hcPath"),
+            })
-    hcScheme: varchar("hcScheme"),
+            .notNull(),
-    hcMode: varchar("hcMode").default("http"),
+        name: varchar("name"),
-    hcHostname: varchar("hcHostname"),
+        hcEnabled: boolean("hcEnabled").notNull().default(false),
-    hcPort: integer("hcPort"),
+        hcPath: varchar("hcPath"),
-    hcInterval: integer("hcInterval").default(30), // in seconds
+        hcScheme: varchar("hcScheme"),
-    hcUnhealthyInterval: integer("hcUnhealthyInterval").default(30), // in seconds
+        hcMode: varchar("hcMode").default("http"),
-    hcTimeout: integer("hcTimeout").default(5), // in seconds
+        hcHostname: varchar("hcHostname"),
-    hcHeaders: varchar("hcHeaders"),
+        hcPort: integer("hcPort"),
-    hcFollowRedirects: boolean("hcFollowRedirects").default(true),
+        hcInterval: integer("hcInterval").default(30), // in seconds
-    hcMethod: varchar("hcMethod").default("GET"),
+        hcUnhealthyInterval: integer("hcUnhealthyInterval").default(30), // in seconds
-    hcStatus: integer("hcStatus"), // http code
+        hcTimeout: integer("hcTimeout").default(5), // in seconds
-    hcHealth: text("hcHealth")
+        hcHeaders: varchar("hcHeaders"),
-        .$type<"unknown" | "healthy" | "unhealthy">()
+        hcFollowRedirects: boolean("hcFollowRedirects").default(true),
-        .default("unknown"), // "unknown", "healthy", "unhealthy"
+        hcMethod: varchar("hcMethod").default("GET"),
-    hcTlsServerName: text("hcTlsServerName"),
+        hcStatus: integer("hcStatus"), // http code
-    hcHealthyThreshold: integer("hcHealthyThreshold").default(1),
+        hcHealth: text("hcHealth")
-    hcUnhealthyThreshold: integer("hcUnhealthyThreshold").default(1)
+            .$type<"unknown" | "healthy" | "unhealthy">()
-});
+            .default("unknown"), // "unknown", "healthy", "unhealthy"
+        hcTlsServerName: text("hcTlsServerName"),
+        hcHealthyThreshold: integer("hcHealthyThreshold").default(1),
+        hcUnhealthyThreshold: integer("hcUnhealthyThreshold").default(1)
+    },
+    (t) => [index("idx_targethealthcheck_targetid").on(t.targetId)]
+);
 
 export const exitNodes = pgTable("exitNodes", {
     exitNodeId: serial("exitNodeId").primaryKey(),
@@ -406,43 +442,74 @@ export const networks = pgTable("networks", {
         .notNull()
 });
 
-export const siteNetworks = pgTable("siteNetworks", {
+export const siteNetworks = pgTable(
-    siteId: integer("siteId")
+    "siteNetworks",
-        .notNull()
+    {
-        .references(() => sites.siteId, {
+        siteId: integer("siteId")
-            onDelete: "cascade"
+            .notNull()
-        }),
+            .references(() => sites.siteId, {
-    networkId: integer("networkId")
+                onDelete: "cascade"
-        .notNull()
+            }),
-        .references(() => networks.networkId, { onDelete: "cascade" })
+        networkId: integer("networkId")
-});
+            .notNull()
+            .references(() => networks.networkId, { onDelete: "cascade" })
+    },
+    (t) => [
+        index("idx_sitenetworks_siteid").on(t.siteId),
+        index("idx_sitenetworks_networkid").on(t.networkId)
+    ]
+);
 
-export const clientSiteResources = pgTable("clientSiteResources", {
+export const clientSiteResources = pgTable(
-    clientId: integer("clientId")
+    "clientSiteResources",
-        .notNull()
+    {
-        .references(() => clients.clientId, { onDelete: "cascade" }),
+        clientId: integer("clientId")
-    siteResourceId: integer("siteResourceId")
+            .notNull()
-        .notNull()
+            .references(() => clients.clientId, { onDelete: "cascade" }),
-        .references(() => siteResources.siteResourceId, { onDelete: "cascade" })
+        siteResourceId: integer("siteResourceId")
-});
+            .notNull()
+            .references(() => siteResources.siteResourceId, {
+                onDelete: "cascade"
+            })
+    },
+    (t) => [
+        index("idx_clientsiteresources_clientid").on(t.clientId),
+        index("idx_clientsiteresources_siteresourceid").on(t.siteResourceId)
+    ]
+);
 
-export const roleSiteResources = pgTable("roleSiteResources", {
+export const roleSiteResources = pgTable(
-    roleId: integer("roleId")
+    "roleSiteResources",
-        .notNull()
+    {
-        .references(() => roles.roleId, { onDelete: "cascade" }),
+        roleId: integer("roleId")
-    siteResourceId: integer("siteResourceId")
+            .notNull()
-        .notNull()
+            .references(() => roles.roleId, { onDelete: "cascade" }),
-        .references(() => siteResources.siteResourceId, { onDelete: "cascade" })
+        siteResourceId: integer("siteResourceId")
-});
+            .notNull()
+            .references(() => siteResources.siteResourceId, {
+                onDelete: "cascade"
+            })
+    },
+    (t) => [index("idx_rolesiteresources_siteresourceid").on(t.siteResourceId)]
+);
 
-export const userSiteResources = pgTable("userSiteResources", {
+export const userSiteResources = pgTable(
-    userId: varchar("userId")
+    "userSiteResources",
-        .notNull()
+    {
-        .references(() => users.userId, { onDelete: "cascade" }),
+        userId: varchar("userId")
-    siteResourceId: integer("siteResourceId")
+            .notNull()
-        .notNull()
+            .references(() => users.userId, { onDelete: "cascade" }),
-        .references(() => siteResources.siteResourceId, { onDelete: "cascade" })
+        siteResourceId: integer("siteResourceId")
-});
+            .notNull()
+            .references(() => siteResources.siteResourceId, {
+                onDelete: "cascade"
+            })
+    },
+    (t) => [
+        index("idx_usersiteresources_userid").on(t.userId),
+        index("idx_usersiteresources_siteresourceid").on(t.siteResourceId)
+    ]
+);
 
 export const users = pgTable("user", {
     userId: varchar("id").primaryKey(),
@@ -467,15 +534,19 @@ export const users = pgTable("user", {
     locale: varchar("locale")
 });
 
-export const newts = pgTable("newt", {
+export const newts = pgTable(
-    newtId: varchar("id").primaryKey(),
+    "newt",
-    secretHash: varchar("secretHash").notNull(),
+    {
-    dateCreated: varchar("dateCreated").notNull(),
+        newtId: varchar("id").primaryKey(),
-    version: varchar("version"),
+        secretHash: varchar("secretHash").notNull(),
-    siteId: integer("siteId").references(() => sites.siteId, {
+        dateCreated: varchar("dateCreated").notNull(),
-        onDelete: "cascade"
+        version: varchar("version"),
-    })
+        siteId: integer("siteId").references(() => sites.siteId, {
-});
+            onDelete: "cascade"
+        })
+    },
+    (t) => [index("idx_newt_siteid").on(t.siteId)]
+);
 
 export const twoFactorBackupCodes = pgTable("twoFactorBackupCodes", {
     codeId: serial("id").primaryKey(),
@@ -576,29 +647,49 @@ export const userOrgRoles = pgTable(
     (t) => [unique().on(t.userId, t.orgId, t.roleId)]
 );
 
-export const roleActions = pgTable("roleActions", {
+export const roleActions = pgTable(
-    roleId: integer("roleId")
+    "roleActions",
-        .notNull()
+    {
-        .references(() => roles.roleId, { onDelete: "cascade" }),
+        roleId: integer("roleId")
-    actionId: varchar("actionId")
+            .notNull()
-        .notNull()
+            .references(() => roles.roleId, { onDelete: "cascade" }),
-        .references(() => actions.actionId, { onDelete: "cascade" }),
+        actionId: varchar("actionId")
-    orgId: varchar("orgId")
+            .notNull()
-        .notNull()
+            .references(() => actions.actionId, { onDelete: "cascade" }),
-        .references(() => orgs.orgId, { onDelete: "cascade" })
+        orgId: varchar("orgId")
-});
+            .notNull()
+            .references(() => orgs.orgId, { onDelete: "cascade" })
+    },
+    (t) => [
+        index("idx_roleActions_roleId_orgId_actionId").on(
+            t.roleId,
+            t.orgId,
+            t.actionId
+        )
+    ]
+);
 
-export const userActions = pgTable("userActions", {
+export const userActions = pgTable(
-    userId: varchar("userId")
+    "userActions",
-        .notNull()
+    {
-        .references(() => users.userId, { onDelete: "cascade" }),
+        userId: varchar("userId")
-    actionId: varchar("actionId")
+            .notNull()
-        .notNull()
+            .references(() => users.userId, { onDelete: "cascade" }),
-        .references(() => actions.actionId, { onDelete: "cascade" }),
+        actionId: varchar("actionId")
-    orgId: varchar("orgId")
+            .notNull()
-        .notNull()
+            .references(() => actions.actionId, { onDelete: "cascade" }),
-        .references(() => orgs.orgId, { onDelete: "cascade" })
+        orgId: varchar("orgId")
-});
+            .notNull()
+            .references(() => orgs.orgId, { onDelete: "cascade" })
+    },
+    (t) => [
+        index("idx_userActions_userId_orgId_actionId").on(
+            t.userId,
+            t.orgId,
+            t.actionId
+        )
+    ]
+);
 
 export const roleSites = pgTable("roleSites", {
     roleId: integer("roleId")
@@ -1004,40 +1095,44 @@ export const idpOrg = pgTable("idpOrg", {
     orgMapping: varchar("orgMapping")
 });
 
-export const clients = pgTable("clients", {
+export const clients = pgTable(
-    clientId: serial("clientId").primaryKey(),
+    "clients",
-    orgId: varchar("orgId")
+    {
-        .references(() => orgs.orgId, {
+        clientId: serial("clientId").primaryKey(),
+        orgId: varchar("orgId")
+            .references(() => orgs.orgId, {
+                onDelete: "cascade"
+            })
+            .notNull(),
+        exitNodeId: integer("exitNode").references(() => exitNodes.exitNodeId, {
+            onDelete: "set null"
+        }),
+        userId: text("userId").references(() => users.userId, {
+            // optionally tied to a user and in this case delete when the user deletes
             onDelete: "cascade"
-        })
+        }),
-        .notNull(),
+        niceId: varchar("niceId").notNull(),
-    exitNodeId: integer("exitNode").references(() => exitNodes.exitNodeId, {
+        olmId: text("olmId"), // to lock it to a specific olm optionally
-        onDelete: "set null"
+        name: varchar("name").notNull(),
-    }),
+        pubKey: varchar("pubKey"),
-    userId: text("userId").references(() => users.userId, {
+        subnet: varchar("subnet").notNull(),
-        // optionally tied to a user and in this case delete when the user deletes
+        megabytesIn: real("bytesIn"),
-        onDelete: "cascade"
+        megabytesOut: real("bytesOut"),
-    }),
+        lastBandwidthUpdate: varchar("lastBandwidthUpdate"),
-    niceId: varchar("niceId").notNull(),
+        lastPing: integer("lastPing"),
-    olmId: text("olmId"), // to lock it to a specific olm optionally
+        type: varchar("type").notNull(), // "olm"
-    name: varchar("name").notNull(),
+        online: boolean("online").notNull().default(false),
-    pubKey: varchar("pubKey"),
+        // endpoint: varchar("endpoint"),
-    subnet: varchar("subnet").notNull(),
+        lastHolePunch: integer("lastHolePunch"),
-    megabytesIn: real("bytesIn"),
+        maxConnections: integer("maxConnections"),
-    megabytesOut: real("bytesOut"),
+        archived: boolean("archived").notNull().default(false),
-    lastBandwidthUpdate: varchar("lastBandwidthUpdate"),
+        blocked: boolean("blocked").notNull().default(false),
-    lastPing: integer("lastPing"),
+        approvalState: varchar("approvalState").$type<
-    type: varchar("type").notNull(), // "olm"
+            "pending" | "approved" | "denied"
-    online: boolean("online").notNull().default(false),
+        >()
-    // endpoint: varchar("endpoint"),
+    },
-    lastHolePunch: integer("lastHolePunch"),
+    (t) => [index("idx_clients_userid").on(t.userId)]
-    maxConnections: integer("maxConnections"),
+);
-    archived: boolean("archived").notNull().default(false),
-    blocked: boolean("blocked").notNull().default(false),
-    approvalState: varchar("approvalState").$type<
-        "pending" | "approved" | "denied"
-    >()
-});
 
 export const clientSitesAssociationsCache = pgTable(
     "clientSitesAssociationsCache",
@@ -1049,7 +1144,11 @@ export const clientSitesAssociationsCache = pgTable(
         isJitMode: boolean("isJitMode").notNull().default(false),
         endpoint: varchar("endpoint"),
         publicKey: varchar("publicKey") // this will act as the session's public key for hole punching so we can track when it changes
-    }
+    },
+    (t) => [
+        primaryKey({ columns: [t.clientId, t.siteId] }),
+        index("idx_clientsitesassociationscache_siteid").on(t.siteId)
+    ]
 );
 
 export const clientSiteResourcesAssociationsCache = pgTable(
@@ -1058,7 +1157,14 @@ export const clientSiteResourcesAssociationsCache = pgTable(
         clientId: integer("clientId") // not a foreign key here so after its deleted the rebuild function can delete it and send the message
             .notNull(),
         siteResourceId: integer("siteResourceId").notNull()
-    }
+    },
+    (t) => [
+        primaryKey({ columns: [t.clientId, t.siteResourceId] }),
+        index("idx_clientSiteResourcesAssociationsCache_siteResourceId").on(
+            t.siteResourceId,
+            t.clientId
+        )
+    ]
 );
 
 export const clientPostureSnapshots = pgTable("clientPostureSnapshots", {
@@ -1071,23 +1177,27 @@ export const clientPostureSnapshots = pgTable("clientPostureSnapshots", {
     collectedAt: integer("collectedAt").notNull()
 });
 
-export const olms = pgTable("olms", {
+export const olms = pgTable(
-    olmId: varchar("id").primaryKey(),
+    "olms",
-    secretHash: varchar("secretHash").notNull(),
+    {
-    dateCreated: varchar("dateCreated").notNull(),
+        olmId: varchar("id").primaryKey(),
-    version: text("version"),
+        secretHash: varchar("secretHash").notNull(),
-    agent: text("agent"),
+        dateCreated: varchar("dateCreated").notNull(),
-    name: varchar("name"),
+        version: text("version"),
-    clientId: integer("clientId").references(() => clients.clientId, {
+        agent: text("agent"),
-        // we will switch this depending on the current org it wants to connect to
+        name: varchar("name"),
-        onDelete: "set null"
+        clientId: integer("clientId").references(() => clients.clientId, {
-    }),
+            // we will switch this depending on the current org it wants to connect to
-    userId: text("userId").references(() => users.userId, {
+            onDelete: "set null"
-        // optionally tied to a user and in this case delete when the user deletes
+        }),
-        onDelete: "cascade"
+        userId: text("userId").references(() => users.userId, {
-    }),
+            // optionally tied to a user and in this case delete when the user deletes
-    archived: boolean("archived").notNull().default(false)
+            onDelete: "cascade"
-});
+        }),
+        archived: boolean("archived").notNull().default(false)
+    },
+    (t) => [index("idx_olms_clientid").on(t.clientId)]
+);
 
 export const currentFingerprint = pgTable("currentFingerprint", {
     fingerprintId: serial("id").primaryKey(),

server/db/sqlite/driver.ts

@@ -1,6 +1,5 @@
 import { drizzle as DrizzleSqlite } from "drizzle-orm/better-sqlite3";
 import Database from "better-sqlite3";
-import type BetterSqlite3 from "better-sqlite3";
 import * as schema from "./schema/schema";
 import path from "path";
 import fs from "fs";
@@ -12,68 +11,31 @@ export const exists = checkFileExists(location);
 
 bootstrapVolume();
 
-/**
- * Wraps better-sqlite3 Statement to call `finalize()` immediately after
- * execution, freeing native sqlite3_stmt memory deterministically instead
- * of waiting for GC. Fixes steady off-heap growth under load (#2120).
- * WARNING: Finalizes after first execution — incompatible with drizzle's
- * reusable .prepare() builders. No such usage exists in this codebase.
- */
-function autoFinalizeStatement(
-    stmt: BetterSqlite3.Statement
-): BetterSqlite3.Statement {
-    const wrapExec = <T extends (...args: any[]) => any>(fn: T): T => {
-        return function (this: any, ...args: any[]) {
-            try {
-                return fn.apply(this, args);
-            } finally {
-                try {
-                    // finalize() exists on the native Statement at runtime but
-                    // is missing from @types/better-sqlite3.
-                    (stmt as any).finalize();
-                } catch {
-                    // Already finalized — harmless
-                }
-            }
-        } as unknown as T;
-    };
-
-    stmt.run = wrapExec(stmt.run);
-    stmt.get = wrapExec(stmt.get);
-    stmt.all = wrapExec(stmt.all);
-
-    return stmt;
-}
-
 function createDb() {
     const sqlite = new Database(location);
 
     if (process.env.ENABLE_SQLITE_WAL_MODE == "true") {
         // Enable WAL mode — allows concurrent readers + single writer, preventing
         // contention across subsystems (verifySession, Traefik, audit, ping).
+        // NOTE: journal_mode persists in the DB file once set; unsetting this
+        // env var does NOT revert an existing WAL database.
         sqlite.pragma("journal_mode = WAL");
         // NORMAL sync mode: safe with WAL, reduces write lock hold time.
         sqlite.pragma("synchronous = NORMAL");
     }
 
-    // Wait up to 5s on SQLITE_BUSY instead of failing — prevents audit log
+    // No busy_timeout pragma: better-sqlite3 already arms
-    // retry loops that accumulate memory.
+    // sqlite3_busy_timeout(db, 5000) via its default `timeout` option
-    sqlite.pragma("busy_timeout = 5000");
+    // (lib/database.js), so an explicit pragma is redundant.
 
-    // 64 MB page cache (default 2 MB) — reduces I/O round-trips on large
+    // Intentionally NOT setting cache_size or mmap_size: a large page cache plus
-    // TraefikConfigManager JOINs that block the event loop.
+    // a multi-hundred-MB mmap region inflate RSS and cause page-cache thrashing
-    sqlite.pragma("cache_size = -65536");
+    // on small (~1 GB) instances. Leave SQLite on its conservative defaults.
 
-    // 256 MB memory-mapped I/O — OS serves reads from page cache directly,
+    // Intentionally NOT wrapping prepare()/statements: better-sqlite3 finalizes
-    // reducing event-loop blocking.
+    // sqlite3_stmt in the Statement destructor at GC, and drizzle-orm prepares a
-    sqlite.pragma("mmap_size = 268435456");
+    // fresh statement per query (no statement cache), so statements cannot
-
+    // accumulate. better-sqlite3 11.x exposes no Statement.finalize() at all.
-    // Wrap prepare() so every drizzle-orm statement is auto-finalized after
-    // first use, preventing sqlite3_stmt accumulation between GC cycles.
-    const originalPrepare = sqlite.prepare.bind(sqlite);
-    (sqlite as any).prepare = function autoFinalizePrepare(source: string) {
-        return autoFinalizeStatement(originalPrepare(source));
-    };
 
     return DrizzleSqlite(sqlite, {
         schema

server/index.ts

@@ -24,6 +24,7 @@ import license from "#dynamic/license/license";
 import { initLogCleanupInterval } from "@server/lib/cleanupLogs";
 import { initAcmeCertSync } from "#dynamic/lib/acmeCertSync";
 import { fetchServerIp } from "@server/lib/serverIpService";
+import { startRebuildQueueProcessor } from "@server/lib/rebuildClientAssociations";
 
 async function startServers() {
     await setHostMeta();
@@ -41,6 +42,7 @@ async function startServers() {
 
     initLogCleanupInterval();
     initAcmeCertSync();
+    startRebuildQueueProcessor();
 
     // Start all servers
     const apiServer = createApiServer();

server/lib/billing/usageService.ts

@@ -12,7 +12,7 @@ import {
 import { FeatureId, getFeatureMeterId } from "./features";
 import logger from "@server/logger";
 import { build } from "@server/build";
-import cache from "#dynamic/lib/cache";
+import { regionalCache as cache } from "#dynamic/lib/cache";
 
 export function noop() {
     if (build !== "saas") {
@@ -22,7 +22,6 @@ export function noop() {
 }
 
 export class UsageService {
-
     constructor() {
         if (noop()) {
             return;
@@ -57,7 +56,10 @@ export class UsageService {
             try {
                 let usage;
                 if (transaction) {
-                    const orgIdToUse = await this.getBillingOrg(orgId, transaction);
+                    const orgIdToUse = await this.getBillingOrg(
+                        orgId,
+                        transaction
+                    );
                     usage = await this.internalAddUsage(
                         orgIdToUse,
                         featureId,

server/lib/blueprints/applyBlueprint.ts

@@ -48,18 +48,18 @@ export async function applyBlueprint({
     name,
     source = "API"
 }: ApplyBlueprintArgs): Promise<Blueprint> {
-    // Validate the input data
-    const validationResult = ConfigSchema.safeParse(configData);
-    if (!validationResult.success) {
-        throw new Error(fromError(validationResult.error).toString());
-    }
-
-    const config: Config = validationResult.data;
     let blueprintSucceeded: boolean = false;
-    let blueprintMessage: string;
+    let blueprintMessage = "";
     let error: any | null = null;
 
     try {
+        const validationResult = ConfigSchema.safeParse(configData);
+        if (!validationResult.success) {
+            throw new Error(fromError(validationResult.error).toString());
+        }
+
+        const config: Config = validationResult.data;
+
         let proxyResourcesResults: PublicResourcesResults = [];
         let clientResourcesResults: ClientResourcesResults = [];
         await db.transaction(async (trx) => {

server/lib/pathMatch.ts

@@ -0,0 +1,74 @@
+const MAX_RECURSION_DEPTH = 100;
+
+const segmentRegexCache = new Map<string, RegExp>();
+
+function getSegmentRegex(patternPart: string): RegExp {
+    let regex = segmentRegexCache.get(patternPart);
+    if (!regex) {
+        const regexPattern = patternPart
+            .replace(/[.+^${}()|[\]\\]/g, "\\$&")
+            .replace(/\*/g, ".*")
+            .replace(/\?/g, ".");
+        regex = new RegExp(`^${regexPattern}$`);
+        segmentRegexCache.set(patternPart, regex);
+    }
+    return regex;
+}
+
+export function isPathAllowed(pattern: string, path: string): boolean {
+    const normalize = (p: string) => p.split("/").filter(Boolean);
+    const patternParts = normalize(pattern);
+    const pathParts = normalize(path);
+
+    function matchSegments(
+        patternIndex: number,
+        pathIndex: number,
+        depth: number = 0
+    ): boolean {
+        if (depth > MAX_RECURSION_DEPTH) {
+            return false;
+        }
+
+        const currentPatternPart = patternParts[patternIndex];
+        const currentPathPart = pathParts[pathIndex];
+
+        if (patternIndex >= patternParts.length) {
+            return pathIndex >= pathParts.length;
+        }
+
+        if (pathIndex >= pathParts.length) {
+            return patternParts.slice(patternIndex).every((p) => p === "*");
+        }
+
+        if (currentPatternPart === "*") {
+            if (matchSegments(patternIndex + 1, pathIndex, depth + 1)) {
+                return true;
+            }
+            if (matchSegments(patternIndex, pathIndex + 1, depth + 1)) {
+                return true;
+            }
+            return false;
+        }
+
+        if (currentPatternPart.includes("*")) {
+            const regex = getSegmentRegex(currentPatternPart);
+
+            if (regex.test(currentPathPart)) {
+                return matchSegments(
+                    patternIndex + 1,
+                    pathIndex + 1,
+                    depth + 1
+                );
+            }
+            return false;
+        }
+
+        if (currentPatternPart !== currentPathPart) {
+            return false;
+        }
+
+        return matchSegments(patternIndex + 1, pathIndex + 1, depth + 1);
+    }
+
+    return matchSegments(0, 0, 0);
+}

server/lib/rebuildClientAssociations.ts

@@ -8,6 +8,7 @@ import {
     exitNodes,
     newts,
     olms,
+    primaryDb,
     roleSiteResources,
     Site,
     SiteResource,
@@ -20,10 +21,10 @@ import {
 } from "@server/db";
 import { and, count, eq, inArray, ne } from "drizzle-orm";
 
-import { deletePeer as newtDeletePeer } from "@server/routers/newt/peers";
+import { deletePeersBatch as newtDeletePeersBatch } from "@server/routers/newt/peers";
 import {
-    initPeerAddHandshake,
+    initPeerAddHandshakeBatch,
-    deletePeer as olmDeletePeer
+    deletePeersBatch as olmDeletePeersBatch
 } from "@server/routers/olm/peers";
 import { sendToExitNode } from "#dynamic/lib/exitNodes";
 import logger from "@server/logger";
@@ -34,12 +35,13 @@ import {
     parseEndpoint
 } from "@server/lib/ip";
 import {
-    addPeerData,
+    addPeerDataBatch,
-    addTargets as addSubnetProxyTargets,
+    addTargetsBatch as addSubnetProxyTargetsBatch,
-    removePeerData,
+    removePeerDataBatch,
-    removeTargets as removeSubnetProxyTargets
+    removeTargetsBatch as removeSubnetProxyTargetsBatch
 } from "@server/routers/client/targets";
 import { lockManager } from "#dynamic/lib/lock";
+import { rebuildQueue } from "#dynamic/lib/rebuildQueue";
 
 // TTL for rebuild-association locks. These functions can fan out into many
 // peer/proxy updates, so give them a generous window.
@@ -160,18 +162,33 @@ export async function getClientSiteResourceAccess(
 export async function rebuildClientAssociationsFromSiteResource(
     siteResource: SiteResource,
     trx: Transaction | typeof db = db
-): Promise<{
+) {
-    mergedAllClients: {
+    try {
-        clientId: number;
+        return await lockManager.withLock(
-        pubKey: string | null;
+            `rebuild-client-associations:site-resource:${siteResource.siteResourceId}`,
-        subnet: string | null;
+            () =>
-    }[];
+                rebuildClientAssociationsFromSiteResourceImpl(
-}> {
+                    siteResource,
-    return await lockManager.withLock(
+                    trx
-        `rebuild-client-associations:site-resource:${siteResource.siteResourceId}`,
+                ),
-        () => rebuildClientAssociationsFromSiteResourceImpl(siteResource, trx),
+            REBUILD_ASSOCIATIONS_LOCK_TTL_MS
-        REBUILD_ASSOCIATIONS_LOCK_TTL_MS
+        );
-    );
+    } catch (err: any) {
+        if (
+            typeof err?.message === "string" &&
+            err.message.startsWith("Failed to acquire lock")
+        ) {
+            logger.warn(
+                `rebuildClientAssociations: could not acquire lock for site resource ${siteResource.siteResourceId}, queuing for deferred processing`
+            );
+            await rebuildQueue.enqueue({
+                type: "site-resource",
+                id: siteResource.siteResourceId
+            });
+            return { mergedAllClients: [] };
+        }
+        throw err;
+    }
 }
 
 async function rebuildClientAssociationsFromSiteResourceImpl(
@@ -536,6 +553,28 @@ async function handleMessagesForSiteClients(
     const newtJobs: Promise<any>[] = [];
     const olmJobs: Promise<any>[] = [];
     const exitNodeJobs: Promise<any>[] = [];
+    const newtPeerDeletes: {
+        siteId: number;
+        publicKey: string;
+        newtId: string;
+    }[] = [];
+    const olmPeerDeletes: {
+        clientId: number;
+        siteId: number;
+        publicKey: string;
+        olmId: string;
+    }[] = [];
+    const olmPeerAddHandshakes: {
+        clientId: number;
+        peer: {
+            siteId: number;
+            exitNode: {
+                publicKey: string;
+                endpoint: string;
+            };
+        };
+        olmId: string;
+    }[] = [];
 
     // Combine all clients that need processing (those being added or removed)
     const clientsToProcess = new Map<
@@ -584,6 +623,21 @@ async function handleMessagesForSiteClients(
         }
     }
 
+    // Batch-fetch all olm IDs for the clients we need to process
+    const clientIdsToProcess = Array.from(clientsToProcess.keys());
+    const olmRows =
+        clientIdsToProcess.length > 0
+            ? await trx
+                  .select({ olmId: olms.olmId, clientId: olms.clientId })
+                  .from(olms)
+                  .where(inArray(olms.clientId, clientIdsToProcess))
+            : [];
+    const olmByClientId = new Map<number, string>(
+        olmRows
+            .filter((r) => r.clientId !== null)
+            .map((r) => [r.clientId as number, r.olmId])
+    );
+
     for (const client of clientsToProcess.values()) {
         // UPDATE THE NEWT
         if (!client.subnet || !client.pubKey) {
@@ -600,14 +654,8 @@ async function handleMessagesForSiteClients(
             continue;
         }
 
-        const [olm] = await trx
+        const olmId = olmByClientId.get(client.clientId);
-            .select({
+        if (!olmId) {
-                olmId: olms.olmId
-            })
-            .from(olms)
-            .where(eq(olms.clientId, client.clientId))
-            .limit(1);
-        if (!olm) {
             logger.warn(
                 `Olm not found for client ${client.clientId} so cannot add/delete peers`
             );
@@ -615,15 +663,17 @@ async function handleMessagesForSiteClients(
         }
 
         if (isDelete) {
-            newtJobs.push(newtDeletePeer(siteId, client.pubKey, newt.newtId));
+            newtPeerDeletes.push({
-            olmJobs.push(
+                siteId,
-                olmDeletePeer(
+                publicKey: client.pubKey,
-                    client.clientId,
+                newtId: newt.newtId
-                    siteId,
+            });
-                    site.publicKey,
+            olmPeerDeletes.push({
-                    olm.olmId
+                clientId: client.clientId,
-                )
+                siteId,
-            );
+                publicKey: site.publicKey,
+                olmId
+            });
         }
 
         if (isAdd) {
@@ -635,23 +685,34 @@ async function handleMessagesForSiteClients(
                 continue;
             }
 
-            await initPeerAddHandshake(
+            olmPeerAddHandshakes.push({
-                // this will kick off the add peer process for the client
+                clientId: client.clientId,
-                client.clientId,
+                peer: {
-                {
                     siteId,
                     exitNode: {
                         publicKey: exitNode.publicKey,
                         endpoint: exitNode.endpoint
                     }
                 },
-                olm.olmId
+                olmId
-            );
+            });
         }
 
         exitNodeJobs.push(updateClientSiteDestinations(client, trx));
     }
 
+    if (newtPeerDeletes.length > 0) {
+        newtJobs.push(newtDeletePeersBatch(newtPeerDeletes));
+    }
+
+    if (olmPeerDeletes.length > 0) {
+        olmJobs.push(olmDeletePeersBatch(olmPeerDeletes));
+    }
+
+    if (olmPeerAddHandshakes.length > 0) {
+        olmJobs.push(initPeerAddHandshakeBatch(olmPeerAddHandshakes));
+    }
+
     Promise.all(exitNodeJobs).catch((error) => {
         logger.error(
             `rebuildClientAssociations: Error updating client site destinations for site ${site.siteId}:`,
@@ -812,6 +873,20 @@ async function handleSubnetProxyTargetUpdates(
 ): Promise<void> {
     const proxyJobs: Promise<any>[] = [];
     const olmJobs: Promise<any>[] = [];
+    const targetsToAddBatch: {
+        newtId: string;
+        targets: NonNullable<
+            Awaited<ReturnType<typeof generateSubnetProxyTargetV2>>
+        >;
+        version: string | null;
+    }[] = [];
+    const targetsToRemoveBatch: {
+        newtId: string;
+        targets: NonNullable<
+            Awaited<ReturnType<typeof generateSubnetProxyTargetV2>>
+        >;
+        version: string | null;
+    }[] = [];
 
     for (const siteData of sitesList) {
         const siteId = siteData.siteId;
@@ -843,25 +918,25 @@ async function handleSubnetProxyTargetUpdates(
                 );
 
                 if (targetsToAdd) {
-                    proxyJobs.push(
+                    targetsToAddBatch.push({
-                        addSubnetProxyTargets(
+                        newtId: newt.newtId,
-                            newt.newtId,
+                        targets: targetsToAdd,
-                            targetsToAdd,
+                        version: newt.version
-                            newt.version
+                    });
-                        )
-                    );
                 }
 
-                for (const client of addedClients) {
+                olmJobs.push(
-                    olmJobs.push(
+                    addPeerDataBatch(
-                        addPeerData(
+                        addedClients.map((client) => ({
-                            client.clientId,
+                            clientId: client.clientId,
                             siteId,
-                            generateRemoteSubnets([siteResource]),
+                            remoteSubnets: generateRemoteSubnets([
-                            generateAliasConfig([siteResource])
+                                siteResource
-                        )
+                            ]),
-                    );
+                            aliases: generateAliasConfig([siteResource])
-                }
+                        }))
+                    )
+                );
             }
         }
 
@@ -880,15 +955,20 @@ async function handleSubnetProxyTargetUpdates(
                 );
 
                 if (targetsToRemove) {
-                    proxyJobs.push(
+                    targetsToRemoveBatch.push({
-                        removeSubnetProxyTargets(
+                        newtId: newt.newtId,
-                            newt.newtId,
+                        targets: targetsToRemove,
-                            targetsToRemove,
+                        version: newt.version
-                            newt.version
+                    });
-                        )
-                    );
                 }
 
+                const peerDataRemovals: {
+                    clientId: number;
+                    siteId: number;
+                    remoteSubnets: string[];
+                    aliases: ReturnType<typeof generateAliasConfig>;
+                }[] = [];
+
                 for (const client of removedClients) {
                     if (!siteResource.destination) {
                         continue;
@@ -936,31 +1016,58 @@ async function handleSubnetProxyTargetUpdates(
                             ? []
                             : generateRemoteSubnets([siteResource]);
 
-                    olmJobs.push(
+                    peerDataRemovals.push({
-                        removePeerData(
+                        clientId: client.clientId,
-                            client.clientId,
+                        siteId,
-                            siteId,
+                        remoteSubnets: remoteSubnetsToRemove,
-                            remoteSubnetsToRemove,
+                        aliases: generateAliasConfig([siteResource])
-                            generateAliasConfig([siteResource])
+                    });
-                        )
+                }
-                    );
+
+                if (peerDataRemovals.length > 0) {
+                    olmJobs.push(removePeerDataBatch(peerDataRemovals));
                 }
             }
         }
     }
 
-    await Promise.all(proxyJobs);
+    if (targetsToAddBatch.length > 0) {
+        proxyJobs.push(addSubnetProxyTargetsBatch(targetsToAddBatch));
+    }
+
+    if (targetsToRemoveBatch.length > 0) {
+        proxyJobs.push(removeSubnetProxyTargetsBatch(targetsToRemoveBatch));
+    }
+
+    await Promise.all([...proxyJobs, ...olmJobs]);
 }
 
 export async function rebuildClientAssociationsFromClient(
     client: Client,
     trx: Transaction | typeof db = db
 ): Promise<void> {
-    return await lockManager.withLock(
+    try {
-        `rebuild-client-associations:client:${client.clientId}`,
+        return await lockManager.withLock(
-        () => rebuildClientAssociationsFromClientImpl(client, trx),
+            `rebuild-client-associations:client:${client.clientId}`,
-        REBUILD_ASSOCIATIONS_LOCK_TTL_MS
+            () => rebuildClientAssociationsFromClientImpl(client, trx),
-    );
+            REBUILD_ASSOCIATIONS_LOCK_TTL_MS
+        );
+    } catch (err: any) {
+        if (
+            typeof err?.message === "string" &&
+            err.message.startsWith("Failed to acquire lock")
+        ) {
+            logger.warn(
+                `rebuildClientAssociations: could not acquire lock for client ${client.clientId}, queuing for deferred processing`
+            );
+            await rebuildQueue.enqueue({
+                type: "client",
+                id: client.clientId
+            });
+            return;
+        }
+        throw err;
+    }
 }
 
 async function rebuildClientAssociationsFromClientImpl(
@@ -1237,6 +1344,28 @@ async function handleMessagesForClientSites(
     const newtJobs: Promise<any>[] = [];
     const olmJobs: Promise<any>[] = [];
     const exitNodeJobs: Promise<any>[] = [];
+    const newtPeerDeletes: {
+        siteId: number;
+        publicKey: string;
+        newtId: string;
+    }[] = [];
+    const olmPeerDeletes: {
+        clientId: number;
+        siteId: number;
+        publicKey: string;
+        olmId: string;
+    }[] = [];
+    const olmPeerAddHandshakes: {
+        clientId: number;
+        peer: {
+            siteId: number;
+            exitNode: {
+                publicKey: string;
+                endpoint: string;
+            };
+        };
+        olmId: string;
+    }[] = [];
 
     const totalSitesOnClient = await trx
         .select({ count: count(clientSitesAssociationsCache.siteId) })
@@ -1268,19 +1397,19 @@ async function handleMessagesForClientSites(
 
         if (isRemove) {
             // Remove peer from newt
-            newtJobs.push(
+            newtPeerDeletes.push({
-                newtDeletePeer(site.siteId, client.pubKey, newt.newtId)
+                siteId: site.siteId,
-            );
+                publicKey: client.pubKey,
+                newtId: newt.newtId
+            });
             try {
                 // Remove peer from olm
-                olmJobs.push(
+                olmPeerDeletes.push({
-                    olmDeletePeer(
+                    clientId: client.clientId,
-                        client.clientId,
+                    siteId: site.siteId,
-                        site.siteId,
+                    publicKey: site.publicKey,
-                        site.publicKey,
+                    olmId
-                        olmId
+                });
-                    )
-                );
             } catch (error) {
                 // if the error includes not found then its just because the olm does not exist anymore or yet and its fine if we dont send
                 if (
@@ -1312,10 +1441,9 @@ async function handleMessagesForClientSites(
                 continue;
             }
 
-            await initPeerAddHandshake(
+            olmPeerAddHandshakes.push({
-                // this will kick off the add peer process for the client
+                clientId: client.clientId,
-                client.clientId,
+                peer: {
-                {
                     siteId: site.siteId,
                     exitNode: {
                         publicKey: exitNode.publicKey,
@@ -1323,7 +1451,7 @@ async function handleMessagesForClientSites(
                     }
                 },
                 olmId
-            );
+            });
         }
 
         // Update exit node destinations
@@ -1339,6 +1467,18 @@ async function handleMessagesForClientSites(
         );
     }
 
+    if (newtPeerDeletes.length > 0) {
+        newtJobs.push(newtDeletePeersBatch(newtPeerDeletes));
+    }
+
+    if (olmPeerDeletes.length > 0) {
+        olmJobs.push(olmDeletePeersBatch(olmPeerDeletes));
+    }
+
+    if (olmPeerAddHandshakes.length > 0) {
+        olmJobs.push(initPeerAddHandshakeBatch(olmPeerAddHandshakes));
+    }
+
     Promise.all(exitNodeJobs).catch((error) => {
         logger.error(
             `rebuildClientAssociations: Error updating client site destinations for client ${client.clientId}:`,
@@ -1437,6 +1577,20 @@ async function handleMessagesForClientResources(
                 continue;
             }
 
+            const targetsToAddBatch: {
+                newtId: string;
+                targets: NonNullable<
+                    Awaited<ReturnType<typeof generateSubnetProxyTargetV2>>
+                >;
+                version: string | null;
+            }[] = [];
+            const peerDataAdds: {
+                clientId: number;
+                siteId: number;
+                remoteSubnets: string[];
+                aliases: ReturnType<typeof generateAliasConfig>;
+            }[] = [];
+
             for (const resource of resources) {
                 const targets = await generateSubnetProxyTargetV2(resource, [
                     {
@@ -1447,25 +1601,21 @@ async function handleMessagesForClientResources(
                 ]);
 
                 if (targets) {
-                    proxyJobs.push(
+                    targetsToAddBatch.push({
-                        addSubnetProxyTargets(
+                        newtId: newt.newtId,
-                            newt.newtId,
+                        targets,
-                            targets,
+                        version: newt.version
-                            newt.version
+                    });
-                        )
-                    );
                 }
 
                 try {
                     // Add peer data to olm
-                    olmJobs.push(
+                    peerDataAdds.push({
-                        addPeerData(
+                        clientId: client.clientId,
-                            client.clientId,
+                        siteId,
-                            siteId,
+                        remoteSubnets: generateRemoteSubnets([resource]),
-                            generateRemoteSubnets([resource]),
+                        aliases: generateAliasConfig([resource])
-                            generateAliasConfig([resource])
+                    });
-                        )
-                    );
                 } catch (error) {
                     // if the error includes not found then its just because the olm does not exist anymore or yet and its fine if we dont send
                     if (
@@ -1480,6 +1630,14 @@ async function handleMessagesForClientResources(
                     }
                 }
             }
+
+            if (targetsToAddBatch.length > 0) {
+                proxyJobs.push(addSubnetProxyTargetsBatch(targetsToAddBatch));
+            }
+
+            if (peerDataAdds.length > 0) {
+                olmJobs.push(addPeerDataBatch(peerDataAdds));
+            }
         }
     }
 
@@ -1546,6 +1704,20 @@ async function handleMessagesForClientResources(
                 continue;
             }
 
+            const targetsToRemoveBatch: {
+                newtId: string;
+                targets: NonNullable<
+                    Awaited<ReturnType<typeof generateSubnetProxyTargetV2>>
+                >;
+                version: string | null;
+            }[] = [];
+            const peerDataRemovals: {
+                clientId: number;
+                siteId: number;
+                remoteSubnets: string[];
+                aliases: ReturnType<typeof generateAliasConfig>;
+            }[] = [];
+
             for (const resource of resources) {
                 const targets = await generateSubnetProxyTargetV2(resource, [
                     {
@@ -1556,13 +1728,11 @@ async function handleMessagesForClientResources(
                 ]);
 
                 if (targets) {
-                    proxyJobs.push(
+                    targetsToRemoveBatch.push({
-                        removeSubnetProxyTargets(
+                        newtId: newt.newtId,
-                            newt.newtId,
+                        targets,
-                            targets,
+                        version: newt.version
-                            newt.version
+                    });
-                        )
-                    );
                 }
 
                 try {
@@ -1613,14 +1783,12 @@ async function handleMessagesForClientResources(
                             : generateRemoteSubnets([resource]);
 
                     // Remove peer data from olm
-                    olmJobs.push(
+                    peerDataRemovals.push({
-                        removePeerData(
+                        clientId: client.clientId,
-                            client.clientId,
+                        siteId,
-                            siteId,
+                        remoteSubnets: remoteSubnetsToRemove,
-                            remoteSubnetsToRemove,
+                        aliases: generateAliasConfig([resource])
-                            generateAliasConfig([resource])
+                    });
-                        )
-                    );
                 } catch (error) {
                     // if the error includes not found then its just because the olm does not exist anymore or yet and its fine if we dont send
                     if (
@@ -1635,6 +1803,16 @@ async function handleMessagesForClientResources(
                     }
                 }
             }
+
+            if (targetsToRemoveBatch.length > 0) {
+                proxyJobs.push(
+                    removeSubnetProxyTargetsBatch(targetsToRemoveBatch)
+                );
+            }
+
+            if (peerDataRemovals.length > 0) {
+                olmJobs.push(removePeerDataBatch(peerDataRemovals));
+            }
         }
     }
 
@@ -1884,11 +2062,20 @@ export async function cleanupSiteAssociations(
 
     // 7. Fire all removal messages in parallel.
     const jobs: Promise<any>[] = [];
+    const olmPeerDeletes: {
+        clientId: number;
+        siteId: number;
+        publicKey: string;
+    }[] = [];
 
     for (const client of allClients) {
         // Tell each olm to drop the site's WireGuard peer.
         if (site.publicKey) {
-            jobs.push(olmDeletePeer(client.clientId, siteId, site.publicKey));
+            olmPeerDeletes.push({
+                clientId: client.clientId,
+                siteId,
+                publicKey: site.publicKey
+            });
         }
 
         // Recompute and push updated relay destinations (now excluding this site).
@@ -1897,6 +2084,10 @@ export async function cleanupSiteAssociations(
         }
     }
 
+    if (olmPeerDeletes.length > 0) {
+        jobs.push(olmDeletePeersBatch(olmPeerDeletes));
+    }
+
     await Promise.all(jobs).catch((error) => {
         logger.error(
             `cleanupSiteAssociations: error sending cleanup messages for siteId=${siteId}:`,
@@ -1906,3 +2097,47 @@ export async function cleanupSiteAssociations(
 
     logger.debug(`cleanupSiteAssociations: DONE siteId=${siteId}`);
 }
+
+/**
+ * Start the background rebuild queue processor. This should be called once
+ * during server startup. Only one server instance at a time will actively
+ * consume the queue (enforced via a distributed Redis lock); all other
+ * instances will poll and wait until the lock becomes available.
+ */
+export function startRebuildQueueProcessor(): void {
+    rebuildQueue.startProcessing({
+        onSiteResource: async (siteResourceId: number) => {
+            const [siteResource] = await primaryDb
+                .select()
+                .from(siteResources)
+                .where(eq(siteResources.siteResourceId, siteResourceId));
+
+            if (!siteResource) {
+                logger.warn(
+                    `Rebuild queue: site resource ${siteResourceId} not found, skipping`
+                );
+                return;
+            }
+
+            await rebuildClientAssociationsFromSiteResource(
+                siteResource,
+                primaryDb
+            );
+        },
+        onClient: async (clientId: number) => {
+            const [client] = await primaryDb
+                .select()
+                .from(clients)
+                .where(eq(clients.clientId, clientId));
+
+            if (!client) {
+                logger.warn(
+                    `Rebuild queue: client ${clientId} not found, skipping`
+                );
+                return;
+            }
+
+            await rebuildClientAssociationsFromClient(client, primaryDb);
+        }
+    });
+}

server/lib/rebuildQueue.ts

@@ -0,0 +1,23 @@
+export type RebuildJobType = "site-resource" | "client";
+
+export interface RebuildJob {
+    type: RebuildJobType;
+    id: number;
+}
+
+export interface RebuildJobHandlers {
+    onSiteResource(siteResourceId: number): Promise<void>;
+    onClient(clientId: number): Promise<void>;
+}
+
+export interface RebuildQueueManager {
+    enqueue(job: RebuildJob): Promise<void>;
+    startProcessing(handlers: RebuildJobHandlers): void;
+}
+
+class NoopRebuildQueue implements RebuildQueueManager {
+    async enqueue(_job: RebuildJob): Promise<void> {}
+    startProcessing(_handlers: RebuildJobHandlers): void {}
+}
+
+export const rebuildQueue: RebuildQueueManager = new NoopRebuildQueue();

server/lib/traefik/TraefikConfigManager.ts

@@ -511,6 +511,12 @@ export class TraefikConfigManager {
         let traefikConfig;
         try {
             const currentExitNode = await getCurrentExitNodeId();
+
+            const maintenancePort = config.getRawConfig().server.next_port;
+            const maintenanceHost =
+                config.getRawConfig().server.internal_hostname;
+            const pangolinUIUrl = `http://${maintenanceHost}:${maintenancePort}`;
+
             // logger.debug(`Fetching traefik config for exit node: ${currentExitNode}`);
             traefikConfig = await getTraefikConfig(
                 // this is called by the local exit node to get its own config
@@ -521,7 +527,8 @@ export class TraefikConfigManager {
                 build == "saas"
                     ? false
                     : config.getRawConfig().traefik.allow_raw_resources, // dont allow raw resources on saas otherwise use config
-                build != "oss" // generate browser gateway targets on cloud and enterprise
+                pangolinUIUrl, // generate maintenance pages on cloud and hybrid
+                pangolinUIUrl // generate browser gateway targets on cloud and hybrid
             );
 
             const domains = new Set<string>();

server/lib/traefik/getTraefikConfig.ts

@@ -44,8 +44,8 @@ export async function getTraefikConfig(
     filterOutNamespaceDomains = false, // UNUSED BUT USED IN PRIVATE
     generateLoginPageRouters = false, // UNUSED BUT USED IN PRIVATE
     allowRawResources = true,
-    allowMaintenancePage = true, // UNUSED BUT USED IN PRIVATE
+    maintenancePageUiUrl: string | null = null, // UNUSED BUT USED IN PRIVATE
-    allowBrowserGatewayResources = true
+    browserGatewayUiUrl: string | null = null // UNUSED BUT USED IN PRIVATE
 ): Promise<any> {
     // Get resources with their targets and sites in a single optimized query
     // Start from sites on this exit node, then join to targets and resources

server/lib/validators.test.ts

@@ -1,4 +1,7 @@
-import { isValidUrlGlobPattern } from "./validators";
+import {
+    getResourceRuleValueValidationError,
+    isValidUrlGlobPattern
+} from "./validators";
 import { assertEquals } from "@test/assert";
 
 function runTests() {
@@ -236,6 +239,43 @@ function runTests() {
         "Path with isolated percent sign should be invalid"
     );
 
+    // ASN validation tests
+    assertEquals(
+        getResourceRuleValueValidationError("ASN", "AS15169"),
+        null,
+        "Standard ASN should be valid"
+    );
+    assertEquals(
+        getResourceRuleValueValidationError("ASN", "  As15169  "),
+        null,
+        "Standard ASN should be valid with mixed case and whitespace"
+    );
+    assertEquals(
+        getResourceRuleValueValidationError("ASN", "ALL"),
+        null,
+        "ALL ASN selector should be valid"
+    );
+    assertEquals(
+        getResourceRuleValueValidationError("ASN", " all "),
+        null,
+        "ALL ASN selector should be valid with mixed case and whitespace"
+    );
+    assertEquals(
+        getResourceRuleValueValidationError("ASN", "AS0"),
+        null,
+        "AS0 alias should be valid"
+    );
+    assertEquals(
+        getResourceRuleValueValidationError("ASN", " as0 "),
+        null,
+        "AS0 alias should be valid with mixed case and whitespace"
+    );
+    assertEquals(
+        getResourceRuleValueValidationError("ASN", "not-an-asn"),
+        "Invalid ASN provided",
+        "Invalid ASN should return an error"
+    );
+
     console.log("All tests passed!");
 }
 

server/lib/validators.ts

@@ -100,7 +100,10 @@ export function getResourceRuleValueValidationError(
                 ? null
                 : "Invalid country code provided";
         case "ASN":
-            return /^AS\d+$/i.test(value.trim())
+            const normalizedValue = value.trim().toUpperCase();
+            return /^AS\d+$/.test(normalizedValue) ||
+                normalizedValue === "ALL" ||
+                normalizedValue === "AS0"
                 ? null
                 : "Invalid ASN provided";
         default:

server/private/lib/certificates.ts

@@ -17,7 +17,7 @@ import { certificates, db } from "@server/db";
 import { and, eq, isNotNull, or, inArray, sql } from "drizzle-orm";
 import { decrypt } from "@server/lib/crypto";
 import logger from "@server/logger";
-import cache from "#private/lib/cache";
+import { regionalCache as cache } from "#private/lib/cache";
 import { build } from "@server/build";
 
 // Define the return type for clarity and type safety

server/private/lib/rebuildQueue.ts

@@ -0,0 +1,198 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { redis } from "#private/lib/redis";
+import { lockManager } from "#dynamic/lib/lock";
+import logger from "@server/logger";
+
+export type RebuildJobType = "site-resource" | "client";
+
+export interface RebuildJob {
+    type: RebuildJobType;
+    id: number;
+}
+
+export interface RebuildJobHandlers {
+    onSiteResource(siteResourceId: number): Promise<void>;
+    onClient(clientId: number): Promise<void>;
+}
+
+// Redis list holding pending rebuild jobs (RPUSH to enqueue, LPOP to dequeue — FIFO order).
+const QUEUE_KEY = "rebuild-client-associations:queue";
+const QUEUED_SET_KEY = "rebuild-client-associations:queued";
+
+// Distributed lock that serialises queue consumption to a single server instance
+// at a time. TTL is generous enough to cover a full batch of expensive rebuilds.
+const PROCESSOR_LOCK_KEY = "rebuild-client-associations:processor";
+
+// Each rebuild can take up to REBUILD_ASSOCIATIONS_LOCK_TTL_MS (120 s) per
+// resource. Allow BATCH_SIZE resources per processor-lock acquisition, plus a
+// small buffer.
+const BATCH_SIZE = 5;
+const PROCESSOR_LOCK_TTL_MS = 120000 * BATCH_SIZE + 30000; // ~630 s
+
+const POLL_INTERVAL_MS = 500;
+
+class RedisRebuildQueue {
+    private processingStarted = false;
+
+    async enqueue(job: RebuildJob): Promise<void> {
+        if (!redis || redis.status !== "ready") {
+            logger.warn(
+                `Rebuild queue: Redis not available — rebuild for ${job.type}:${job.id} will not be retried`
+            );
+            return;
+        }
+
+        try {
+            const dedupeKey = `${job.type}:${job.id}`;
+            const added = await redis.sadd(QUEUED_SET_KEY, dedupeKey);
+            if (added === 0) {
+                logger.debug(
+                    `Rebuild queue: skipped duplicate queued job ${job.type}:${job.id}`
+                );
+                return;
+            }
+
+            await redis.rpush(QUEUE_KEY, JSON.stringify(job));
+            logger.debug(
+                `Rebuild queue: enqueued ${job.type}:${job.id} (queue position: tail)`
+            );
+        } catch (err) {
+            await redis
+                .srem(QUEUED_SET_KEY, `${job.type}:${job.id}`)
+                .catch((cleanupErr) =>
+                    logger.warn(
+                        `Rebuild queue: failed to cleanup dedupe key for ${job.type}:${job.id} after enqueue failure:`,
+                        cleanupErr
+                    )
+                );
+            logger.error(
+                `Rebuild queue: failed to enqueue ${job.type}:${job.id}:`,
+                err
+            );
+        }
+    }
+
+    startProcessing(handlers: RebuildJobHandlers): void {
+        if (this.processingStarted) return;
+        this.processingStarted = true;
+
+        this.processLoop(handlers).catch((err) => {
+            logger.error("Rebuild queue processor loop crashed:", err);
+        });
+
+        logger.info("Rebuild queue processor started");
+    }
+
+    private async processLoop(handlers: RebuildJobHandlers): Promise<void> {
+        while (true) {
+            try {
+                await this.tryProcessBatch(handlers);
+            } catch (err) {
+                logger.error(
+                    "Rebuild queue: unhandled error in process loop:",
+                    err
+                );
+            }
+            await new Promise((resolve) =>
+                setTimeout(resolve, POLL_INTERVAL_MS)
+            );
+        }
+    }
+
+    private async tryProcessBatch(handlers: RebuildJobHandlers): Promise<void> {
+        if (!redis || redis.status !== "ready") return;
+
+        // Peek before acquiring the processor lock to avoid unnecessary Redis
+        // round-trips and lock contention when the queue is idle.
+        const queueLength = await redis.llen(QUEUE_KEY).catch(() => 0);
+        if (queueLength === 0) return;
+
+        try {
+            await lockManager.withLock(
+                PROCESSOR_LOCK_KEY,
+                async () => {
+                    for (let i = 0; i < BATCH_SIZE; i++) {
+                        if (!redis || redis.status !== "ready") break;
+
+                        const payload = await redis.lpop(QUEUE_KEY);
+                        if (payload === null) break; // queue drained
+
+                        let job: RebuildJob;
+                        try {
+                            job = JSON.parse(payload) as RebuildJob;
+                        } catch {
+                            logger.error(
+                                `Rebuild queue: could not parse job payload, discarding: ${payload}`
+                            );
+                            continue;
+                        }
+
+                        // Remove from dedupe set once dequeued so the same job
+                        // can be re-queued while this one is in progress.
+                        await redis
+                            .srem(QUEUED_SET_KEY, `${job.type}:${job.id}`)
+                            .catch((cleanupErr) =>
+                                logger.warn(
+                                    `Rebuild queue: failed to remove dedupe key for ${job.type}:${job.id} on dequeue:`,
+                                    cleanupErr
+                                )
+                            );
+
+                        logger.debug(
+                            `Rebuild queue: processing ${job.type}:${job.id}`
+                        );
+
+                        try {
+                            if (job.type === "site-resource") {
+                                await handlers.onSiteResource(job.id);
+                            } else if (job.type === "client") {
+                                await handlers.onClient(job.id);
+                            } else {
+                                logger.warn(
+                                    `Rebuild queue: unknown job type "${(job as any).type}", discarding`
+                                );
+                            }
+
+                            logger.debug(
+                                `Rebuild queue: completed ${job.type}:${job.id}`
+                            );
+                        } catch (err) {
+                            logger.error(
+                                `Rebuild queue: job ${job.type}:${job.id} threw an error:`,
+                                err
+                            );
+                        }
+                    }
+                },
+                PROCESSOR_LOCK_TTL_MS
+            );
+        } catch (err: any) {
+            if (
+                typeof err?.message === "string" &&
+                err.message.startsWith("Failed to acquire lock")
+            ) {
+                // Another server instance currently holds the processor lock and
+                // is consuming the queue — nothing to do this cycle.
+                logger.debug(
+                    "Rebuild queue: processor lock held by another instance, skipping this cycle"
+                );
+            } else {
+                throw err;
+            }
+        }
+    }
+}
+
+export const rebuildQueue: RedisRebuildQueue = new RedisRebuildQueue();

server/private/lib/traefik/getTraefikConfig.ts

@@ -84,8 +84,8 @@ export async function getTraefikConfig(
     filterOutNamespaceDomains = false,
     generateLoginPageRouters = false,
     allowRawResources = true,
-    allowMaintenancePage = true,
+    maintenancePageUiUrl: string | null = null,
-    allowBrowserGatewayResources = true
+    browserGatewayUiUrl: string | null = null
 ): Promise<any> {
     // Get resources with their targets and sites in a single optimized query
     // Start from sites on this exit node, then join to targets and resources
@@ -317,7 +317,7 @@ export async function getTraefikConfig(
         BrowserGatewayResourceEntry
     >();
 
-    if (allowBrowserGatewayResources) {
+    if (browserGatewayUiUrl) {
         for (const row of resourcesWithTargetsAndSites) {
             if (!["ssh", "vnc", "rdp"].includes(row.mode)) {
                 continue;
@@ -630,10 +630,11 @@ export async function getTraefikConfig(
                 }
             }
 
-            if (showMaintenancePage && allowMaintenancePage) {
+            if (showMaintenancePage && maintenancePageUiUrl) {
                 const maintenanceServiceName = `${key}-maintenance-service`;
                 const maintenanceRouterName = `${key}-maintenance-router`;
                 const rewriteMiddlewareName = `${key}-maintenance-rewrite`;
+                const maintenanceHeadersMiddlewareName = `${key}-maintenance-headers`;
 
                 const entrypointHttp =
                     config.getRawConfig().traefik.http_entrypoint;
@@ -646,15 +647,11 @@ export async function getTraefikConfig(
                     ? `*.${domainParts.slice(1).join(".")}`
                     : fullDomain;
 
-                const maintenancePort = config.getRawConfig().server.next_port;
-                const maintenanceHost =
-                    config.getRawConfig().server.internal_hostname;
-
                 config_output.http.services[maintenanceServiceName] = {
                     loadBalancer: {
                         servers: [
                             {
-                                url: `http://${maintenanceHost}:${maintenancePort}`
+                                url: maintenancePageUiUrl
                             }
                         ],
                         passHostHeader: true
@@ -673,12 +670,26 @@ export async function getTraefikConfig(
                     }
                 };
 
+                config_output.http.middlewares[
+                    maintenanceHeadersMiddlewareName
+                ] = {
+                    headers: {
+                        customRequestHeaders: {
+                            Host: "app.pangolin.net", // if we are sending to the cloud the host needs to be this but we will pull the p-host to find the resource
+                            "p-host": fullDomain
+                        }
+                    }
+                };
+
                 config_output.http.routers[maintenanceRouterName] = {
                     entryPoints: [
                         resource.ssl ? entrypointHttps : entrypointHttp
                     ],
                     service: maintenanceServiceName,
-                    middlewares: [rewriteMiddlewareName],
+                    middlewares: [
+                        rewriteMiddlewareName,
+                        maintenanceHeadersMiddlewareName
+                    ],
                     rule: rule,
                     priority: 2000,
                     ...(resource.ssl ? { tls } : {})
@@ -691,6 +702,7 @@ export async function getTraefikConfig(
                             resource.ssl ? entrypointHttps : entrypointHttp
                         ],
                         service: maintenanceServiceName,
+                        middlewares: [maintenanceHeadersMiddlewareName],
                         rule: `${rule} && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`) || Path(\`/favicon.ico\`)) `,
                         priority: 2001,
                         ...(resource.ssl ? { tls } : {})
@@ -1027,7 +1039,7 @@ export async function getTraefikConfig(
         }
     }
 
-    if (allowBrowserGatewayResources) {
+    if (browserGatewayUiUrl) {
         // Generate Traefik config for browser gateway resources
         const browserGatewayPort = 39999;
         for (const [, bgResource] of browserGatewayResourcesMap.entries()) {
@@ -1119,20 +1131,17 @@ export async function getTraefikConfig(
                 }
             }
 
-            if (showBgMaintenancePage && allowMaintenancePage) {
+            if (showBgMaintenancePage && maintenancePageUiUrl) {
                 const bgMaintenanceServiceName = `bg-r${bgResource.resourceId}-maintenance-service`;
                 const bgMaintenanceRouterName = `bg-r${bgResource.resourceId}-maintenance-router`;
                 const bgRewriteMiddlewareName = `bg-r${bgResource.resourceId}-maintenance-rewrite`;
+                const bgMaintenanceHeadersMiddlewareName = `bg-r${bgResource.resourceId}-maintenance-headers`;
 
                 const entrypointHttp =
                     config.getRawConfig().traefik.http_entrypoint;
                 const entrypointHttps =
                     config.getRawConfig().traefik.https_entrypoint;
 
-                const maintenancePort = config.getRawConfig().server.next_port;
-                const maintenanceHost =
-                    config.getRawConfig().server.internal_hostname;
-
                 if (!config_output.http.services)
                     config_output.http.services = {};
                 if (!config_output.http.middlewares)
@@ -1144,7 +1153,7 @@ export async function getTraefikConfig(
                     loadBalancer: {
                         servers: [
                             {
-                                url: `http://${maintenanceHost}:${maintenancePort}`
+                                url: maintenancePageUiUrl
                             }
                         ],
                         passHostHeader: true
@@ -1158,12 +1167,26 @@ export async function getTraefikConfig(
                     }
                 };
 
+                config_output.http.middlewares![
+                    bgMaintenanceHeadersMiddlewareName
+                ] = {
+                    headers: {
+                        customRequestHeaders: {
+                            Host: "app.pangolin.net", // if we are sending to the cloud the host needs to be this but we will pull the p-host to find the resource
+                            "p-host": fullDomain
+                        }
+                    }
+                };
+
                 config_output.http.routers![bgMaintenanceRouterName] = {
                     entryPoints: [
                         bgResource.ssl ? entrypointHttps : entrypointHttp
                     ],
                     service: bgMaintenanceServiceName,
-                    middlewares: [bgRewriteMiddlewareName],
+                    middlewares: [
+                        bgRewriteMiddlewareName,
+                        bgMaintenanceHeadersMiddlewareName
+                    ],
                     rule: hostRule,
                     priority: 2000,
                     ...(bgResource.ssl ? { tls } : {})
@@ -1176,6 +1199,7 @@ export async function getTraefikConfig(
                         bgResource.ssl ? entrypointHttps : entrypointHttp
                     ],
                     service: bgMaintenanceServiceName,
+                    middlewares: [bgMaintenanceHeadersMiddlewareName],
                     rule: `${hostRule} && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`) || Path(\`/favicon.ico\`))`,
                     priority: 2001,
                     ...(bgResource.ssl ? { tls } : {})
@@ -1234,9 +1258,8 @@ export async function getTraefikConfig(
             // The primary type is used for the path rewrite (e.g. /rdp), mirroring
             // how the maintenance page rewrites everything to /maintenance-screen.
             const primaryType = typeMap.keys().next().value as string;
-            const internalHost = config.getRawConfig().server.internal_hostname;
-            const internalPort = config.getRawConfig().server.next_port;
             const uiRewriteMiddlewareName = `bg-r${bgResource.resourceId}-ui-rewrite`;
+            const uiHeadersMiddlewareName = `bg-r${bgResource.resourceId}-ui-headers`;
             const entrypoint = bgResource.ssl
                 ? config.getRawConfig().traefik.https_entrypoint
                 : config.getRawConfig().traefik.http_entrypoint;
@@ -1252,22 +1275,33 @@ export async function getTraefikConfig(
                 }
             };
 
+            config_output.http.middlewares![uiHeadersMiddlewareName] = {
+                headers: {
+                    customRequestHeaders: {
+                        Host: "app.pangolin.net", // if we are sending to the cloud the host needs to be this but we will pull the p-host to find the resource
+                        "p-host": fullDomain
+                    }
+                }
+            };
+
             config_output.http.services![bgUiServiceName] = {
                 loadBalancer: {
                     servers: [
                         {
-                            url: `http://${internalHost}:${internalPort}`
+                            url: browserGatewayUiUrl
                         }
                     ]
                 }
             };
 
-            // Assets router at higher priority so /_next files load without rewrite
+            // Assets router at higher priority so /_next files load without rewrite.
+            // Do NOT apply the path-rewrite middleware here — static assets must
+            // keep their original path; only the host headers are needed.
             config_output.http.routers![
                 `bg-r${bgResource.resourceId}-assets-router`
             ] = {
                 entryPoints: [entrypoint],
-                middlewares: routerMiddlewares,
+                middlewares: [...routerMiddlewares, uiHeadersMiddlewareName],
                 service: bgUiServiceName,
                 rule: `${hostRule} && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`) || Path(\`/favicon.ico\`))`,
                 priority: 101,
@@ -1279,7 +1313,11 @@ export async function getTraefikConfig(
                 `bg-r${bgResource.resourceId}-ui-router`
             ] = {
                 entryPoints: [entrypoint],
-                middlewares: [...routerMiddlewares, uiRewriteMiddlewareName],
+                middlewares: [
+                    ...routerMiddlewares,
+                    uiRewriteMiddlewareName,
+                    uiHeadersMiddlewareName
+                ],
                 service: bgUiServiceName,
                 rule: hostRule,
                 priority: 100,
@@ -1312,10 +1350,6 @@ export async function getTraefikConfig(
             const siteResourceRouterName = `${srKey}-router`;
             const siteResourceRewriteMiddlewareName = `${srKey}-rewrite`;
 
-            const maintenancePort = config.getRawConfig().server.next_port;
-            const maintenanceHost =
-                config.getRawConfig().server.internal_hostname;
-
             if (!config_output.http.routers) {
                 config_output.http.routers = {};
             }
@@ -1331,7 +1365,7 @@ export async function getTraefikConfig(
                 loadBalancer: {
                     servers: [
                         {
-                            url: `http://${maintenanceHost}:${maintenancePort}`
+                            url: maintenancePageUiUrl
                         }
                     ],
                     passHostHeader: true

server/private/routers/hybrid.ts

@@ -277,6 +277,8 @@ hybridRouter.get(
             );
         }
 
+        const pangolinUIUrl = config.getRawConfig().app.dashboard_url; // points to the dashboard to serve from there
+
         try {
             const traefikConfig = await getTraefikConfig(
                 remoteExitNode.exitNodeId,
@@ -284,8 +286,8 @@ hybridRouter.get(
                 true, // But don't allow domain namespace resources
                 false, // Dont include login pages,
                 true, // allow raw resources
-                false, // dont generate maintenance page
+                pangolinUIUrl, // dont generate maintenance page
-                false // dont generate browser gateway targets
+                pangolinUIUrl // generate browser gateway targets
             );
 
             return response(res, {

server/private/routers/remoteExitNode/listRemoteExitNodes.ts

@@ -22,7 +22,7 @@ import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { ListRemoteExitNodesResponse } from "@server/routers/remoteExitNode/types";
-import cache from "#private/lib/cache";
+import { regionalCache as cache } from "#private/lib/cache";
 import semver from "semver";
 
 let stalePangolinNodeVersion: string | null = null;

server/private/routers/ws/ws.ts

@@ -38,6 +38,7 @@ import { messageHandlers } from "@server/routers/ws/messageHandlers";
 import { messageHandlers as privateMessageHandlers } from "#private/routers/ws/messageHandlers";
 import {
     AuthenticatedWebSocket,
+    BatchSendMessage,
     ClientType,
     WSMessage,
     TokenPayload,
@@ -187,6 +188,8 @@ const wss: WebSocketServer = new WebSocketServer({ noServer: true });
 // Generate unique node ID for this instance
 const NODE_ID = uuidv4();
 const REDIS_CHANNEL = "websocket_messages";
+const REDIS_DIRECT_BATCH_SIZE = 250;
+const REDIS_DIRECT_FLUSH_INTERVAL_MS = 10;
 
 // Client tracking map (local to this node)
 const connectedClients: Map<string, AuthenticatedWebSocket[]> = new Map();
@@ -197,6 +200,15 @@ const clientConfigVersions: Map<string, number> = new Map();
 // Recovery tracking
 let isRedisRecoveryInProgress = false;
 
+interface RedisDirectBatchEntry {
+    targetClientId: string;
+    message: WSMessage;
+    resolve: () => void;
+}
+
+let pendingRedisDirectMessages: RedisDirectBatchEntry[] = [];
+let redisDirectFlushTimer: NodeJS.Timeout | null = null;
+
 // Helper to get map key
 const getClientMapKey = (clientId: string) => clientId;
 
@@ -207,6 +219,78 @@ const getNodeConnectionsKey = (nodeId: string, clientId: string) =>
 const getConfigVersionKey = (clientId: string) =>
     `ws:configVersion:${clientId}`;
 
+const clearRedisDirectFlushTimer = (): void => {
+    if (redisDirectFlushTimer) {
+        clearTimeout(redisDirectFlushTimer);
+        redisDirectFlushTimer = null;
+    }
+};
+
+const publishDirectBatch = async (
+    entries: RedisDirectBatchEntry[]
+): Promise<void> => {
+    const redisMessage: RedisMessage = {
+        type: "direct-batch",
+        messages: entries.map((entry) => ({
+            targetClientId: entry.targetClientId,
+            message: entry.message
+        })),
+        fromNodeId: NODE_ID
+    };
+
+    await redisManager.publish(REDIS_CHANNEL, JSON.stringify(redisMessage));
+};
+
+const flushPendingRedisDirectMessages = async (): Promise<void> => {
+    clearRedisDirectFlushTimer();
+
+    if (pendingRedisDirectMessages.length === 0) {
+        return;
+    }
+
+    const entries = pendingRedisDirectMessages;
+    pendingRedisDirectMessages = [];
+
+    if (!redisManager.isRedisEnabled()) {
+        entries.forEach((entry) => entry.resolve());
+        return;
+    }
+
+    for (let i = 0; i < entries.length; i += REDIS_DIRECT_BATCH_SIZE) {
+        const batch = entries.slice(i, i + REDIS_DIRECT_BATCH_SIZE);
+        try {
+            await publishDirectBatch(batch);
+        } catch (error) {
+            logger.error(
+                "Failed to send batched direct messages via Redis, messages may be lost:",
+                error
+            );
+        } finally {
+            batch.forEach((entry) => entry.resolve());
+        }
+    }
+};
+
+const enqueueRedisDirectMessage = async (
+    targetClientId: string,
+    message: WSMessage
+): Promise<void> => {
+    await new Promise<void>((resolve) => {
+        pendingRedisDirectMessages.push({ targetClientId, message, resolve });
+
+        if (pendingRedisDirectMessages.length >= REDIS_DIRECT_BATCH_SIZE) {
+            void flushPendingRedisDirectMessages();
+            return;
+        }
+
+        if (!redisDirectFlushTimer) {
+            redisDirectFlushTimer = setTimeout(() => {
+                void flushPendingRedisDirectMessages();
+            }, REDIS_DIRECT_FLUSH_INTERVAL_MS);
+        }
+    });
+};
+
 // Initialize Redis subscription for cross-node messaging
 const initializeRedisSubscription = async (): Promise<void> => {
     if (!redisManager.isRedisEnabled()) return;
@@ -227,7 +311,16 @@ const initializeRedisSubscription = async (): Promise<void> => {
                     // Send to specific client on this node
                     await sendToClientLocal(
                         redisMessage.targetClientId,
-                        redisMessage.message
+                        redisMessage.message,
+                        {},
+                        redisMessage.message.configVersion
+                    );
+                } else if (
+                    redisMessage.type === "direct-batch" &&
+                    redisMessage.messages
+                ) {
+                    await sendRedisDirectBatchToLocalClients(
+                        redisMessage.messages
                     );
                 } else if (redisMessage.type === "broadcast") {
                     // Broadcast to all clients on this node except excluded
@@ -503,7 +596,8 @@ const incrementClientConfigVersion = async (
 const sendToClientLocal = async (
     clientId: string,
     message: WSMessage,
-    options: SendMessageOptions = {}
+    options: SendMessageOptions = {},
+    preResolvedConfigVersion?: number
 ): Promise<boolean> => {
     const mapKey = getClientMapKey(clientId);
     const clients = connectedClients.get(mapKey);
@@ -512,7 +606,8 @@ const sendToClientLocal = async (
     }
 
     // Handle config version
-    const configVersion = await getClientConfigVersion(clientId);
+    const configVersion =
+        preResolvedConfigVersion ?? (await getClientConfigVersion(clientId));
 
     // Add config version to message
     const messageWithVersion = {
@@ -545,43 +640,71 @@ const sendToClientLocal = async (
     return true;
 };
 
+const sendRedisDirectBatchToLocalClients = async (
+    entries: { targetClientId: string; message: WSMessage }[]
+): Promise<void> => {
+    const jobs = entries.map((entry) =>
+        sendToClientLocal(
+            entry.targetClientId,
+            entry.message,
+            {},
+            entry.message.configVersion
+        )
+    );
+    await Promise.all(jobs);
+};
+
 const broadcastToAllExceptLocal = async (
     message: WSMessage,
     excludeClientId?: string,
     options: SendMessageOptions = {}
 ): Promise<void> => {
-    for (const [mapKey, clients] of connectedClients.entries()) {
+    const sendPlans = await Promise.all(
-        const [type, id] = mapKey.split(":");
+        Array.from(connectedClients.entries()).map(
-        const clientId = mapKey; // mapKey is the clientId
+            async ([mapKey, clients]) => {
-        if (!(excludeClientId && clientId === excludeClientId)) {
+                const clientId = mapKey; // mapKey is the clientId
-            // Handle config version per client
+                if (excludeClientId && clientId === excludeClientId) {
-            let configVersion = await getClientConfigVersion(clientId);
+                    return null;
-            if (options.incrementConfigVersion) {
+                }
-                configVersion = await incrementClientConfigVersion(clientId);
-            }
 
-            // Add config version to message
+                let configVersion = await getClientConfigVersion(clientId);
-            const messageWithVersion = {
+                if (options.incrementConfigVersion) {
-                ...message,
+                    configVersion =
-                configVersion
+                        await incrementClientConfigVersion(clientId);
-            };
+                }
 
-            if (options.compress) {
+                return {
-                const compressed = zlib.gzipSync(
+                    clients,
-                    Buffer.from(JSON.stringify(messageWithVersion), "utf8")
+                    messageWithVersion: {
-                );
+                        ...message,
-                clients.forEach((client) => {
+                        configVersion
-                    if (client.readyState === WebSocket.OPEN) {
-                        client.send(compressed);
                     }
-                });
+                };
-            } else {
-                clients.forEach((client) => {
-                    if (client.readyState === WebSocket.OPEN) {
-                        client.send(JSON.stringify(messageWithVersion));
-                    }
-                });
             }
+        )
+    );
+
+    for (const plan of sendPlans) {
+        if (!plan) {
+            continue;
+        }
+
+        if (options.compress) {
+            const compressed = zlib.gzipSync(
+                Buffer.from(JSON.stringify(plan.messageWithVersion), "utf8")
+            );
+            plan.clients.forEach((client) => {
+                if (client.readyState === WebSocket.OPEN) {
+                    client.send(compressed);
+                }
+            });
+        } else {
+            const messageString = JSON.stringify(plan.messageWithVersion);
+            plan.clients.forEach((client) => {
+                if (client.readyState === WebSocket.OPEN) {
+                    client.send(messageString);
+                }
+            });
         }
     }
 };
@@ -602,28 +725,23 @@ const sendToClient = async (
     );
 
     // Try to send locally first
-    const localSent = await sendToClientLocal(clientId, message, options);
+    const localSent = await sendToClientLocal(
+        clientId,
+        message,
+        options,
+        configVersion
+    );
 
     // Only send via Redis if the client is not connected locally and Redis is enabled
     if (!localSent && redisManager.isRedisEnabled()) {
         try {
-            const redisMessage: RedisMessage = {
+            await enqueueRedisDirectMessage(clientId, {
-                type: "direct",
+                ...message,
-                targetClientId: clientId,
+                configVersion
-                message: {
+            });
-                    ...message,
-                    configVersion
-                },
-                fromNodeId: NODE_ID
-            };
-
-            await redisManager.publish(
-                REDIS_CHANNEL,
-                JSON.stringify(redisMessage)
-            );
         } catch (error) {
             logger.error(
-                "Failed to send message via Redis, message may be lost:",
+                "Failed to queue batched direct message for Redis delivery, message may be lost:",
                 error
             );
             // Continue execution - local delivery already attempted
@@ -638,6 +756,95 @@ const sendToClient = async (
     return localSent;
 };
 
+const sendToClientsBatch = async (
+    entries: BatchSendMessage[]
+): Promise<void> => {
+    if (entries.length === 0) {
+        return;
+    }
+
+    const remoteEntries: { targetClientId: string; message: WSMessage }[] = [];
+    const clientsWithIncrement = new Set(
+        entries
+            .filter((entry) => !!entry.options?.incrementConfigVersion)
+            .map((entry) => entry.clientId)
+    );
+    const nonIncrementOnlyClientIds = Array.from(
+        new Set(
+            entries
+                .map((entry) => entry.clientId)
+                .filter((clientId) => !clientsWithIncrement.has(clientId))
+        )
+    );
+    const stableConfigVersionByClient = new Map<string, number | undefined>(
+        await Promise.all(
+            nonIncrementOnlyClientIds.map(
+                async (clientId) =>
+                    [clientId, await getClientConfigVersion(clientId)] as const
+            )
+        )
+    );
+
+    for (const entry of entries) {
+        const options = entry.options || {};
+        const { clientId, message } = entry;
+
+        const configVersion = options.incrementConfigVersion
+            ? await incrementClientConfigVersion(clientId)
+            : stableConfigVersionByClient.get(clientId);
+
+        logger.debug(
+            `sendToClientsBatch: Message type ${message.type} queued for clientId ${clientId} (new configVersion: ${configVersion})`
+        );
+
+        const localSent = await sendToClientLocal(
+            clientId,
+            message,
+            options,
+            configVersion
+        );
+
+        if (!localSent && redisManager.isRedisEnabled()) {
+            remoteEntries.push({
+                targetClientId: clientId,
+                message: {
+                    ...message,
+                    configVersion
+                }
+            });
+        } else if (!localSent && !redisManager.isRedisEnabled()) {
+            logger.debug(
+                `Could not deliver batch message to ${clientId} - not connected locally and Redis unavailable`
+            );
+        }
+    }
+
+    if (!redisManager.isRedisEnabled() || remoteEntries.length === 0) {
+        return;
+    }
+
+    for (let i = 0; i < remoteEntries.length; i += REDIS_DIRECT_BATCH_SIZE) {
+        const messages = remoteEntries.slice(i, i + REDIS_DIRECT_BATCH_SIZE);
+        try {
+            const redisMessage: RedisMessage = {
+                type: "direct-batch",
+                messages,
+                fromNodeId: NODE_ID
+            };
+
+            await redisManager.publish(
+                REDIS_CHANNEL,
+                JSON.stringify(redisMessage)
+            );
+        } catch (error) {
+            logger.error(
+                "Failed to send explicit direct batch via Redis, messages may be lost:",
+                error
+            );
+        }
+    }
+};
+
 const broadcastToAllExcept = async (
     message: WSMessage,
     excludeClientId?: string,
@@ -1109,6 +1316,8 @@ const disconnectClient = async (clientId: string): Promise<boolean> => {
 // Cleanup function for graceful shutdown
 const cleanup = async (): Promise<void> => {
     try {
+        await flushPendingRedisDirectMessages();
+
         // Close all WebSocket connections
         connectedClients.forEach((clients) => {
             clients.forEach((client) => {
@@ -1139,6 +1348,7 @@ export {
     router,
     handleWSUpgrade,
     sendToClient,
+    sendToClientsBatch,
     broadcastToAllExcept,
     connectedClients,
     hasActiveConnections,

server/routers/badger/verifySession.test.ts

@@ -1,5 +1,6 @@
 import { assertEquals } from "@test/assert";
 import { REGIONS } from "@server/db/regions";
+import { isPathAllowed } from "@server/lib/pathMatch";
 
 function isIpInRegion(
     ipCountryCode: string | undefined,
@@ -33,76 +34,6 @@ function isIpInRegion(
     return false;
 }
 
-function isPathAllowed(pattern: string, path: string): boolean {
-    // Normalize and split paths into segments
-    const normalize = (p: string) => p.split("/").filter(Boolean);
-    const patternParts = normalize(pattern);
-    const pathParts = normalize(path);
-
-    // Recursive function to try different wildcard matches
-    function matchSegments(patternIndex: number, pathIndex: number): boolean {
-        const indent = "  ".repeat(pathIndex); // Indent based on recursion depth
-        const currentPatternPart = patternParts[patternIndex];
-        const currentPathPart = pathParts[pathIndex];
-
-        // If we've consumed all pattern parts, we should have consumed all path parts
-        if (patternIndex >= patternParts.length) {
-            const result = pathIndex >= pathParts.length;
-            return result;
-        }
-
-        // If we've consumed all path parts but still have pattern parts
-        if (pathIndex >= pathParts.length) {
-            // The only way this can match is if all remaining pattern parts are wildcards
-            const remainingPattern = patternParts.slice(patternIndex);
-            const result = remainingPattern.every((p) => p === "*");
-            return result;
-        }
-
-        // For full segment wildcards, try consuming different numbers of path segments
-        if (currentPatternPart === "*") {
-            // Try consuming 0 segments (skip the wildcard)
-            if (matchSegments(patternIndex + 1, pathIndex)) {
-                return true;
-            }
-
-            // Try consuming current segment and recursively try rest
-            if (matchSegments(patternIndex, pathIndex + 1)) {
-                return true;
-            }
-
-            return false;
-        }
-
-        // Check for in-segment wildcard (e.g., "prefix*" or "prefix*suffix")
-        if (currentPatternPart.includes("*")) {
-            // Convert the pattern segment to a regex pattern
-            const regexPattern = currentPatternPart
-                .replace(/\*/g, ".*") // Replace * with .* for regex wildcard
-                .replace(/\?/g, "."); // Replace ? with . for single character wildcard if needed
-
-            const regex = new RegExp(`^${regexPattern}$`);
-
-            if (regex.test(currentPathPart)) {
-                return matchSegments(patternIndex + 1, pathIndex + 1);
-            }
-
-            return false;
-        }
-
-        // For regular segments, they must match exactly
-        if (currentPatternPart !== currentPathPart) {
-            return false;
-        }
-
-        // Move to next segments in both pattern and path
-        return matchSegments(patternIndex + 1, pathIndex + 1);
-    }
-
-    const result = matchSegments(0, 0);
-    return result;
-}
-
 function runTests() {
     console.log("Running path matching tests...");
 
@@ -308,6 +239,121 @@ function runTests() {
     console.log("All path matching tests passed!");
 }
 
+function runSpecialCharacterTests() {
+    console.log("\nRunning special character tests...");
+
+    let threw = false;
+    try {
+        isPathAllowed("(api*", "anything");
+        isPathAllowed("a(b*", "a(bc");
+        isPathAllowed("c[d*", "c[de");
+        isPathAllowed("x{2}*", "x{2}y");
+        isPathAllowed("a|b*", "a|bc");
+        isPathAllowed("back\\slash*", "back\\slashed");
+    } catch (e) {
+        threw = true;
+        console.error(
+            "Patterns accepted by isValidUrlGlobPattern crashed the matcher:",
+            e instanceof Error ? e.message : e
+        );
+    }
+    assertEquals(
+        threw,
+        false,
+        "Patterns with regex metacharacters must not throw"
+    );
+
+    assertEquals(
+        isPathAllowed("(api*", "(api-v1"),
+        true,
+        "Parenthesis should be treated as a literal character"
+    );
+    assertEquals(
+        isPathAllowed("(api*", "xapi-v1"),
+        false,
+        "Parenthesis should not match other characters"
+    );
+    assertEquals(
+        isPathAllowed("a(b)*", "a(b)c"),
+        true,
+        "Parentheses pair should be treated as literal characters"
+    );
+
+    assertEquals(
+        isPathAllowed("*.png", "image.png"),
+        true,
+        "Dot should match a literal dot"
+    );
+    assertEquals(
+        isPathAllowed("*.png", "imageXpng"),
+        false,
+        "Dot should not act as a regex wildcard"
+    );
+    assertEquals(
+        isPathAllowed("v1.0*", "v1.0.1"),
+        true,
+        "Version-like literal should match itself"
+    );
+    assertEquals(
+        isPathAllowed("v1.0*", "v1x0-beta"),
+        false,
+        "Version-like literal should not match arbitrary characters"
+    );
+
+    assertEquals(
+        isPathAllowed("a+b*", "a+bc"),
+        true,
+        "Plus should be treated as a literal character"
+    );
+    assertEquals(
+        isPathAllowed("a+b*", "aaabc"),
+        false,
+        "Plus should not act as a regex quantifier"
+    );
+
+    assertEquals(
+        isPathAllowed("$ref*", "$refs"),
+        true,
+        "Dollar sign should be treated as a literal character"
+    );
+    assertEquals(
+        isPathAllowed("price$*", "price$100"),
+        true,
+        "Dollar sign mid-pattern should be treated as a literal character"
+    );
+
+    assertEquals(
+        isPathAllowed("^start*", "^started"),
+        true,
+        "Caret should be treated as a literal character"
+    );
+
+    assertEquals(
+        isPathAllowed("a|b*", "a|bc"),
+        true,
+        "Pipe should be treated as a literal character"
+    );
+    assertEquals(
+        isPathAllowed("a|b*", "a"),
+        false,
+        "Pipe should not act as regex alternation"
+    );
+
+    assertEquals(
+        isPathAllowed("file?*", "fileX"),
+        true,
+        "Question mark should still act as a single-character wildcard"
+    );
+
+    assertEquals(
+        isPathAllowed("api/*", "api/" + "x/".repeat(50)),
+        true,
+        "Deeply nested paths should still match"
+    );
+
+    console.log("All special character tests passed!");
+}
+
 function runRegionTests() {
     console.log("\nRunning isIpInRegion tests...");
 
@@ -367,6 +413,7 @@ function runRegionTests() {
 // Run all tests
 try {
     runTests();
+    runSpecialCharacterTests();
     runRegionTests();
     console.log("\n✅ All tests passed!");
 } catch (error) {

server/routers/badger/verifySession.ts

@@ -25,6 +25,7 @@ import {
 } from "@server/db";
 import config from "@server/lib/config";
 import { isIpInCidr, stripPortFromHost } from "@server/lib/ip";
+import { isPathAllowed } from "@server/lib/pathMatch";
 import { response } from "@server/lib/response";
 import logger from "@server/logger";
 import HttpCode from "@server/types/HttpCode";
@@ -1090,143 +1091,7 @@ async function checkRules(
     return;
 }
 
-export function isPathAllowed(pattern: string, path: string): boolean {
+export { isPathAllowed };
-    logger.debug(`\nMatching path "${path}" against pattern "${pattern}"`);
-
-    // Normalize and split paths into segments
-    const normalize = (p: string) => p.split("/").filter(Boolean);
-    const patternParts = normalize(pattern);
-    const pathParts = normalize(path);
-
-    logger.debug(`Normalized pattern parts: [${patternParts.join(", ")}]`);
-    logger.debug(`Normalized path parts: [${pathParts.join(", ")}]`);
-
-    // Maximum recursion depth to prevent stack overflow and memory issues
-    const MAX_RECURSION_DEPTH = 100;
-
-    // Recursive function to try different wildcard matches
-    function matchSegments(
-        patternIndex: number,
-        pathIndex: number,
-        depth: number = 0
-    ): boolean {
-        // Check recursion depth limit
-        if (depth > MAX_RECURSION_DEPTH) {
-            logger.warn(
-                `Path matching exceeded maximum recursion depth (${MAX_RECURSION_DEPTH}) for pattern "${pattern}" and path "${path}"`
-            );
-            return false;
-        }
-
-        const indent = "  ".repeat(depth); // Indent based on recursion depth
-        const currentPatternPart = patternParts[patternIndex];
-        const currentPathPart = pathParts[pathIndex];
-
-        logger.debug(
-            `${indent}Checking patternIndex=${patternIndex} (${currentPatternPart || "END"}) vs pathIndex=${pathIndex} (${currentPathPart || "END"}) [depth=${depth}]`
-        );
-
-        // If we've consumed all pattern parts, we should have consumed all path parts
-        if (patternIndex >= patternParts.length) {
-            const result = pathIndex >= pathParts.length;
-            logger.debug(
-                `${indent}Reached end of pattern, remaining path: ${pathParts.slice(pathIndex).join("/")} -> ${result}`
-            );
-            return result;
-        }
-
-        // If we've consumed all path parts but still have pattern parts
-        if (pathIndex >= pathParts.length) {
-            // The only way this can match is if all remaining pattern parts are wildcards
-            const remainingPattern = patternParts.slice(patternIndex);
-            const result = remainingPattern.every((p) => p === "*");
-            logger.debug(
-                `${indent}Reached end of path, remaining pattern: ${remainingPattern.join("/")} -> ${result}`
-            );
-            return result;
-        }
-
-        // For full segment wildcards, try consuming different numbers of path segments
-        if (currentPatternPart === "*") {
-            logger.debug(
-                `${indent}Found wildcard at pattern index ${patternIndex}`
-            );
-
-            // Try consuming 0 segments (skip the wildcard)
-            logger.debug(
-                `${indent}Trying to skip wildcard (consume 0 segments)`
-            );
-            if (matchSegments(patternIndex + 1, pathIndex, depth + 1)) {
-                logger.debug(
-                    `${indent}Successfully matched by skipping wildcard`
-                );
-                return true;
-            }
-
-            // Try consuming current segment and recursively try rest
-            logger.debug(
-                `${indent}Trying to consume segment "${currentPathPart}" for wildcard`
-            );
-            if (matchSegments(patternIndex, pathIndex + 1, depth + 1)) {
-                logger.debug(
-                    `${indent}Successfully matched by consuming segment for wildcard`
-                );
-                return true;
-            }
-
-            logger.debug(`${indent}Failed to match wildcard`);
-            return false;
-        }
-
-        // Check for in-segment wildcard (e.g., "prefix*" or "prefix*suffix")
-        if (currentPatternPart.includes("*")) {
-            logger.debug(
-                `${indent}Found in-segment wildcard in "${currentPatternPart}"`
-            );
-
-            // Convert the pattern segment to a regex pattern
-            const regexPattern = currentPatternPart
-                .replace(/\*/g, ".*") // Replace * with .* for regex wildcard
-                .replace(/\?/g, "."); // Replace ? with . for single character wildcard if needed
-
-            const regex = new RegExp(`^${regexPattern}$`);
-
-            if (regex.test(currentPathPart)) {
-                logger.debug(
-                    `${indent}Segment with wildcard matches: "${currentPatternPart}" matches "${currentPathPart}"`
-                );
-                return matchSegments(
-                    patternIndex + 1,
-                    pathIndex + 1,
-                    depth + 1
-                );
-            }
-
-            logger.debug(
-                `${indent}Segment with wildcard mismatch: "${currentPatternPart}" doesn't match "${currentPathPart}"`
-            );
-            return false;
-        }
-
-        // For regular segments, they must match exactly
-        if (currentPatternPart !== currentPathPart) {
-            logger.debug(
-                `${indent}Segment mismatch: "${currentPatternPart}" != "${currentPathPart}"`
-            );
-            return false;
-        }
-
-        logger.debug(
-            `${indent}Segments match: "${currentPatternPart}" = "${currentPathPart}"`
-        );
-        // Move to next segments in both pattern and path
-        return matchSegments(patternIndex + 1, pathIndex + 1, depth + 1);
-    }
-
-    const result = matchSegments(0, 0, 0);
-    logger.debug(`Final result: ${result}`);
-    return result;
-}
 
 async function isIpInGeoIP(
     ipCountryCode: string | undefined,

server/routers/client/listUserDevices.ts

@@ -420,31 +420,6 @@ export async function listUserDevices(
             }
         );
 
-        // REMOVING THIS BECAUSE WE HAVE DIFFERENT TYPES OF CLIENTS NOW
-        // // Try to get the latest version, but don't block if it fails
-        // try {
-        //     const latestOlmVersion = await getLatestOlmVersion();
-
-        //     if (latestOlmVersion) {
-        //         olmsWithUpdates.forEach((client) => {
-        //             try {
-        //                 client.olmUpdateAvailable = semver.lt(
-        //                     client.olmVersion ? client.olmVersion : "",
-        //                     latestOlmVersion
-        //                 );
-        //             } catch (error) {
-        //                 client.olmUpdateAvailable = false;
-        //             }
-        //         });
-        //     }
-        // } catch (error) {
-        //     // Log the error but don't let it block the response
-        //     logger.warn(
-        //         "Failed to check for OLM updates, continuing without update info:",
-        //         error
-        //     );
-        // }
-
         return response<ListUserDevicesResponse>(res, {
             data: {
                 devices: olmsWithUpdates,

server/routers/client/targets.ts

@@ -1,4 +1,4 @@
-import { sendToClient } from "#dynamic/routers/ws";
+import { sendToClient, sendToClientsBatch } from "#dynamic/routers/ws";
 import { db, newts, olms } from "@server/db";
 import {
     Alias,
@@ -8,7 +8,7 @@ import {
 } from "@server/lib/ip";
 import { canCompress } from "@server/lib/clientVersionChecks";
 import logger from "@server/logger";
-import { eq } from "drizzle-orm";
+import { eq, inArray } from "drizzle-orm";
 import semver from "semver";
 
 const NEWT_V2_TARGETS_VERSION = ">=1.10.3";
@@ -59,6 +59,42 @@ export async function addTargets(
     );
 }
 
+export async function addTargetsBatch(
+    entries: {
+        newtId: string;
+        targets: SubnetProxyTarget[] | SubnetProxyTargetV2[];
+        version?: string | null;
+    }[]
+) {
+    if (entries.length === 0) {
+        return;
+    }
+
+    const resolved = await Promise.all(
+        entries.map(async (entry) => ({
+            ...entry,
+            targets: await convertTargetsIfNecessary(
+                entry.newtId,
+                entry.targets
+            )
+        }))
+    );
+
+    await sendToClientsBatch(
+        resolved.map((entry) => ({
+            clientId: entry.newtId,
+            message: {
+                type: `newt/wg/targets/add`,
+                data: entry.targets
+            },
+            options: {
+                incrementConfigVersion: true,
+                compress: canCompress(entry.version, "newt")
+            }
+        }))
+    );
+}
+
 export async function removeTargets(
     newtId: string,
     targets: SubnetProxyTarget[] | SubnetProxyTargetV2[],
@@ -76,6 +112,42 @@ export async function removeTargets(
     );
 }
 
+export async function removeTargetsBatch(
+    entries: {
+        newtId: string;
+        targets: SubnetProxyTarget[] | SubnetProxyTargetV2[];
+        version?: string | null;
+    }[]
+) {
+    if (entries.length === 0) {
+        return;
+    }
+
+    const resolved = await Promise.all(
+        entries.map(async (entry) => ({
+            ...entry,
+            targets: await convertTargetsIfNecessary(
+                entry.newtId,
+                entry.targets
+            )
+        }))
+    );
+
+    await sendToClientsBatch(
+        resolved.map((entry) => ({
+            clientId: entry.newtId,
+            message: {
+                type: `newt/wg/targets/remove`,
+                data: entry.targets
+            },
+            options: {
+                incrementConfigVersion: true,
+                compress: canCompress(entry.version, "newt")
+            }
+        }))
+    );
+}
+
 export async function updateTargets(
     newtId: string,
     targets: {
@@ -201,6 +273,171 @@ export async function removePeerData(
     });
 }
 
+const resolveOlmTargets = async (
+    entries: {
+        clientId: number;
+        olmId?: string;
+        version?: string | null;
+    }[]
+) => {
+    const unresolvedClientIds = entries
+        .filter((entry) => !entry.olmId)
+        .map((entry) => entry.clientId);
+
+    const olmMap = new Map<number, { olmId: string; version: string | null }>();
+
+    if (unresolvedClientIds.length > 0) {
+        const olmRows = await db
+            .select({
+                clientId: olms.clientId,
+                olmId: olms.olmId,
+                version: olms.version
+            })
+            .from(olms)
+            .where(inArray(olms.clientId, unresolvedClientIds));
+
+        for (const row of olmRows) {
+            if (row.clientId !== null) {
+                olmMap.set(row.clientId, {
+                    olmId: row.olmId,
+                    version: row.version
+                });
+            }
+        }
+    }
+
+    return entries
+        .map((entry) => {
+            if (entry.olmId) {
+                return {
+                    clientId: entry.clientId,
+                    olmId: entry.olmId,
+                    version: entry.version
+                };
+            }
+
+            const resolved = olmMap.get(entry.clientId);
+            if (!resolved) {
+                return null;
+            }
+
+            return {
+                clientId: entry.clientId,
+                olmId: resolved.olmId,
+                version: entry.version ?? resolved.version
+            };
+        })
+        .filter((entry) => entry !== null);
+};
+
+export async function addPeerDataBatch(
+    entries: {
+        clientId: number;
+        siteId: number;
+        remoteSubnets: string[];
+        aliases: Alias[];
+        olmId?: string;
+        version?: string | null;
+    }[]
+) {
+    if (entries.length === 0) {
+        return;
+    }
+
+    const resolvedTargets = await resolveOlmTargets(entries);
+
+    if (resolvedTargets.length === 0) {
+        return;
+    }
+
+    const payloads = entries
+        .map((entry) => {
+            const resolved = resolvedTargets.find(
+                (target) => target.clientId === entry.clientId
+            );
+            if (!resolved) {
+                return null;
+            }
+
+            return {
+                clientId: resolved.olmId,
+                message: {
+                    type: `olm/wg/peer/data/add`,
+                    data: {
+                        siteId: entry.siteId,
+                        remoteSubnets: entry.remoteSubnets,
+                        aliases: entry.aliases
+                    }
+                },
+                options: {
+                    incrementConfigVersion: true,
+                    compress: canCompress(resolved.version, "olm")
+                }
+            };
+        })
+        .filter((entry) => entry !== null);
+
+    if (payloads.length === 0) {
+        return;
+    }
+
+    await sendToClientsBatch(payloads);
+}
+
+export async function removePeerDataBatch(
+    entries: {
+        clientId: number;
+        siteId: number;
+        remoteSubnets: string[];
+        aliases: Alias[];
+        olmId?: string;
+        version?: string | null;
+    }[]
+) {
+    if (entries.length === 0) {
+        return;
+    }
+
+    const resolvedTargets = await resolveOlmTargets(entries);
+
+    if (resolvedTargets.length === 0) {
+        return;
+    }
+
+    const payloads = entries
+        .map((entry) => {
+            const resolved = resolvedTargets.find(
+                (target) => target.clientId === entry.clientId
+            );
+            if (!resolved) {
+                return null;
+            }
+
+            return {
+                clientId: resolved.olmId,
+                message: {
+                    type: `olm/wg/peer/data/remove`,
+                    data: {
+                        siteId: entry.siteId,
+                        remoteSubnets: entry.remoteSubnets,
+                        aliases: entry.aliases
+                    }
+                },
+                options: {
+                    incrementConfigVersion: true,
+                    compress: canCompress(resolved.version, "olm")
+                }
+            };
+        })
+        .filter((entry) => entry !== null);
+
+    if (payloads.length === 0) {
+        return;
+    }
+
+    await sendToClientsBatch(payloads);
+}
+
 export async function updatePeerData(
     clientId: number,
     siteId: number,

server/routers/integration.ts

@@ -17,7 +17,6 @@ import {
     verifyApiKey,
     verifyApiKeyOrgAccess,
     verifyApiKeyHasAction,
-    verifyApiKeyCanSetUserOrgRoles,
     verifyApiKeySiteAccess,
     verifyApiKeyResourceAccess,
     verifyApiKeyTargetAccess,
@@ -974,6 +973,13 @@ authenticated.get(
     idp.getIdp
 );
 
+authenticated.delete(
+    "/idp/:idpId",
+    verifyApiKeyIsRoot,
+    verifyApiKeyHasAction(ActionsEnum.deleteIdp),
+    idp.deleteIdp
+);
+
 authenticated.put(
     "/idp/:idpId/org/:orgId",
     verifyApiKeyIsRoot,

server/routers/newt/getNewtVersion.ts

@@ -10,7 +10,7 @@ import { verifyPassword } from "@server/auth/password";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import logger from "@server/logger";
-import cache from "#dynamic/lib/cache";
+import { regionalCache as cache } from "#dynamic/lib/cache";
 import config from "@server/lib/config";
 
 // Stale-while-revalidate in-memory fallback for the releases API.

server/routers/newt/handleNewtGetConfigMessage.ts

@@ -54,7 +54,7 @@ export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
         // TODO: somehow we should make sure a recent hole punch has happened if this occurs (hole punch could be from the last restart if done quickly)
     }
 
-    if (existingSite.lastHolePunch && now - existingSite.lastHolePunch > 5) {
+    if (existingSite.lastHolePunch && now - existingSite.lastHolePunch > 12) {
         logger.warn(
             `Site last hole punch is too old; skipping this register. The site is failing to hole punch and identify its network address with the server. Can the site reach the server on UDP port ${config.getRawConfig().gerbil.clients_start_port}?`
         );

server/routers/newt/handleSocketMessages.ts

@@ -2,7 +2,7 @@ import { MessageHandler } from "@server/routers/ws";
 import logger from "@server/logger";
 import { Newt } from "@server/db";
 import { applyNewtDockerBlueprint } from "@server/lib/blueprints/applyNewtDockerBlueprint";
-import cache from "#dynamic/lib/cache";
+import cache from "#dynamic/lib/cache"; // not using regional here because we dont know where the site is
 
 export const handleDockerStatusMessage: MessageHandler = async (context) => {
     const { message, client, sendToClient } = context;

server/routers/newt/peers.ts

@@ -1,7 +1,7 @@
 import { db, Site } from "@server/db";
 import { newts, sites } from "@server/db";
 import { eq } from "drizzle-orm";
-import { sendToClient } from "#dynamic/routers/ws";
+import { sendToClient, sendToClientsBatch } from "#dynamic/routers/ws";
 import logger from "@server/logger";
 
 export async function addPeer(
@@ -36,10 +36,14 @@ export async function addPeer(
         newtId = newt.newtId;
     }
 
-    await sendToClient(newtId, {
+    await sendToClient(
-        type: "newt/wg/peer/add",
+        newtId,
-        data: peer
+        {
-    }, { incrementConfigVersion: true }).catch((error) => {
+            type: "newt/wg/peer/add",
+            data: peer
+        },
+        { incrementConfigVersion: true }
+    ).catch((error) => {
         logger.warn(`Error sending message:`, error);
     });
 
@@ -76,12 +80,16 @@ export async function deletePeer(
         newtId = newt.newtId;
     }
 
-    await sendToClient(newtId, {
+    await sendToClient(
-        type: "newt/wg/peer/remove",
+        newtId,
-        data: {
+        {
-            publicKey
+            type: "newt/wg/peer/remove",
-        }
+            data: {
-    }, { incrementConfigVersion: true }).catch((error) => {
+                publicKey
+            }
+        },
+        { incrementConfigVersion: true }
+    ).catch((error) => {
         logger.warn(`Error sending message:`, error);
     });
 
@@ -90,6 +98,35 @@ export async function deletePeer(
     return site;
 }
 
+export async function deletePeersBatch(
+    peers: {
+        siteId: number;
+        publicKey: string;
+        newtId: string;
+    }[]
+) {
+    if (peers.length === 0) {
+        return;
+    }
+
+    await sendToClientsBatch(
+        peers.map((peer) => ({
+            clientId: peer.newtId,
+            message: {
+                type: "newt/wg/peer/remove",
+                data: {
+                    publicKey: peer.publicKey
+                }
+            },
+            options: { incrementConfigVersion: true }
+        }))
+    ).catch((error) => {
+        logger.warn(`Error sending batched newt peer removals:`, error);
+    });
+
+    logger.info(`Deleted ${peers.length} peer(s) from newts (batch)`);
+}
+
 export async function updatePeer(
     siteId: number,
     publicKey: string,
@@ -122,13 +159,17 @@ export async function updatePeer(
         newtId = newt.newtId;
     }
 
-    await sendToClient(newtId, {
+    await sendToClient(
-        type: "newt/wg/peer/update",
+        newtId,
-        data: {
+        {
-            publicKey,
+            type: "newt/wg/peer/update",
-            ...peer
+            data: {
-        }
+                publicKey,
-    }, { incrementConfigVersion: true }).catch((error) => {
+                ...peer
+            }
+        },
+        { incrementConfigVersion: true }
+    ).catch((error) => {
         logger.warn(`Error sending message:`, error);
     });
 

server/routers/olm/handleOlmRegisterMessage.ts

@@ -20,7 +20,7 @@ import { handleFingerprintInsertion } from "./fingerprintingUtils";
 import { build } from "@server/build";
 import { canCompress } from "@server/lib/clientVersionChecks";
 import config from "@server/lib/config";
-import cache from "#dynamic/lib/cache";
+import cache from "#dynamic/lib/cache"; // not using regional here because we need this in the register message handler before we know where the client is
 
 const HOLEPUNCH_STALE_CHAIN_THRESHOLD = 18;
 const HOLEPUNCH_STALE_CHAIN_TTL_SECONDS = 1800;
@@ -348,7 +348,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
     // this prevents us from accepting a register from an olm that has not hole punched yet.
     // the olm will pump the register so we can keep checking
     // TODO: I still think there is a better way to do this rather than locking it out here but ???
-    if (now - (client.lastHolePunch || 0) > 5 && sitesCount > 0) {
+    if (now - (client.lastHolePunch || 0) > 12 && sitesCount > 0) {
         logger.warn(
             `[handleOlmRegisterMessage] Client last hole punch is too old and we have sites to send; skipping this register. The client is failing to hole punch and identify its network address with the server. Can the client reach the server on UDP port ${config.getRawConfig().gerbil.clients_start_port}?`,
             { orgId: client.orgId, clientId: client.clientId }

server/routers/olm/peers.ts

@@ -1,9 +1,9 @@
-import { sendToClient } from "#dynamic/routers/ws";
+import { sendToClient, sendToClientsBatch } from "#dynamic/routers/ws";
 import { clientSitesAssociationsCache, db, olms } from "@server/db";
 import { canCompress } from "@server/lib/clientVersionChecks";
 import config from "@server/lib/config";
 import logger from "@server/logger";
-import { and, eq } from "drizzle-orm";
+import { and, eq, inArray } from "drizzle-orm";
 import { Alias } from "yaml";
 
 export async function addPeer(
@@ -205,3 +205,150 @@ export async function initPeerAddHandshake(
         `Initiated peer add handshake for site ${peer.siteId} to olm ${olmId}`
     );
 }
+
+export async function deletePeersBatch(
+    peers: {
+        clientId: number;
+        siteId: number;
+        publicKey: string;
+        olmId?: string;
+        version?: string | null;
+    }[]
+) {
+    if (peers.length === 0) {
+        return;
+    }
+
+    const unresolvedClientIds = peers
+        .filter((peer) => !peer.olmId)
+        .map((peer) => peer.clientId);
+
+    const olmByClientId = new Map<
+        number,
+        { olmId: string; version: string | null }
+    >();
+
+    if (unresolvedClientIds.length > 0) {
+        const olmRows = await db
+            .select({
+                clientId: olms.clientId,
+                olmId: olms.olmId,
+                version: olms.version
+            })
+            .from(olms)
+            .where(inArray(olms.clientId, unresolvedClientIds));
+
+        for (const row of olmRows) {
+            if (row.clientId !== null) {
+                olmByClientId.set(row.clientId, {
+                    olmId: row.olmId,
+                    version: row.version
+                });
+            }
+        }
+    }
+
+    const batchPayloads = peers
+        .map((peer) => {
+            const resolved = peer.olmId
+                ? { olmId: peer.olmId, version: peer.version ?? null }
+                : olmByClientId.get(peer.clientId);
+            if (!resolved) {
+                return null;
+            }
+
+            return {
+                clientId: resolved.olmId,
+                message: {
+                    type: "olm/wg/peer/remove",
+                    data: {
+                        publicKey: peer.publicKey,
+                        siteId: peer.siteId
+                    }
+                },
+                options: {
+                    incrementConfigVersion: true,
+                    compress: canCompress(
+                        peer.version ?? resolved.version,
+                        "olm"
+                    )
+                }
+            };
+        })
+        .filter((payload) => payload !== null);
+
+    if (batchPayloads.length === 0) {
+        return;
+    }
+
+    await sendToClientsBatch(batchPayloads).catch((error) => {
+        logger.warn(`Error sending batched olm peer removals:`, error);
+    });
+
+    logger.info(`Deleted ${batchPayloads.length} peer(s) from olms (batch)`);
+}
+
+export async function initPeerAddHandshakeBatch(
+    handshakes: {
+        clientId: number;
+        peer: {
+            siteId: number;
+            exitNode: {
+                publicKey: string;
+                endpoint: string;
+            };
+        };
+        olmId: string;
+        chainId?: string;
+    }[]
+) {
+    if (handshakes.length === 0) {
+        return;
+    }
+
+    await sendToClientsBatch(
+        handshakes.map((item) => ({
+            clientId: item.olmId,
+            message: {
+                type: "olm/wg/peer/holepunch/site/add",
+                data: {
+                    siteId: item.peer.siteId,
+                    exitNode: {
+                        publicKey: item.peer.exitNode.publicKey,
+                        relayPort:
+                            config.getRawConfig().gerbil.clients_start_port,
+                        endpoint: item.peer.exitNode.endpoint
+                    },
+                    chainId: item.chainId
+                }
+            },
+            options: { incrementConfigVersion: true }
+        }))
+    ).catch((error) => {
+        logger.warn(`Error sending batched olm handshakes:`, error);
+    });
+
+    await Promise.all(
+        handshakes.map((item) =>
+            db
+                .update(clientSitesAssociationsCache)
+                .set({ isJitMode: false })
+                .where(
+                    and(
+                        eq(
+                            clientSitesAssociationsCache.clientId,
+                            item.clientId
+                        ),
+                        eq(
+                            clientSitesAssociationsCache.siteId,
+                            item.peer.siteId
+                        )
+                    )
+                )
+        )
+    );
+
+    logger.info(
+        `Initiated ${handshakes.length} peer add handshake(s) to olms (batch)`
+    );
+}

server/routers/resource/getResource.ts

@@ -9,6 +9,7 @@ import { NextFunction, Request, Response } from "express";
 import createHttpError from "http-errors";
 import { z } from "zod";
 import { fromError } from "zod-validation-error";
+import { applyInlinePolicyFields } from "./inlinePolicyFields";
 
 const getResourceSchema = z.strictObject({
     resourceId: z
@@ -151,13 +152,7 @@ export async function getResource(
             const policy = await queryInlinePolicy(
                 resource.defaultResourcePolicyId!
             );
-            returnData = {
+            returnData = applyInlinePolicyFields(returnData, policy);
-                ...returnData,
-                sso: policy?.sso || null,
-                emailWhitelistEnabled: policy?.emailWhitelistEnabled || null,
-                applyRules: policy?.applyRules || null,
-                skipToIdpId: policy?.idpId || null
-            };
         }
 
         return response<GetResourceResponse>(res, {

server/routers/resource/inlinePolicyFields.test.ts

@@ -0,0 +1,74 @@
+import { assertEquals } from "../../../test/assert";
+import { applyInlinePolicyFields } from "./inlinePolicyFields";
+
+function runTests() {
+    const resource = {
+        resourceId: 1,
+        name: "dashboard",
+        sso: null,
+        emailWhitelistEnabled: null,
+        applyRules: null,
+        skipToIdpId: null
+    } as any;
+
+    const enabledPolicy = {
+        sso: true,
+        emailWhitelistEnabled: true,
+        applyRules: true,
+        idpId: 42
+    };
+
+    const enabledResult = applyInlinePolicyFields(resource, enabledPolicy);
+    assertEquals(enabledResult.sso, true, "sso should mirror policy true");
+    assertEquals(
+        enabledResult.emailWhitelistEnabled,
+        true,
+        "email whitelist should mirror policy true"
+    );
+    assertEquals(
+        enabledResult.applyRules,
+        true,
+        "applyRules should mirror policy true"
+    );
+    assertEquals(
+        enabledResult.skipToIdpId,
+        42,
+        "skipToIdpId should use policy idpId"
+    );
+
+    const disabledPolicy = {
+        sso: false,
+        emailWhitelistEnabled: false,
+        applyRules: false,
+        idpId: null
+    };
+
+    const disabledResult = applyInlinePolicyFields(resource, disabledPolicy);
+    assertEquals(disabledResult.sso, false, "sso false must not become null");
+    assertEquals(
+        disabledResult.emailWhitelistEnabled,
+        false,
+        "email whitelist false must not become null"
+    );
+    assertEquals(
+        disabledResult.applyRules,
+        false,
+        "applyRules false must not become null"
+    );
+    assertEquals(
+        disabledResult.skipToIdpId,
+        null,
+        "missing idp should stay null"
+    );
+
+    const missingPolicyResult = applyInlinePolicyFields(resource, null);
+    assertEquals(
+        missingPolicyResult.sso,
+        null,
+        "missing policy should return nullable resource fields"
+    );
+
+    console.log("PASS: inline policy fields mirror policy values");
+}
+
+runTests();

server/routers/resource/inlinePolicyFields.ts

@@ -0,0 +1,19 @@
+import type { Resource, ResourcePolicy } from "@server/db";
+
+type InlinePolicyFields = Pick<
+    ResourcePolicy,
+    "sso" | "emailWhitelistEnabled" | "applyRules" | "idpId"
+>;
+
+export function applyInlinePolicyFields<T extends Resource>(
+    resource: T,
+    policy: InlinePolicyFields | null | undefined
+): T {
+    return {
+        ...resource,
+        sso: policy?.sso ?? null,
+        emailWhitelistEnabled: policy?.emailWhitelistEnabled ?? null,
+        applyRules: policy?.applyRules ?? null,
+        skipToIdpId: policy?.idpId ?? null
+    };
+}

server/routers/resource/listUserResourceAliases.ts

@@ -15,8 +15,7 @@ import logger from "@server/logger";
 import { z } from "zod";
 import { fromZodError } from "zod-validation-error";
 import type { PaginatedResponse } from "@server/types/Pagination";
-import { OpenAPITags, registry } from "@server/openApi";
+import { regionalCache as cache } from "#dynamic/lib/cache";
-import { localCache } from "#dynamic/lib/cache";
 
 const USER_RESOURCE_ALIASES_CACHE_TTL_SEC = 60;
 
@@ -153,7 +152,7 @@ export async function listUserResourceAliases(
             pageSize
         );
         const cachedData: ListUserResourceAliasesResponse | undefined =
-            localCache.get(cacheKey);
+            await cache.get(cacheKey);
 
         if (cachedData) {
             return response<ListUserResourceAliasesResponse>(res, {
@@ -211,7 +210,11 @@ export async function listUserResourceAliases(
                     page
                 }
             };
-            localCache.set(cacheKey, data, USER_RESOURCE_ALIASES_CACHE_TTL_SEC);
+            await cache.set(
+                cacheKey,
+                data,
+                USER_RESOURCE_ALIASES_CACHE_TTL_SEC
+            );
             return response<ListUserResourceAliasesResponse>(res, {
                 data,
                 success: true,
@@ -256,7 +259,7 @@ export async function listUserResourceAliases(
                 page
             }
         };
-        localCache.set(cacheKey, data, USER_RESOURCE_ALIASES_CACHE_TTL_SEC);
+        await cache.set(cacheKey, data, USER_RESOURCE_ALIASES_CACHE_TTL_SEC);
 
         return response<ListUserResourceAliasesResponse>(res, {
             data,

server/routers/resource/updateResource.ts

@@ -47,6 +47,7 @@ import { build } from "@server/build";
 import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import { isSubscribed } from "#dynamic/lib/isSubscribed";
+import { applyInlinePolicyFields } from "./inlinePolicyFields";
 
 const updateResourceParamsSchema = z.strictObject({
     resourceId: z.coerce.number().int().positive()
@@ -682,6 +683,12 @@ async function updateHttpResource(
                 .where(eq(resourcePolicies.resourcePolicyId, policyId));
         }
 
+        const [inlinePolicy] = await db
+            .select()
+            .from(resourcePolicies)
+            .where(eq(resourcePolicies.resourcePolicyId, policyId))
+            .limit(1);
+
         const updatedResource = await db
             .update(resources)
             .set({ ...resourceOnlyData, headers })
@@ -698,7 +705,7 @@ async function updateHttpResource(
         }
 
         return response(res, {
-            data: updatedResource[0],
+            data: applyInlinePolicyFields(updatedResource[0], inlinePolicy),
             success: true,
             error: false,
             message: "HTTP resource updated successfully",

server/routers/resource/updateResourceRule.ts

@@ -1,8 +1,8 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db } from "@server/db";
-import { resourceRules, resources } from "@server/db";
+import { resourcePolicyRules, resourceRules, resources } from "@server/db";
-import { eq } from "drizzle-orm";
+import { and, eq } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
@@ -22,13 +22,20 @@ const updateResourceRuleParamsSchema = z.strictObject({
     resourceId: z.coerce.number().int().positive()
 });
 
+const resourceRuleMatchSchema = z.enum([
+    "CIDR",
+    "IP",
+    "PATH",
+    "COUNTRY",
+    "ASN",
+    "REGION"
+]);
+
 // Define Zod schema for request body validation
 const updateResourceRuleSchema = z
     .strictObject({
         action: z.enum(["ACCEPT", "DROP", "PASS"]).optional(),
-        match: z
+        match: resourceRuleMatchSchema.optional(),
-            .enum(["CIDR", "IP", "PATH", "COUNTRY", "ASN", "REGION"])
-            .optional(),
         value: z.string().min(1).optional(),
         priority: z.int(),
         enabled: z.boolean().optional()
@@ -123,37 +130,102 @@ export async function updateResourceRule(
             return next(
                 createHttpError(
                     HttpCode.BAD_REQUEST,
-                    "Cannot create rule for non-http resource"
+                    "Cannot update rule for non-http resource"
                 )
             );
         }
 
-        // Verify that the rule exists and belongs to the specified resource
+        const isInlinePolicy =
-        const [existingRule] = await db
+            resource.resourcePolicyId === null &&
-            .select()
+            resource.defaultResourcePolicyId !== null;
-            .from(resourceRules)
-            .where(eq(resourceRules.ruleId, ruleId))
-            .limit(1);
 
-        if (!existingRule) {
+        let existingMatch:
-            return next(
+            | "CIDR"
-                createHttpError(
+            | "IP"
-                    HttpCode.NOT_FOUND,
+            | "PATH"
-                    `Resource rule with ID ${ruleId} not found`
+            | "COUNTRY"
-                )
+            | "ASN"
+            | "REGION";
+
+        if (isInlinePolicy) {
+            const policyId = resource.defaultResourcePolicyId!;
+            const [existingRule] = await db
+                .select()
+                .from(resourcePolicyRules)
+                .where(eq(resourcePolicyRules.ruleId, ruleId))
+                .limit(1);
+
+            if (!existingRule) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        `Resource rule with ID ${ruleId} not found`
+                    )
+                );
+            }
+
+            if (existingRule.resourcePolicyId !== policyId) {
+                return next(
+                    createHttpError(
+                        HttpCode.FORBIDDEN,
+                        `Resource rule ${ruleId} does not belong to resource ${resourceId}`
+                    )
+                );
+            }
+
+            const parsedExistingMatch = resourceRuleMatchSchema.safeParse(
+                existingRule.match
             );
+            if (!parsedExistingMatch.success) {
+                return next(
+                    createHttpError(
+                        HttpCode.INTERNAL_SERVER_ERROR,
+                        "Resource rule has invalid match type"
+                    )
+                );
+            }
+            existingMatch = parsedExistingMatch.data;
+        } else {
+            // Verify that the rule exists and belongs to the specified resource
+            const [existingRule] = await db
+                .select()
+                .from(resourceRules)
+                .where(eq(resourceRules.ruleId, ruleId))
+                .limit(1);
+
+            if (!existingRule) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        `Resource rule with ID ${ruleId} not found`
+                    )
+                );
+            }
+
+            if (existingRule.resourceId !== resourceId) {
+                return next(
+                    createHttpError(
+                        HttpCode.FORBIDDEN,
+                        `Resource rule ${ruleId} does not belong to resource ${resourceId}`
+                    )
+                );
+            }
+
+            const parsedExistingMatch = resourceRuleMatchSchema.safeParse(
+                existingRule.match
+            );
+            if (!parsedExistingMatch.success) {
+                return next(
+                    createHttpError(
+                        HttpCode.INTERNAL_SERVER_ERROR,
+                        "Resource rule has invalid match type"
+                    )
+                );
+            }
+            existingMatch = parsedExistingMatch.data;
         }
 
-        if (existingRule.resourceId !== resourceId) {
+        const match = updateData.match || existingMatch;
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    `Resource rule ${ruleId} does not belong to resource ${resourceId}`
-                )
-            );
-        }
-
-        const match = updateData.match || existingRule.match;
         const { value } = updateData;
 
         if (value !== undefined) {
@@ -197,11 +269,30 @@ export async function updateResourceRule(
         }
 
         // Update the rule
-        const [updatedRule] = await db
+        const [updatedRule] = isInlinePolicy
-            .update(resourceRules)
+            ? await db
-            .set(updateData)
+                  .update(resourcePolicyRules)
-            .where(eq(resourceRules.ruleId, ruleId))
+                  .set(updateData)
-            .returning();
+                  .where(
+                      and(
+                          eq(resourcePolicyRules.ruleId, ruleId),
+                          eq(
+                              resourcePolicyRules.resourcePolicyId,
+                              resource.defaultResourcePolicyId!
+                          )
+                      )
+                  )
+                  .returning()
+            : await db
+                  .update(resourceRules)
+                  .set(updateData)
+                  .where(
+                      and(
+                          eq(resourceRules.ruleId, ruleId),
+                          eq(resourceRules.resourceId, resourceId)
+                      )
+                  )
+                  .returning();
 
         return response(res, {
             data: updatedRule,

server/routers/serverInfo/getServerInfo.ts

@@ -3,7 +3,6 @@ import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { response as sendResponse } from "@server/lib/response";
-import config from "@server/lib/config";
 import { build } from "@server/build";
 import { APP_VERSION } from "@server/lib/consts";
 import license from "#dynamic/license/license";
@@ -22,9 +21,6 @@ export async function getServerInfo(
     next: NextFunction
 ): Promise<any> {
     try {
-        const supporterData = config.getSupporterData();
-        const supporterStatusValid = supporterData?.valid || false;
-
         let enterpriseLicenseValid = false;
         let enterpriseLicenseType: string | null = null;
 
@@ -41,7 +37,7 @@ export async function getServerInfo(
         return sendResponse<GetServerInfoResponse>(res, {
             data: {
                 version: APP_VERSION,
-                supporterStatusValid,
+                supporterStatusValid: true,
                 build,
                 enterpriseLicenseValid,
                 enterpriseLicenseType

server/routers/site/listSites.ts

@@ -1,20 +1,21 @@
 import {
     db,
     exitNodes,
+    labels,
     newts,
     orgs,
     remoteExitNodes,
     roleSites,
+    siteLabels,
     siteNetworks,
     siteResources,
-    targets,
     sites,
+    targets,
     userSites,
-    labels,
-    siteLabels,
     type Label
 } from "@server/db";
-import cache from "#dynamic/lib/cache";
+import { regionalCache as cache } from "#dynamic/lib/cache";
+import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import { OpenAPITags, registry } from "@server/openApi";
@@ -23,102 +24,9 @@ import type { PaginatedResponse } from "@server/types/Pagination";
 import { and, asc, desc, eq, inArray, like, or, sql } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
 import createHttpError from "http-errors";
-import semver from "semver";
 import { z } from "zod";
 import { fromError } from "zod-validation-error";
 import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
-import { tierMatrix } from "@server/lib/billing/tierMatrix";
-
-// Stale-while-revalidate: keeps the last successfully fetched version so that
-// a transient network failure / timeout does not flip every site back to
-// newtUpdateAvailable: false.
-let staleNewtVersion: string | null = null;
-
-async function getLatestNewtVersion(): Promise<string | null> {
-    try {
-        const cachedVersion = await cache.get<string>(
-            "cache:latestNewtVersion"
-        );
-        if (cachedVersion) {
-            return cachedVersion;
-        }
-
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), 1500);
-
-        const response = await fetch(
-            "https://api.github.com/repos/fosrl/newt/tags",
-            {
-                signal: controller.signal
-            }
-        );
-
-        clearTimeout(timeoutId);
-
-        if (!response.ok) {
-            logger.warn(
-                `Failed to fetch latest Newt version from GitHub: ${response.status} ${response.statusText}`
-            );
-            return staleNewtVersion;
-        }
-
-        let tags = await response.json();
-        if (!Array.isArray(tags) || tags.length === 0) {
-            logger.warn("No tags found for Newt repository");
-            return staleNewtVersion;
-        }
-
-        // Remove release-candidates, then sort descending by semver so that
-        // duplicate tags (e.g. "1.10.3" and "v1.10.3") and any ordering quirks
-        // from the GitHub API do not cause an older tag to be selected.
-        tags = tags.filter((tag: any) => !tag.name.includes("rc"));
-        tags.sort((a: any, b: any) => {
-            const va = semver.coerce(a.name);
-            const vb = semver.coerce(b.name);
-            if (!va && !vb) return 0;
-            if (!va) return 1;
-            if (!vb) return -1;
-            return semver.rcompare(va, vb);
-        });
-
-        // Deduplicate: keep only the first (highest) entry per normalised version
-        const seen = new Set<string>();
-        tags = tags.filter((tag: any) => {
-            const normalised = semver.coerce(tag.name)?.version;
-            if (!normalised || seen.has(normalised)) return false;
-            seen.add(normalised);
-            return true;
-        });
-
-        if (tags.length === 0) {
-            logger.warn("No valid semver tags found for Newt repository");
-            return staleNewtVersion;
-        }
-
-        const latestVersion = tags[0].name;
-
-        staleNewtVersion = latestVersion;
-        await cache.set("cache:latestNewtVersion", latestVersion, 3600);
-
-        return latestVersion;
-    } catch (error: any) {
-        if (error.name === "AbortError") {
-            logger.warn(
-                "Request to fetch latest Newt version timed out (1.5s)"
-            );
-        } else if (error.cause?.code === "UND_ERR_CONNECT_TIMEOUT") {
-            logger.warn(
-                "Connection timeout while fetching latest Newt version"
-            );
-        } else {
-            logger.warn(
-                "Error fetching latest Newt version:",
-                error.message || error
-            );
-        }
-        return staleNewtVersion;
-    }
-}
 
 const listSitesParamsSchema = z.strictObject({
     orgId: z.string()
@@ -449,9 +357,6 @@ export async function listSites(
 
         const totalCount = Number(countRows[0]?.count ?? 0);
 
-        // Get latest version asynchronously without blocking the response
-        const latestNewtVersionPromise = getLatestNewtVersion();
-
         const siteIds = rows.map((site) => site.siteId);
 
         let labelsForSites: Array<{
@@ -494,36 +399,6 @@ export async function listSites(
             return { ...siteWithUpdate, labels: labelsForSite };
         });
 
-        // Try to get the latest version, but don't block if it fails
-        try {
-            const latestNewtVersion = await latestNewtVersionPromise;
-
-            if (latestNewtVersion) {
-                sitesWithUpdates.forEach((site) => {
-                    if (
-                        site.type === "newt" &&
-                        site.newtVersion &&
-                        latestNewtVersion
-                    ) {
-                        try {
-                            site.newtUpdateAvailable = semver.lt(
-                                site.newtVersion,
-                                latestNewtVersion
-                            );
-                        } catch (error) {
-                            site.newtUpdateAvailable = false;
-                        }
-                    }
-                });
-            }
-        } catch (error) {
-            // Log the error but don't let it block the response
-            logger.warn(
-                "Failed to check for Newt updates, continuing without update info:",
-                error
-            );
-        }
-
         const sitesPayload = sitesWithUpdates.map((site) =>
             site.type === "local" ? { ...site, online: undefined } : site
         );

server/routers/siteResource/updateSiteResource.ts

@@ -28,7 +28,10 @@ import {
     isIpInCidr,
     portRangeStringSchema
 } from "@server/lib/ip";
-import { rebuildClientAssociationsFromSiteResource } from "@server/lib/rebuildClientAssociations";
+import {
+    getClientSiteResourceAccess,
+    rebuildClientAssociationsFromSiteResource
+} from "@server/lib/rebuildClientAssociations";
 import logger from "@server/logger";
 import HttpCode from "@server/types/HttpCode";
 import { NextFunction, Request, Response } from "express";
@@ -846,9 +849,14 @@ export async function handleMessagingForUpdatedSiteResource(
         updatedSiteResource
     );
 
-    const { mergedAllClients } =
+    await rebuildClientAssociationsFromSiteResource(
-        await rebuildClientAssociationsFromSiteResource(
+        existingSiteResource || updatedSiteResource, // we want to rebuild based on the existing resource then we will apply the change to the destination below
-            existingSiteResource || updatedSiteResource, // we want to rebuild based on the existing resource then we will apply the change to the destination below
+        trx
+    );
+
+    const { sitesList, mergedAllClients, mergedAllClientIds } =
+        await getClientSiteResourceAccess(
+            existingSiteResource || updatedSiteResource,
             trx
         );
 

server/routers/traefik/traefikConfigProvider.ts

@@ -17,13 +17,18 @@ export async function traefikConfigProvider(
         // Get the current exit node name from config
         const currentExitNodeId = await getCurrentExitNodeId();
 
+        const maintenancePort = config.getRawConfig().server.next_port;
+        const maintenanceHost = config.getRawConfig().server.internal_hostname;
+        const pangolinUIUrl = `http://${maintenanceHost}:${maintenancePort}`;
+
         const traefikConfig = await getTraefikConfig(
             currentExitNodeId,
             config.getRawConfig().traefik.site_types,
             build == "oss", // filter out the namespace domains in open source
             build != "oss", // generate the login pages on the cloud and and enterprise,
             config.getRawConfig().traefik.allow_raw_resources,
-            build != "oss" // generate browser gateway resources on cloud and enterprise
+            pangolinUIUrl,
+            pangolinUIUrl
         );
 
         if (traefikConfig?.http?.middlewares) {

server/routers/ws/types.ts

@@ -76,12 +76,32 @@ export interface SendMessageOptions {
     compress?: boolean;
 }
 
-// Redis message type for cross-node communication
+export interface BatchSendMessage {
-export interface RedisMessage {
+    clientId: string;
-    type: "direct" | "broadcast";
-    targetClientId?: string;
-    excludeClientId?: string;
     message: WSMessage;
-    fromNodeId: string;
     options?: SendMessageOptions;
 }
+
+// Redis message types for cross-node communication
+export type RedisMessage =
+    | {
+          type: "direct";
+          targetClientId: string;
+          message: WSMessage;
+          fromNodeId: string;
+      }
+    | {
+          type: "direct-batch";
+          messages: {
+              targetClientId: string;
+              message: WSMessage;
+          }[];
+          fromNodeId: string;
+      }
+    | {
+          type: "broadcast";
+          excludeClientId?: string;
+          message: WSMessage;
+          fromNodeId: string;
+          options?: SendMessageOptions;
+      };

server/routers/ws/ws.ts

@@ -26,7 +26,8 @@ import {
     WebSocketRequest,
     WSMessage,
     AuthenticatedWebSocket,
-    SendMessageOptions
+    SendMessageOptions,
+    BatchSendMessage
 } from "./types";
 import { validateSessionToken } from "@server/auth/sessions/app";
 
@@ -212,6 +213,20 @@ const sendToClient = async (
     return localSent;
 };
 
+const sendToClientsBatch = async (
+    entries: BatchSendMessage[]
+): Promise<void> => {
+    if (entries.length === 0) {
+        return;
+    }
+
+    await Promise.all(
+        entries.map((entry) =>
+            sendToClient(entry.clientId, entry.message, entry.options)
+        )
+    );
+};
+
 const broadcastToAllExcept = async (
     message: WSMessage,
     excludeClientId?: string,
@@ -552,6 +567,7 @@ export {
     router,
     handleWSUpgrade,
     sendToClient,
+    sendToClientsBatch,
     broadcastToAllExcept,
     connectedClients,
     hasActiveConnections,

src/app/[orgId]/settings/clients/user/[niceId]/general/page.tsx

@@ -41,6 +41,13 @@ import { useParams } from "next/navigation";
 import { FaApple, FaWindows, FaLinux } from "react-icons/fa";
 import { SiAndroid } from "react-icons/si";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
+import {
+    productUpdatesQueries,
+    type LatestVersionResponse
+} from "@app/lib/queries";
+import { useQuery } from "@tanstack/react-query";
+import semver from "semver";
+import { InfoPopup } from "@app/components/ui/info-popup";
 
 function formatTimestamp(timestamp: number | null | undefined): string {
     if (!timestamp) return "-";
@@ -166,6 +173,34 @@ export default function GeneralPage() {
     }>(null);
     const [isCheckingCache, setIsCheckingCache] = useState(false);
     const [isRebuildingCache, setIsRebuildingCache] = useState(false);
+    const data = useQuery(productUpdatesQueries.latestVersion(true));
+    const latestPlatformVersions = data.data?.data;
+
+    const agentVersionMap: Record<string, string> = {
+        "Pangolin Windows": "windows",
+        "Pangolin Android": "android",
+        "Pangolin iOS": "ios",
+        "Pangolin iPadOS": "ios",
+        "Pangolin macOS": "mac",
+        "Pangolin CLI": "cli",
+        "Olm CLI": "olm"
+    };
+
+    let updateAvailable = false;
+    if (client.agent && client.olmVersion && latestPlatformVersions) {
+        const agent = agentVersionMap[
+            client.agent
+        ] as keyof LatestVersionResponse;
+
+        if (agent in latestPlatformVersions) {
+            const agentVersion = latestPlatformVersions[agent];
+
+            updateAvailable = semver.lt(
+                client.olmVersion,
+                agentVersion.latestVersion
+            );
+        }
+    }
 
     // get "imp" from local storage to determine if we should show the verify button (imp = "1" means show)
     const showVerifyButton =
@@ -451,11 +486,21 @@ export default function GeneralPage() {
                                         {t("agent")}
                                     </InfoSectionTitle>
                                     <InfoSectionContent>
-                                        <Badge variant="secondary">
+                                        <div className="flex items-center">
-                                            {client.agent +
+                                            <Badge variant="secondary">
-                                                " v" +
+                                                {client.agent +
-                                                client.olmVersion}
+                                                    " v" +
-                                        </Badge>
+                                                    client.olmVersion}
+                                            </Badge>
+
+                                            {updateAvailable && (
+                                                <InfoPopup
+                                                    info={t(
+                                                        "updateAvailableInfo"
+                                                    )}
+                                                />
+                                            )}
+                                        </div>
                                     </InfoSectionContent>
                                 </InfoSection>
                             </div>

src/app/[orgId]/settings/logs/request/page.tsx

@@ -18,7 +18,6 @@ import Link from "next/link";
 import { useParams, useRouter, useSearchParams } from "next/navigation";
 import { useMemo, useState, useTransition } from "react";
 import { useStoredPageSize } from "@app/hooks/useStoredPageSize";
-import { build } from "@server/build";
 import type { QueryRequestAuditLogResponse } from "@server/routers/auditLogs/types";
 import { ColumnFilterButton } from "@app/components/ColumnFilterButton";
 
@@ -122,8 +121,7 @@ export default function GeneralPage() {
         ...logQueries.requests({
             orgId: orgId as string,
             filters: queryFilters
-        }),
+        })
-        enabled: build !== "oss"
     });
 
     const rows = isLoading ? generateSampleRequestLogs() : (data?.log ?? []);

src/app/admin/license/page.tsx

@@ -42,7 +42,14 @@ import {
     SettingsSectionFooter
 } from "@app/components/Settings";
 import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
-import { ArrowRight, Check, ExternalLink, Heart, InfoIcon, TicketCheck } from "lucide-react";
+import {
+    ArrowRight,
+    Check,
+    ExternalLink,
+    Heart,
+    InfoIcon,
+    TicketCheck
+} from "lucide-react";
 import Link from "next/link";
 import DismissableBanner from "@app/components/DismissableBanner";
 import CopyTextBox from "@app/components/CopyTextBox";
@@ -50,7 +57,7 @@ import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
 import { SitePriceCalculator } from "@app/components/SitePriceCalculator";
 import { Checkbox } from "@app/components/ui/checkbox";
 import { Alert, AlertDescription, AlertTitle } from "@app/components/ui/alert";
-import { useSupporterStatusContext } from "@app/hooks/useSupporterStatusContext";
+// import { useSupporterStatusContext } from "@app/hooks/useSupporterStatusContext";
 import { useTranslations } from "next-intl";
 
 const ENTERPRISE_DOCS_URL =
@@ -82,7 +89,7 @@ export default function LicensePage() {
     const [isActivatingLicense, setIsActivatingLicense] = useState(false);
     const [isDeletingLicense, setIsDeletingLicense] = useState(false);
     const [isRecheckingLicense, setIsRecheckingLicense] = useState(false);
-    const { supporterStatus } = useSupporterStatusContext();
+    // const { supporterStatus } = useSupporterStatusContext();
 
     const t = useTranslations();
 
@@ -347,9 +354,7 @@ export default function LicensePage() {
                     storageKey="license-banner-dismissed"
                     version={1}
                     title={t("licenseBannerTitle")}
-                    titleIcon={
+                    titleIcon={<TicketCheck className="w-5 h-5 text-primary" />}
-                        <TicketCheck className="w-5 h-5 text-primary" />
-                    }
                     description={t("licenseBannerDescription")}
                 >
                     <Link

src/app/layout.tsx

@@ -68,15 +68,15 @@ export default async function RootLayout({
     const env = pullEnv();
     const locale = await getLocale();
 
-    const supporterData = {
+    // const supporterData = {
-        visible: true
+    //     visible: true
-    } as any;
+    // } as any;
 
-    const res = await priv.get<AxiosResponse<IsSupporterKeyVisibleResponse>>(
+    // const res = await priv.get<AxiosResponse<IsSupporterKeyVisibleResponse>>(
-        "supporter-key/visible"
+    //     "supporter-key/visible"
-    );
+    // );
-    supporterData.visible = res.data.data.visible;
+    // supporterData.visible = res.data.data.visible;
-    supporterData.tier = res.data.data.tier;
+    // supporterData.tier = res.data.data.tier;
 
     let licenseStatus: GetLicenseStatusResponse;
     if (build === "enterprise") {
@@ -127,20 +127,20 @@ export default async function RootLayout({
                                     <LicenseStatusProvider
                                         licenseStatus={licenseStatus}
                                     >
-                                        <SupportStatusProvider
+                                        {/* <SupportStatusProvider
                                             supporterStatus={supporterData}
-                                        >
+                                        > */}
-                                            {/* Main content */}
+                                        {/* Main content */}
-                                            <div className="h-full flex flex-col">
+                                        <div className="h-full flex flex-col">
-                                                <div className="flex-1 overflow-auto">
+                                            <div className="flex-1 overflow-auto">
-                                                    <SplashImage>
+                                                <SplashImage>
-                                                        <LicenseViolation />
-                                                        {children}
-                                                    </SplashImage>
                                                     <LicenseViolation />
-                                                </div>
+                                                    {children}
+                                                </SplashImage>
+                                                <LicenseViolation />
                                             </div>
-                                        </SupportStatusProvider>
+                                        </div>
+                                        {/* </SupportStatusProvider> */}
                                     </LicenseStatusProvider>
                                     <Toaster />
                                 </TanstackQueryProvider>

src/app/maintenance-screen/page.tsx

@@ -28,7 +28,7 @@ export default async function MaintenanceScreen() {
 
     try {
         const headersList = await headers();
-        const host = headersList.get("host") || "";
+        const host = headersList.get("p-host") || headersList.get("host") || "";
         const hostname = host.split(":")[0];
 
         const res = await priv.get<AxiosResponse<GetMaintenanceInfoResponse>>(

src/components/AuthPageFooterNotices.tsx

@@ -1,24 +1,24 @@
 "use client";
 
-import { useSupporterStatusContext } from "@app/hooks/useSupporterStatusContext";
+// import { useSupporterStatusContext } from "@app/hooks/useSupporterStatusContext";
 import { useLicenseStatusContext } from "@app/hooks/useLicenseStatusContext";
 import { useTranslations } from "next-intl";
 import { build } from "@server/build";
 
 export default function AuthPageFooterNotices() {
     const t = useTranslations();
-    const { supporterStatus } = useSupporterStatusContext();
+    // const { supporterStatus } = useSupporterStatusContext();
     const { isUnlocked, licenseStatus } = useLicenseStatusContext();
 
     return (
         <>
-            {supporterStatus?.visible && (
+            {/* {supporterStatus?.visible && (
                 <div className="text-center mt-2">
                     <span className="text-sm text-muted-foreground opacity-50">
                         {t("noSupportKey")}
                     </span>
                 </div>
-            )}
+            )} */}
             {build === "enterprise" && !isUnlocked() ? (
                 <div className="text-center mt-2">
                     <span className="text-sm font-medium text-muted-foreground">

src/components/MachineClientsTable.tsx

@@ -11,10 +11,10 @@ import {
 } from "@app/components/ui/dropdown-menu";
 import { useEnvContext } from "@app/hooks/useEnvContext";
 import { useNavigationContext } from "@app/hooks/useNavigationContext";
+import { useOptimisticLabels } from "@app/hooks/useOptimisticLabels";
 import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import { toast } from "@app/hooks/useToast";
 import { createApiClient, formatAxiosError } from "@app/lib/api";
-import { cn } from "@app/lib/cn";
 import { getNextSortOrder, getSortDirection } from "@app/lib/sortColumn";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import type { PaginationState } from "@tanstack/react-table";
@@ -31,15 +31,18 @@ import Link from "next/link";
 import { useRouter } from "next/navigation";
 import { startTransition, useMemo, useState, useTransition } from "react";
 import { useDebouncedCallback } from "use-debounce";
-import z from "zod";
 import { ColumnFilterButton } from "./ColumnFilterButton";
-import { type SelectedLabel } from "./labels-selector";
+import { LabelColumnFilterButton } from "./LabelColumnFilterButton";
 import { LabelsTableCell } from "./LabelsTableCell";
 import { Badge } from "./ui/badge";
 import { ControlledDataTable } from "./ui/controlled-data-table";
-import { LabelColumnFilterButton } from "./LabelColumnFilterButton";
+import {
-import { useLocalLabels } from "@app/hooks/useLocalLabels";
+    productUpdatesQueries,
-import { useOptimisticLabels } from "@app/hooks/useOptimisticLabels";
+    type LatestVersionResponse
+} from "@app/lib/queries";
+import { useQuery } from "@tanstack/react-query";
+import semver from "semver";
+import { InfoPopup } from "./ui/info-popup";
 
 export type ClientRow = {
     id: number;
@@ -101,6 +104,9 @@ export default function MachineClientsTable({
 
     const { isPaidUser } = usePaidStatus();
     const isLabelFeatureEnabled = isPaidUser(tierMatrix.labels);
+    const data = useQuery(productUpdatesQueries.latestVersion(true));
+
+    const latestPlatformVersions = data.data?.data;
 
     const defaultMachineColumnVisibility = {
         subnet: false,
@@ -375,6 +381,37 @@ export default function MachineClientsTable({
                 cell: ({ row }) => {
                     const originalRow = row.original;
 
+                    const agentVersionMap: Record<string, string> = {
+                        "Pangolin Windows": "windows",
+                        "Pangolin Android": "android",
+                        "Pangolin iOS": "ios",
+                        "Pangolin iPadOS": "ios",
+                        "Pangolin macOS": "mac",
+                        "Pangolin CLI": "cli",
+                        "Olm CLI": "olm"
+                    };
+
+                    let updateAvailable = false;
+
+                    if (
+                        originalRow.olmVersion &&
+                        originalRow.agent &&
+                        latestPlatformVersions
+                    ) {
+                        const agent = agentVersionMap[
+                            originalRow.agent
+                        ] as keyof LatestVersionResponse;
+
+                        if (agent in latestPlatformVersions) {
+                            const agentVersion = latestPlatformVersions[agent];
+
+                            updateAvailable = semver.lt(
+                                originalRow.olmVersion,
+                                agentVersion.latestVersion
+                            );
+                        }
+                    }
+
                     return (
                         <div className="flex items-center space-x-1">
                             {originalRow.agent && originalRow.olmVersion ? (
@@ -386,9 +423,9 @@ export default function MachineClientsTable({
                             ) : (
                                 "-"
                             )}
-                            {/*originalRow.olmUpdateAvailable && (
+                            {updateAvailable && (
-                                <InfoPopup info={t("olmUpdateAvailableInfo")} />
+                                <InfoPopup info={t("updateAvailableInfo")} />
-                            )*/}
+                            )}
                         </div>
                     );
                 }

src/components/PrivateResourceForm.tsx

@@ -411,9 +411,9 @@ export function PrivateResourceForm({
 
     type FormData = z.infer<typeof formSchema>;
 
-    const rolesQuery = useQuery(orgQueries.roles({ orgId }));
+    const clientsQuery = useQuery(
-    const usersQuery = useQuery(orgQueries.users({ orgId }));
+        orgQueries.machineClients({ orgId, perPage: 1 })
-    const clientsQuery = useQuery(orgQueries.machineClients({ orgId }));
+    );
     const resourceRolesQuery = useQuery({
         ...resourceQueries.siteResourceRoles({
             siteResourceId: siteResourceId ?? 0
@@ -433,13 +433,6 @@ export function PrivateResourceForm({
         enabled: siteResourceId != null
     });
 
-    const allRoles = (rolesQuery.data ?? [])
-        .map((r) => ({ id: r.roleId.toString(), text: r.name }))
-        .filter((r) => r.text !== "Admin");
-    const allUsers = (usersQuery.data ?? []).map((u) => ({
-        id: u.id.toString(),
-        text: `${getUserDisplayName({ email: u.email, username: u.username })}${u.type !== UserType.Internal ? ` (${u.idpName})` : ""}`
-    }));
     const allClients = (clientsQuery.data ?? [])
         .filter((c) => !c.userId)
         .map((c) => ({ id: c.clientId.toString(), text: c.name }));
@@ -478,8 +471,6 @@ export function PrivateResourceForm({
     }
 
     const loadingRolesUsers =
-        rolesQuery.isLoading ||
-        usersQuery.isLoading ||
         clientsQuery.isLoading ||
         (siteResourceId != null &&
             (resourceRolesQuery.isLoading ||
@@ -488,16 +479,6 @@ export function PrivateResourceForm({
 
     const hasMachineClients = allClients.length > 0;
 
-    const [activeRolesTagIndex, setActiveRolesTagIndex] = useState<
-        number | null
-    >(null);
-    const [activeUsersTagIndex, setActiveUsersTagIndex] = useState<
-        number | null
-    >(null);
-    const [activeClientsTagIndex, setActiveClientsTagIndex] = useState<
-        number | null
-    >(null);
-
     const [sshServerMode, setSshServerMode] = useState<"standard" | "native">(
         () => {
             if (variant === "edit" && resource) {

src/components/SitesTable.tsx

@@ -55,6 +55,9 @@ import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import { LabelColumnFilterButton } from "./LabelColumnFilterButton";
 import { LabelsTableCell } from "./LabelsTableCell";
+import { useQuery } from "@tanstack/react-query";
+import { productUpdatesQueries } from "@app/lib/queries";
+import semver from "semver";
 
 export type SiteRow = {
     id: number;
@@ -113,12 +116,11 @@ export default function SitesTable({
     const api = createApiClient(useEnvContext());
     const t = useTranslations();
 
-    // useEffect(() => {
+    const { data: latestVersions } = useQuery(
-    //     const interval = setInterval(() => {
+        productUpdatesQueries.latestVersion(true)
-    //         router.refresh();
+    );
-    //     }, 30_000);
+
-    //     return () => clearInterval(interval);
+    const latestNewtVersion = latestVersions?.data?.newt?.latestVersion;
-    // }, []);
 
     const booleanSearchFilterSchema = z
         .enum(["true", "false"])
@@ -333,6 +335,11 @@ export default function SitesTable({
                 cell: ({ row }) => {
                     const originalRow = row.original;
 
+                    let updateAvailable =
+                        latestNewtVersion &&
+                        originalRow.newtVersion &&
+                        semver.lt(originalRow.newtVersion, latestNewtVersion);
+
                     if (originalRow.type === "newt") {
                         return (
                             <div className="flex items-center space-x-1">
@@ -346,7 +353,7 @@ export default function SitesTable({
                                         )}
                                     </div>
                                 </Badge>
-                                {originalRow.newtUpdateAvailable && (
+                                {updateAvailable && (
                                     <InfoPopup
                                         info={t("newtUpdateAvailableInfo")}
                                     />
@@ -561,7 +568,7 @@ export default function SitesTable({
         }
 
         return cols;
-    }, [isLabelFeatureEnabled, orgId, t, searchParams]);
+    }, [isLabelFeatureEnabled, orgId, t, searchParams, latestNewtVersion]);
 
     function toggleSort(column: string) {
         const newSearch = getNextSortOrder(column, searchParams);

src/components/SupporterMessage.tsx

@@ -9,33 +9,34 @@ export default function SupporterMessage({ tier }: { tier: string }) {
     const t = useTranslations();
 
     return (
-        <div className="relative flex items-center space-x-2 whitespace-nowrap group">
+        <></>
-            <span
+        // <div className="relative flex items-center space-x-2 whitespace-nowrap group">
-                className="cursor-pointer"
+        //     <span
-                onClick={(e) => {
+        //         className="cursor-pointer"
-                    // Get the bounding box of the element
+        //         onClick={(e) => {
-                    const rect = (
+        //             // Get the bounding box of the element
-                        e.target as HTMLElement
+        //             const rect = (
-                    ).getBoundingClientRect();
+        //                 e.target as HTMLElement
+        //             ).getBoundingClientRect();
 
-                    // Trigger confetti centered on the word "Pangolin"
+        //             // Trigger confetti centered on the word "Pangolin"
-                    confetti({
+        //             confetti({
-                        particleCount: 100,
+        //                 particleCount: 100,
-                        spread: 70,
+        //                 spread: 70,
-                        origin: {
+        //                 origin: {
-                            x: (rect.left + rect.width / 2) / window.innerWidth,
+        //                     x: (rect.left + rect.width / 2) / window.innerWidth,
-                            y: rect.top / window.innerHeight
+        //                     y: rect.top / window.innerHeight
-                        },
+        //                 },
-                        colors: ["#FFA500", "#FF4500", "#FFD700"]
+        //                 colors: ["#FFA500", "#FF4500", "#FFD700"]
-                    });
+        //             });
-                }}
+        //         }}
-            >
+        //     >
-                Pangolin
+        //         Pangolin
-            </span>
+        //     </span>
-            <Star className="w-3 h-3" />
+        //     <Star className="w-3 h-3" />
-            <div className="absolute left-1/2 transform -translate-x-1/2 -top-10 hidden group-hover:block  text-primary text-sm rounded-md border shadow-md px-4 py-2 pointer-events-none opacity-0 group-hover:opacity-100 transition-opacity">
+        //     <div className="absolute left-1/2 transform -translate-x-1/2 -top-10 hidden group-hover:block  text-primary text-sm rounded-md border shadow-md px-4 py-2 pointer-events-none opacity-0 group-hover:opacity-100 transition-opacity">
-                {t("componentsSupporterMessage", { tier: tier })}
+        //         {t("componentsSupporterMessage", { tier: tier })}
-            </div>
+        //     </div>
-        </div>
+        // </div>
     );
 }

src/components/SupporterStatus.tsx

@@ -3,7 +3,7 @@
 // THIS IS DEPRECATED AND IS NO LONGER SHOWED TO THE USER WITH THE DISCONTINUATION
 // OF THE SUPPORTER PROGRAM. IT MAY BE REMOVED IN A FUTURE UPDATE.
 
-import { useSupporterStatusContext } from "@app/hooks/useSupporterStatusContext";
+// import { useSupporterStatusContext } from "@app/hooks/useSupporterStatusContext";
 import { useState, useTransition } from "react";
 import {
     Tooltip,
@@ -58,134 +58,134 @@ interface SupporterStatusProps {
 export default function SupporterStatus({
     isCollapsed = false
 }: SupporterStatusProps) {
-    const { supporterStatus, updateSupporterStatus } =
+    // const { supporterStatus, updateSupporterStatus } =
-        useSupporterStatusContext();
+    //     useSupporterStatusContext();
-    const [supportOpen, setSupportOpen] = useState(false);
+    // const [supportOpen, setSupportOpen] = useState(false);
-    const [keyOpen, setKeyOpen] = useState(false);
+    // const [keyOpen, setKeyOpen] = useState(false);
-    const [purchaseOptionsOpen, setPurchaseOptionsOpen] = useState(false);
+    // const [purchaseOptionsOpen, setPurchaseOptionsOpen] = useState(false);
 
-    const { env } = useEnvContext();
+    // const { env } = useEnvContext();
-    const api = createApiClient({ env });
+    // const api = createApiClient({ env });
-    const t = useTranslations();
+    // const t = useTranslations();
 
-    const formSchema = z.object({
+    // const formSchema = z.object({
-        githubUsername: z.string().nonempty({
+    //     githubUsername: z.string().nonempty({
-            error: "GitHub username is required"
+    //         error: "GitHub username is required"
-        }),
+    //     }),
-        key: z.string().nonempty({
+    //     key: z.string().nonempty({
-            error: "Supporter key is required"
+    //         error: "Supporter key is required"
-        })
+    //     })
-    });
+    // });
 
-    const form = useForm({
+    // const form = useForm({
-        resolver: zodResolver(formSchema),
+    //     resolver: zodResolver(formSchema),
-        defaultValues: {
+    //     defaultValues: {
-            githubUsername: "",
+    //         githubUsername: "",
-            key: ""
+    //         key: ""
-        }
+    //     }
-    });
+    // });
 
-    async function hide() {
+    // async function hide() {
-        await api.post("/supporter-key/hide");
+    //     await api.post("/supporter-key/hide");
 
-        updateSupporterStatus({
+    //     updateSupporterStatus({
-            visible: false
+    //         visible: false
-        });
+    //     });
-    }
+    // }
 
-    async function onSubmit(values: z.infer<typeof formSchema>) {
+    // async function onSubmit(values: z.infer<typeof formSchema>) {
-        try {
+    //     try {
-            const res = await api.post<
+    //         const res = await api.post<
-                AxiosResponse<ValidateSupporterKeyResponse>
+    //             AxiosResponse<ValidateSupporterKeyResponse>
-            >("/supporter-key/validate", {
+    //         >("/supporter-key/validate", {
-                githubUsername: values.githubUsername,
+    //             githubUsername: values.githubUsername,
-                key: values.key
+    //             key: values.key
-            });
+    //         });
 
-            const data = res.data.data;
+    //         const data = res.data.data;
 
-            if (!data || !data.valid) {
+    //         if (!data || !data.valid) {
-                toast({
+    //             toast({
-                    variant: "destructive",
+    //                 variant: "destructive",
-                    title: t("supportKeyInvalid"),
+    //                 title: t("supportKeyInvalid"),
-                    description: t("supportKeyInvalidDescription")
+    //                 description: t("supportKeyInvalidDescription")
-                });
+    //             });
-                return;
+    //             return;
-            }
+    //         }
 
-            // Trigger the toast
+    //         // Trigger the toast
-            toast({
+    //         toast({
-                variant: "default",
+    //             variant: "default",
-                title: t("supportKeyValid"),
+    //             title: t("supportKeyValid"),
-                description: t("supportKeyValidDescription")
+    //             description: t("supportKeyValidDescription")
-            });
+    //         });
 
-            // Fireworks-style confetti
+    //         // Fireworks-style confetti
-            const duration = 5 * 1000; // 5 seconds
+    //         const duration = 5 * 1000; // 5 seconds
-            const animationEnd = Date.now() + duration;
+    //         const animationEnd = Date.now() + duration;
-            const defaults = {
+    //         const defaults = {
-                startVelocity: 30,
+    //             startVelocity: 30,
-                spread: 360,
+    //             spread: 360,
-                ticks: 60,
+    //             ticks: 60,
-                zIndex: 0,
+    //             zIndex: 0,
-                colors: ["#FFA500", "#FF4500", "#FFD700"] // Orange hues
+    //             colors: ["#FFA500", "#FF4500", "#FFD700"] // Orange hues
-            };
+    //         };
 
-            function randomInRange(min: number, max: number) {
+    //         function randomInRange(min: number, max: number) {
-                return Math.random() * (max - min) + min;
+    //             return Math.random() * (max - min) + min;
-            }
+    //         }
 
-            const interval = setInterval(() => {
+    //         const interval = setInterval(() => {
-                const timeLeft = animationEnd - Date.now();
+    //             const timeLeft = animationEnd - Date.now();
 
-                if (timeLeft <= 0) {
+    //             if (timeLeft <= 0) {
-                    clearInterval(interval);
+    //                 clearInterval(interval);
-                    return;
+    //                 return;
-                }
+    //             }
 
-                const particleCount = 50 * (timeLeft / duration);
+    //             const particleCount = 50 * (timeLeft / duration);
 
-                // Launch confetti from two random horizontal positions
+    //             // Launch confetti from two random horizontal positions
-                confetti({
+    //             confetti({
-                    ...defaults,
+    //                 ...defaults,
-                    particleCount,
+    //                 particleCount,
-                    origin: {
+    //                 origin: {
-                        x: randomInRange(0.1, 0.3),
+    //                     x: randomInRange(0.1, 0.3),
-                        y: Math.random() - 0.2
+    //                     y: Math.random() - 0.2
-                    }
+    //                 }
-                });
+    //             });
-                confetti({
+    //             confetti({
-                    ...defaults,
+    //                 ...defaults,
-                    particleCount,
+    //                 particleCount,
-                    origin: {
+    //                 origin: {
-                        x: randomInRange(0.7, 0.9),
+    //                     x: randomInRange(0.7, 0.9),
-                        y: Math.random() - 0.2
+    //                     y: Math.random() - 0.2
-                    }
+    //                 }
-                });
+    //             });
-            }, 250);
+    //         }, 250);
 
-            setPurchaseOptionsOpen(false);
+    //         setPurchaseOptionsOpen(false);
-            setKeyOpen(false);
+    //         setKeyOpen(false);
 
-            updateSupporterStatus({
+    //         updateSupporterStatus({
-                visible: false
+    //             visible: false
-            });
+    //         });
-        } catch (error) {
+    //     } catch (error) {
-            toast({
+    //         toast({
-                variant: "destructive",
+    //             variant: "destructive",
-                title: t("error"),
+    //             title: t("error"),
-                description: formatAxiosError(
+    //             description: formatAxiosError(
-                    error,
+    //                 error,
-                    t("supportKeyErrorValidationDescription")
+    //                 t("supportKeyErrorValidationDescription")
-                )
+    //             )
-            });
+    //         });
-            return;
+    //         return;
-        }
+    //     }
-    }
+    // }
 
     return (
         <>
-            <Credenza
+            {/* <Credenza
                 open={purchaseOptionsOpen}
                 onOpenChange={(val) => {
                     setPurchaseOptionsOpen(val);
@@ -469,7 +469,7 @@ export default function SupporterStatus({
                         {t("supportKeyBuy")}
                     </Button>
                 )
-            ) : null}
+            ) : null} */}
         </>
     );
 }

src/components/UserDevicesTable.tsx

@@ -38,6 +38,12 @@ import { ColumnFilterButton } from "./ColumnFilterButton";
 import IdpTypeBadge from "./IdpTypeBadge";
 import { Badge } from "./ui/badge";
 import { ControlledDataTable } from "./ui/controlled-data-table";
+import {
+    productUpdatesQueries,
+    type LatestVersionResponse
+} from "@app/lib/queries";
+import { useQuery } from "@tanstack/react-query";
+import semver from "semver";
 
 export type ClientRow = {
     id: number;
@@ -100,6 +106,9 @@ export default function UserDevicesTable({
         searchParams
     } = useNavigationContext();
     const [isRefreshing, startTransition] = useTransition();
+    const data = useQuery(productUpdatesQueries.latestVersion(true));
+
+    const latestPlatformVersions = data.data?.data;
 
     const defaultUserColumnVisibility = {
         subnet: false,
@@ -555,6 +564,37 @@ export default function UserDevicesTable({
                 cell: ({ row }) => {
                     const originalRow = row.original;
 
+                    const agentVersionMap: Record<string, string> = {
+                        "Pangolin Windows": "windows",
+                        "Pangolin Android": "android",
+                        "Pangolin iOS": "ios",
+                        "Pangolin iPadOS": "ios",
+                        "Pangolin macOS": "mac",
+                        "Pangolin CLI": "cli",
+                        "Olm CLI": "olm"
+                    };
+
+                    let updateAvailable = false;
+
+                    if (
+                        originalRow.olmVersion &&
+                        originalRow.agent &&
+                        latestPlatformVersions
+                    ) {
+                        const agent = agentVersionMap[
+                            originalRow.agent
+                        ] as keyof LatestVersionResponse;
+
+                        if (agent in latestPlatformVersions) {
+                            const agentVersion = latestPlatformVersions[agent];
+
+                            updateAvailable = semver.lt(
+                                originalRow.olmVersion,
+                                agentVersion.latestVersion
+                            );
+                        }
+                    }
+
                     return (
                         <div className="flex items-center space-x-1">
                             {originalRow.agent && originalRow.olmVersion ? (
@@ -567,9 +607,9 @@ export default function UserDevicesTable({
                                 "-"
                             )}
 
-                            {/*originalRow.olmUpdateAvailable && (
+                            {updateAvailable && (
-                                <InfoPopup info={t("olmUpdateAvailableInfo")} />
+                                <InfoPopup info={t("updateAvailableInfo")} />
-                            )*/}
+                            )}
                         </div>
                     );
                 }
@@ -714,7 +754,7 @@ export default function UserDevicesTable({
         }
 
         return allOptions;
-    }, [t]);
+    }, [t, latestPlatformVersions]);
 
     function handleFilterChange(
         column: string,

src/components/newt-install-commands.tsx

@@ -139,7 +139,6 @@ Restart=always
 RestartSec=2
 UMask=0077
 
-NoNewPrivileges=true
 PrivateTmp=true
 
 [Install]

src/components/resource-policy/policy-access-rule-validation.ts

@@ -83,9 +83,19 @@ export function createPolicyRuleValueSchema(t: TranslateFn, match: string) {
                 { message: t("rulesErrorInvalidCountryDescription") }
             );
         case "ASN":
-            return required.refine((value) => /^AS\d+$/i.test(value.trim()), {
+            return required.refine(
-                message: t("rulesErrorInvalidAsnDescription")
+                (value) => {
-            });
+                    const normalizedValue = value.trim().toUpperCase();
+                    return (
+                        /^AS\d+$/.test(normalizedValue) ||
+                        normalizedValue === "ALL" ||
+                        normalizedValue === "AS0"
+                    );
+                },
+                {
+                    message: t("rulesErrorInvalidAsnDescription")
+                }
+            );
         default:
             return required;
     }

src/lib/getBrowserTargetForRequest.ts

@@ -6,7 +6,7 @@ import { cache } from "react";
 
 export const getBrowserTargetForRequest = cache(async () => {
     const headersList = await headers();
-    const host = headersList.get("host") || "";
+    const host = headersList.get("p-host") || headersList.get("host") || "";
     const hostname = host.split(":")[0];
 
     try {

src/lib/queries.ts

@@ -63,6 +63,34 @@ export type LatestVersionResponse = {
         latestVersion: string;
         releaseNotes: string;
     };
+    newt: {
+        latestVersion: string;
+        releaseNotes: string;
+    };
+    cli: {
+        latestVersion: string;
+        releaseNotes: string;
+    };
+    "panglin-node": {
+        latestVersion: string;
+        releaseNotes: string;
+    };
+    windows: {
+        latestVersion: string;
+        releaseNotes: string;
+    };
+    android: {
+        latestVersion: string;
+        releaseNotes: string;
+    };
+    mac: {
+        latestVersion: string;
+        releaseNotes: string;
+    };
+    ios: {
+        latestVersion: string;
+        releaseNotes: string;
+    };
 };
 
 export const productUpdatesQueries = {