Bump the npm-dependencies group with 8 updates

Bumps the npm-dependencies group with 8 updates: | Package | From | To | | --- | --- | --- | | [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1121.0` | `3.1123.0` | | [@tanstack/react-table](https://github.com/TanStack/table/tree/HEAD/packages/react-table) | `8.21.3` | `9.2.4` | | [next](https://github.com/vercel/next.js) | `16.3.3` | `16.3.4` | | [react-day-picker](https://github.com/gpbl/react-day-picker/tree/HEAD/packages/react-day-picker) | `9.14.0` | `10.0.1` | | [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.3.3` | `16.3.4` | | [tsc-alias](https://github.com/justkey007/tsc-alias) | `1.9.2` | `1.9.3` | | [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.68.0` | `8.69.0` | Updates `@aws-sdk/client-s3` from 3.1121.0 to 3.1123.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1123.0/clients/client-s3) Updates `@tanstack/react-table` from 8.21.3 to 9.2.4 - [Release notes](https://github.com/TanStack/table/releases) - [Changelog](https://github.com/TanStack/table/blob/main/packages/react-table/CHANGELOG.md) - [Commits](https://github.com/TanStack/table/commits/@tanstack/react-table@9.2.4/packages/react-table) Updates `next` from 16.3.3 to 16.3.4 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.3.3...v16.3.4) Updates `react-day-picker` from 9.14.0 to 10.0.1 - [Release notes](https://github.com/gpbl/react-day-picker/releases) - [Changelog](https://github.com/gpbl/react-day-picker/blob/main/packages/react-day-picker/CHANGELOG.md) - [Commits](https://github.com/gpbl/react-day-picker/commits/v10.0.1/packages/react-day-picker) Updates `eslint-config-next` from 16.3.3 to 16.3.4 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.4/packages/eslint-config-next) Updates `tsc-alias` from 1.9.2 to 1.9.3 - [Release notes](https://github.com/justkey007/tsc-alias/releases) - [Commits](https://github.com/justkey007/tsc-alias/compare/v1.9.2...v1.9.3) Updates `typescript` from 6.0.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/compare/v6.0.3...v7.0.2) Updates `typescript-eslint` from 8.68.0 to 8.69.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.69.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.1123.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@tanstack/react-table" dependency-version: 9.2.4 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-dependencies - dependency-name: next dependency-version: 16.3.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: react-day-picker dependency-version: 10.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-dependencies - dependency-name: eslint-config-next dependency-version: 16.3.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: tsc-alias dependency-version: 1.9.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-dependencies - dependency-name: typescript-eslint dependency-version: 8.69.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
Merge pull request #3691 from fosrl/dev
2026-09-04 10:19:38 +02:00 · 2026-09-04 01:37:37 +00:00 · 2026-09-03 16:19:47 -04:00 · 2026-09-03 16:17:07 -04:00 · 2026-09-03 15:41:12 -04:00 · 2026-09-03 12:05:18 -04:00
176 changed files with 8514 additions and 6171 deletions
@@ -34,6 +34,14 @@ body:
      validations:
          required: true

+    - type: textarea
+      attributes:
+          label: AI Disclosure
+          description: |
+              If you used AI to help write this issue, please disclose it here. This is important for transparency and helps maintain the integrity of the issue tracking process.
+      validations:
+          required: true
+
    - type: textarea
      attributes:
          label: Expected Behavior
@@ -4,6 +4,10 @@ perpetual license to use, modify, and redistribute these contributions under any
 choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
 represent that I have the right to grant this license for all contributed content.

+## AI Disclosure
+
+> Please disclose how AI was used in this pull request. The use of AI does not preclude this from being merged but is an important factor in how we review your request.
+
 ## Description


@@ -37,11 +37,22 @@

 <p align="center">
    <strong>
-        Get started with Pangolin at <a href="https://app.pangolin.net/auth/signup">app.pangolin.net</a>
+        Get started with Pangolin Cloud at <a href="https://app.pangolin.net/auth/signup">app.pangolin.net</a>
    </strong>
 </p>

-Pangolin is an open-source, identity-based remote access platform built on WireGuard® that enables secure connectivity to infrastructure anywhere. It combines reverse-proxy and VPN capabilities into one platform, providing browser-based access to web applications and client-based access to private resources with NAT traversal, all with granular access control.
+Pangolin is an open-source SASE platform, built on WireGuard®, with a simple mission: connect and protect your users, wherever they are. It brings networking and security together as one system including a zero-trust VPN, zero-trust reverse proxy, privileged access management, and an identity-aware AI gateway, all sharing one identity and policy model. It's the same idea behind platforms like Cloudflare One, Zscaler, and Prisma but open, self-hostable, and built to stay light and easy to deploy.
+
+### Networking and security that's unified, open, and simple
+
+Legacy SASE platforms got the idea right: connectivity and security belong together. But they delivered it as a heavyweight, closed, cloud-locked stack assembled from years of patchwork. Pangolin exists to do that unification differently, in the open, self-hostable, and simple enough that administrators actually enjoy running it.
+
+* **Open source, not a black box**: the code is open and auditable, so you can see exactly how your traffic is handled and how access decisions get made, instead of trusting a closed cloud control plane.
+* **Networking and security as one platform**: sites, reverse proxy, client access, RBAC, and the AI gateway share one identity and policy model, so protecting users and connecting them are executed together.
+* **Lightweight by design**: the whole platform is built to stay small and fast: easy to self-host on a small server, with a lightweight, user-space connector that goes in your private networks.
+* **Enjoyable to use**: a clean, modern interface and a setup flow that gets out of your way, so managing access feels simple instead of like fighting a legacy admin console.
+* **Zero trust from day one**: access is granted per resource, not per network, with identity provider integration, role-based access control, and full audit logging.
+* **Run it your way**: self-host the Community Edition for free, step up to the Enterprise Edition for advanced features, or use Pangolin Cloud if you'd rather not manage infrastructure at all.

 ## Installation

@@ -53,9 +64,9 @@ Pangolin is an open-source, identity-based remote access platform built on WireG

 ## Deployment Options

- **Pangolin Cloud** - Fully managed service - no infrastructure required.
- **Self-Host: Community Edition** - Free, open source, and licensed under AGPL-3.
- **Self-Host: Enterprise Edition** - Licensed under Fossorial Commercial License. Free for personal and hobbyist use, and for businesses making less than \$100K USD gross annual revenue.
+- **Pangolin Cloud** - Fully managed service with no infrastructure required.
+- **Self-Host: Community Edition** - Free, open-source, and licensed under AGPL-3.
+- **Self-Host: Enterprise Edition** - Open-core, and licensed under Fossorial Commercial License. Free for personal and hobbyist use, and for businesses making less than \$100K USD gross annual revenue.

 ## Key Features

@@ -99,6 +110,19 @@ Access private resources like SSH servers, databases, RDP, and entire network ra

 <img src="public/screenshots/private-resources.png" alt="Private resources" width="100%" />

+### Identity-aware AI gateway
+
+Put an identity-aware proxy in front of public cloud (OpenAI, Anthropic, Gemini, etc.) and self-hosted model servers (Ollama, vLLM, Mistral, etc.) so coding agents and AI clients call a single Pangolin URL. Publish it as a public resource with personal API keys, or keep it private on a client tunnel where the connected client is the credential for keyless access. Budgets, session history, and usage analytics sit in front of every call.
+
+* Access self-hosted models (vLLM, Ollama, etc) alongside cloud models (OpenAI, Anthropic, etc) in one place
+* Keyless access by authenticating users with the Pangolin desktop client
+* Or, provide users with personal API keys
+* Control costs and token usage by setting budgets
+* Audit with detailed session history and analytics
+* Integrate AI clients and coding agents (Claude Code, Codex, OpenCode, etc)
+
+<img src="public/screenshots/expanded-session-logs.png" alt="AI Session Logs" width="100%" />
+
 ### Give users and roles access to resources

 Use Pangolin's built-in users or bring your own identity provider and set up role-based access control (RBAC). Grant users access to specific resources, not entire networks. Unlike traditional VPNs that expose full network access, Pangolin's zero-trust model ensures users can only reach the applications, services, and routes you explicitly define.
@@ -7,6 +7,8 @@ inference resource has more than one AI provider.

 - Route → capability binding: `server/routers/aiGateway/createAiGatewayRouter.ts`
 - Request pipeline: `server/routers/aiGateway/pipeline.ts` (`selectProvider`)
+- Model discovery: `server/routers/aiGateway/v1Models.ts` and
+  `server/lib/aiModelDiscovery.ts`
 - Tie-break scoring: `server/lib/aiProviderSelection.ts`
 - Allow/block matching: `server/lib/aiModelKeyMatch.ts`
 - Model catalog: `server/lib/aiModelCatalog.ts`
@@ -39,6 +41,7 @@ The incoming path selects a capability before any provider logic runs.
 | `POST /v1/chat/completions` | `openai_chat` |
 | `POST /v1/responses` | `openai_responses` |
 | `POST /v1/messages` | `anthropic_messages` |
+| `GET /v1/models`, `GET /v1/models/{id}` | `v1_models` |
 | Gemini / Vertex / Bedrock routes | their respective capability ids |

 Only attached providers that advertise that capability stay in the candidate
@@ -47,10 +50,10 @@ set. Default capabilities do not overlap for native OpenAI vs Anthropic:
 | Provider type | Default capabilities |
 |---------------|----------------------|
 | `openai` | `openai_chat`, `openai_responses` |
-| `anthropic` | `anthropic_messages` |
+| `anthropic` | `anthropic_messages`, `v1_models` |
 | `openRouter` | `openai_chat` |
 | `vercelAiGateway` | `openai_chat`, `openai_responses` |
-| `microsoftFoundry` | `openai_chat`, `openai_responses`, `anthropic_messages` |
+| `microsoftFoundry` | `openai_chat`, `openai_responses`, `anthropic_messages`, `v1_models` |
 | `custom` | whatever was configured |

 ### 2. Allow / Block Lists
@@ -128,6 +131,68 @@ Model "<id>" is ambiguous across multiple AI providers on this resource
 Typical remaining ties: two OpenAI-type providers both with `*`, or two
 customs advertising the same capability for an unknown model.

+## Model Discovery Is Not Selection
+
+`GET /v1/models` and `GET /v1/models/{id}` (`v1_models`) skip steps 3-6
+entirely. There is no requested model to disambiguate on, so the gateway does
+not pick one provider - it returns the **union** of what every attached
+provider advertising `v1_models` would accept, deduplicated by model id
+(lowest `providerId` wins a collision).
+
+Discovery is answered from the gateway's own view of the allow/block lists,
+never proxied upstream. Providers that expose no `/v1/models` endpoint of their
+own still get a working listing, and a model an allow/block list forbids is
+never advertised.
+
+Each provider's candidate ids come from two places:
+
+| Source | Contributes |
+|--------|-------------|
+| Exact (non-wildcard) allow entries | the model key itself |
+| The model catalog for the provider's type | every catalog id matching an allow pattern |
+
+Both sources are then filtered through the same
+`isAllowedByLists(id, allows, blocks)` check step 2 applies, so a block pattern
+hides a model from discovery exactly as it would reject it at request time.
+
+The catalog source is what makes a wildcard allow such as `claude-*`
+enumerable. Provider types with no catalog mapping (`openRouter`,
+`vercelAiGateway`, `custom`) have nothing to expand against, so a wildcard
+allow on those types lists nothing - **add exact allow entries to make their
+models discoverable.**
+
+### Where each field comes from
+
+Token limits and capability flags can't be derived from an allow/block list.
+They come from the model catalog (`server/lib/aiModelCatalog.ts`), which the
+Fossorial API builds from LiteLLM:
+
+| Field | Source |
+|-------|--------|
+| `max_input_tokens` | catalog `limits.input` |
+| `max_tokens` | catalog `limits.output` |
+| `capabilities` | catalog flags, mapped to the Models API shape by `capabilitiesFromCatalog` |
+| `display_name` | the configured model row's name, else the model id |
+| `created_at` | the configured model row's timestamp, else the epoch |
+
+A model the catalog doesn't know (an exact allow entry for a fine-tune, say)
+reports `null` for all three metadata fields. The Models API declares them
+nullable, so that is a valid answer rather than a broken one.
+
+The catalog's flags are coarser than the Models API describes: it carries a
+single `reasoning` flag with no way to distinguish adaptive from
+`budget_tokens`-style thinking, and nothing at all for batch, citations, code
+execution, PDF input, or context management. Anything it reports as unknown
+(`null`) is surfaced as unsupported rather than invented, so `capabilities`
+understates rather than overstates what a model can do.
+
+The gateway does **not** query the provider's own `/v1/models`. Discovery is
+answered entirely from local state.
+
+Results are ordered newest-first with the id as tie-break, and paginated with
+Anthropic's `limit` / `after_id` / `before_id` semantics (default 20, max
+1000).
+
 ## Examples

 Assume each provider below is attached and enabled on the same inference
@@ -16,7 +16,7 @@ experimental:
      version: "{{.BadgerVersion}}"
    crowdsec: # CrowdSec plugin configuration added
      moduleName: "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      version: "v1.4.4"
+      version: "v1.7.1"

 log:
  level: "INFO"
@@ -1176,6 +1176,10 @@
    "idpJmespathAboutDescriptionLink": "Научете повече за JMESPath",
    "idpJmespathLabel": "Идентификатор на пътя",
    "idpJmespathLabelDescription": "Пътят към идентификатора на потребителя в ID токена",
+    "idpIdentifierChangeTitle": "Предупреждение за промяна на пътя на идентификатора",
+    "idpIdentifierChangeDescription": "Ще промените пътя на идентификатора. Това ще повлияе на начина, по който съществуващите потребители са разпределени. Потребители, които преди са влизали чрез този доставчик на идентичности, може вече да не бъдат разпознавани като същите потребители.",
+    "idpIdentifierChangeConfirmMessage": "Потвърждавам",
+    "idpIdentifierChangeWarningText": "Това ще повлияе на начина, по който съществуващите потребители са разпределени",
    "idpJmespathEmailPathOptional": "Път за имейл (по избор)",
    "idpJmespathEmailPathOptionalDescription": "Пътят до имейла на потребителя в ID токена",
    "idpJmespathNamePathOptional": "Път (по избор) на име",
@@ -1573,6 +1577,8 @@
    "search": "Търси…",
    "searchPlaceholder": "Търсене...",
    "emptySearchOptions": "Няма намерени опции",
+    "ipFilterSearchPlaceholder": "Въведете IP адрес…",
+    "ipFilterEmptyMessage": "Въведете IP адрес, за да филтрирате по него",
    "create": "Създаване",
    "orgs": "Организации",
    "loginError": "Възникна неочаквана грешка. Моля, опитайте отново.",
@@ -1785,7 +1791,7 @@
    "aiClientConfigDescriptionClaude": "Инструментът за кодиране на Anthropic за терминала.",
    "aiClientConfigDescriptionCodex": "Инструментът за кодиране на OpenAI за терминала.",
    "aiClientConfigDescriptionOpencode": "Отворен кодиращ агент за терминал.",
-    "aiClientConfigDescriptionCursor": "AI редактор на код, базиран на VS Code.",
+    "aiClientConfigDescriptionGemini": "Агентски инструмент на Google за кодиране на терминал.",
    "aiClientConfigSetup": "Настройка",
    "aiClientConfigTabCli": "Автоматичен (CLI)",
    "aiClientConfigTabManual": "Ръчна конфигурация",
@@ -1891,6 +1897,7 @@
    "aiProviderRoutingModeTargetDescription": "Маршрутиране чрез цели на вашите сайтове",
    "aiProviderRoutingModeTargetNote": "След създаването на този доставчик, конфигурирайте целите на сайта в раздела Настройки на мрежата.",
    "aiProviderTargetNoOne": "Този доставчик няма цели. Добавете цел за маршрутиране на заявки чрез вашите сайтове.",
+    "aiProviderRemoteNodeTargetsWarning": "Уебсайтовете, свързани с отдалечени възли, са недостъпни за пренасочване към AI Gateway доставчици.",
    "aiProviderSkipTlsVerification": "Пропуснете проверката на TLS",
    "aiProviderSkipTlsVerificationDescription": "Деактивирайте проверката на TLS сертификат за възходящото свързване",
    "aiProviderBudget": "Бюджет",
@@ -1923,6 +1930,8 @@
    "aiCapabilityOpenaiResponsesDescription": "Поддържа /v1/responses",
    "aiCapabilityAnthropicMessages": "Anthropic Съобщения",
    "aiCapabilityAnthropicMessagesDescription": "Поддържа /v1/messages",
+    "aiCapabilityV1Models": "Списък на модели",
+    "aiCapabilityV1ModelsDescription": "Поддържа /v1/models откриване на модели",
    "aiCapabilityGeminiGenerateContent": "Gemini Генериране на Съдържание",
    "aiCapabilityGeminiGenerateContentDescription": "Поддържа директния Gemini API",
    "aiCapabilityBedrockModelInvoke": "Бедрок Модел Активирай",
@@ -2593,6 +2602,7 @@
    "createDomainType": "Тип:",
    "createDomainName": "Име:",
    "createDomainValue": "Стойност:",
+    "multiSelectFilterCount": "{count} избрани",
    "createDomainCnameRecords": "CNAME записи",
    "createDomainARecords": "A записи",
    "createDomainRecordNumber": "Запис {number}",
@@ -2707,6 +2717,7 @@
    "healthScheme": "Метод",
    "healthSelectScheme": "Избор на метод",
    "healthCheckPortInvalid": "Портът трябва да бъде между 1 и 65535",
+    "healthCheckHostnameInvalid": "Името на хоста не трябва да съдържа празни символи",
    "healthCheckPath": "Път",
    "healthHostname": "IP / Хост",
    "healthPort": "Порт",
@@ -2990,7 +3001,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Добавете CIDR диапазон (напр. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Неуспешно зареждане на подмрежи",
    "remoteExitNodeNetworkingLabelsTitle": "Етикети за Предпочитания",
-    "remoteExitNodeNetworkingLabelsDescription": "Сайтове с тези етикети ще бъдат принудени да се свържат чрез този отдалечен край.",
+    "remoteExitNodeNetworkingLabelsDescription": "Сайтовете с тези етикети ще предпочетат да се свържат чрез този отдалечен изходен възел.",
    "remoteExitNodeNetworkingLabelsButtonText": "Изберете етикети...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Търсене на етикети...",
    "remoteExitNodeNetworkingLabelsLoadError": "Неуспешно зареждане на етикети",
@@ -3548,6 +3559,9 @@
    "sidebarLogsAction": "Дневници на действията",
    "logRetention": "Задържане на логове",
    "logRetentionDescription": "Управлявайте времето за задържане на различни видове логове за тази организация или ги деактивирайте",
+    "logRetentionDisabledWarningTitle": "Деактивирано съхранение на дневници",
+    "logRetentionDisabledWarningDescription": "{logType} не се съхраняват за тази организация, така че новите дейности няма да се показват тук. Активирайте съхранението в настройките за сигурност, за да започнете събирането на тези дневници.",
+    "logRetentionDisabledWarningButton": "Отидете на настройки за сигурност",
    "requestLogsDescription": "Прегледайте подробни логове на заявки за ресурси в тази организация",
    "aiSessionLogs": "Журнали на AI Портал Сесиите",
    "aiSessionLogsDescription": "Прегледайте подканянета и транскрипции на отговори за запитванията към AI портал в тази организация",
@@ -4081,6 +4095,8 @@
    "httpDestConnectionLogsDescription": "Събития на свързване и прекъсване на сайта и тунела, включително свръзки и прекъсвания.",
    "httpDestRequestLogsTitle": "Логове за HTTP заявки",
    "httpDestRequestLogsDescription": "Регистри за HTTP заявките към проксирани ресурси, включително метод, път и код на отговор.",
+    "httpDestAISessionLogsTitle": "Дневници за AI сесии",
+    "httpDestAISessionLogsDescription": "AI заявки до шлюза и отговори на сесии, включително подканвания, отговори на модели и използване на жетони.",
    "httpDestSaveChanges": "Запази промените",
    "httpDestCreateDestination": "Създаване на дестинация",
    "httpDestUpdatedSuccess": "Дестинацията беше актуализирана успешно",
@@ -1176,6 +1176,10 @@
    "idpJmespathAboutDescriptionLink": "Další informace o cestě JMESPath",
    "idpJmespathLabel": "Cesta identifikátoru",
    "idpJmespathLabelDescription": "Cesta k identifikátoru uživatele v tokenu ID",
+    "idpIdentifierChangeTitle": "Varování o změně cesty identifikátoru",
+    "idpIdentifierChangeDescription": "Chystáte se změnit cestu identifikátoru. Tímto se změní způsob mapování stávajících uživatelů. Uživatelé, kteří se dříve přihlásili přes tohoto poskytovatele identity, již nemusí být rozpoznáni jako stejní uživatelé.",
+    "idpIdentifierChangeConfirmMessage": "Potvrzuji",
+    "idpIdentifierChangeWarningText": "Toto ovlivní, jak budou mapováni stávající uživatelé",
    "idpJmespathEmailPathOptional": "Cesta e-mailu (volitelné)",
    "idpJmespathEmailPathOptionalDescription": "Cesta k e-mailu uživatele v ID tokenu",
    "idpJmespathNamePathOptional": "Cesta k názvu (volitelné)",
@@ -1573,6 +1577,8 @@
    "search": "Vyhledávání…",
    "searchPlaceholder": "Hledat...",
    "emptySearchOptions": "Nebyly nalezeny žádné možnosti",
+    "ipFilterSearchPlaceholder": "Zadejte IP adresu…",
+    "ipFilterEmptyMessage": "Zadejte IP adresu pro filtrování",
    "create": "Vytvořit",
    "orgs": "Organizace",
    "loginError": "Došlo k neočekávané chybě. Zkuste to prosím znovu.",
@@ -1785,7 +1791,7 @@
    "aiClientConfigDescriptionClaude": "Antropický agentický kódovací nástroj pro terminál.",
    "aiClientConfigDescriptionCodex": "Agentický kódovací nástroj OpenAI pro terminál.",
    "aiClientConfigDescriptionOpencode": "Open source terminální kódovací agent.",
-    "aiClientConfigDescriptionCursor": "AI editor kódu postavený na VS Code.",
+    "aiClientConfigDescriptionGemini": "Agentický nástroj Google pro kódování v terminálu.",
    "aiClientConfigSetup": "Nastavení",
    "aiClientConfigTabCli": "Automatické (CLI)",
    "aiClientConfigTabManual": "Ruční konfigurace",
@@ -1891,6 +1897,7 @@
    "aiProviderRoutingModeTargetDescription": "Směrujte přes cíle na svých stránkách",
    "aiProviderRoutingModeTargetNote": "Po vytvoření tohoto poskytovatele, nakonfigurujte cíle stránek na záložce Nastavení sítě.",
    "aiProviderTargetNoOne": "Tento poskytovatel nemá žádné cíle. Přidejte cíl pro směrování požadavků přes vaše stránky.",
+    "aiProviderRemoteNodeTargetsWarning": "Stránky připojené k vzdáleným uzlům nejsou dostupné pro přesměrování na poskytovatele AI Gateway.",
    "aiProviderSkipTlsVerification": "Přeskočit ověření TLS",
    "aiProviderSkipTlsVerificationDescription": "Zakázat ověření certifikátu TLS pro upstream připojení",
    "aiProviderBudget": "Rozpočet",
@@ -1923,6 +1930,8 @@
    "aiCapabilityOpenaiResponsesDescription": "Podporuje /v1/responses",
    "aiCapabilityAnthropicMessages": "Zprávy Anthropic",
    "aiCapabilityAnthropicMessagesDescription": "Podporuje /v1/messages",
+    "aiCapabilityV1Models": "Seznam modelů",
+    "aiCapabilityV1ModelsDescription": "Podporuje objevování modelů /v1/models",
    "aiCapabilityGeminiGenerateContent": "Generování obsahu Gemini",
    "aiCapabilityGeminiGenerateContentDescription": "Podporuje přímé API Gemini",
    "aiCapabilityBedrockModelInvoke": "Vyvolání modelu Bedrock",
@@ -2593,6 +2602,7 @@
    "createDomainType": "Typ:",
    "createDomainName": "Jméno:",
    "createDomainValue": "Hodnota:",
+    "multiSelectFilterCount": "{count} vybráno",
    "createDomainCnameRecords": "Záznamy CNAME",
    "createDomainARecords": "Záznamy",
    "createDomainRecordNumber": "Nahrát {number}",
@@ -2707,6 +2717,7 @@
    "healthScheme": "Způsob",
    "healthSelectScheme": "Vybrat metodu",
    "healthCheckPortInvalid": "Port musí být mezi 1 a 65535",
+    "healthCheckHostnameInvalid": "Název hostitele nesmí obsahovat mezery",
    "healthCheckPath": "Cesta",
    "healthHostname": "IP / Hostitel",
    "healthPort": "Přístav",
@@ -2990,7 +3001,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Přidejte rozsah CIDR (např. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Nepodařilo se načíst podsítě",
    "remoteExitNodeNetworkingLabelsTitle": "Názvy preferencí",
-    "remoteExitNodeNetworkingLabelsDescription": "Weby s těmito názvy budou nuceny připojit se tímto vzdáleným výstupním uzlem.",
+    "remoteExitNodeNetworkingLabelsDescription": "Stránky s těmito štítky preferují spojení přes tento vzdálený výstupní uzel.",
    "remoteExitNodeNetworkingLabelsButtonText": "Vyberte názvy...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Hledat názvy...",
    "remoteExitNodeNetworkingLabelsLoadError": "Nepodařilo se načíst názvy",
@@ -3548,6 +3559,9 @@
    "sidebarLogsAction": "Záznamy akcí",
    "logRetention": "Zaznamenávání záznamu",
    "logRetentionDescription": "Spravovat, jak dlouho jsou různé typy logů uloženy pro tuto organizaci nebo je zakázat",
+    "logRetentionDisabledWarningTitle": "Zakázáno uchování logů",
+    "logRetentionDisabledWarningDescription": "{logType} nejsou uchovávány pro tuto organizaci, takže nová aktivita se zde neprojeví. Aktivujte uchovávání v nastavení zabezpečení pro zahájení sběru těchto logů.",
+    "logRetentionDisabledWarningButton": "Přejít na nastavení zabezpečení",
    "requestLogsDescription": "Zobrazit podrobné protokoly požadavků pro zdroje v této organizaci",
    "aiSessionLogs": "Protokoly AI Gateway Session",
    "aiSessionLogsDescription": "Zobrazit uložené výzvy a odpovědi na žádosti AI brány v této organizaci",
@@ -4081,6 +4095,8 @@
    "httpDestConnectionLogsDescription": "Události týkající se připojení lokality a tunelu, včetně připojení a odpojení.",
    "httpDestRequestLogsTitle": "Záznamy HTTP požadavků",
    "httpDestRequestLogsDescription": "HTTP záznamy požadavků pro proxy zdroje, včetně metod, cesty a kódu odpovědi.",
+    "httpDestAISessionLogsTitle": "Logy AI sezení",
+    "httpDestAISessionLogsDescription": "Relace požadavků a odpovědí AI gateway, včetně podnětů, odpovědí modelů a využití tokenů.",
    "httpDestSaveChanges": "Uložit změny",
    "httpDestCreateDestination": "Vytvořit cíl",
    "httpDestUpdatedSuccess": "Cíl byl úspěšně aktualizován",
@@ -1176,6 +1176,10 @@
    "idpJmespathAboutDescriptionLink": "Læs mere om JMESPath",
    "idpJmespathLabel": "Identifikatorsti",
    "idpJmespathLabelDescription": "Stien til brugeridentifikatoren i ID-tokenet",
+    "idpIdentifierChangeTitle": "Advarsel om ændring af identifikatorsti",
+    "idpIdentifierChangeDescription": "Du er ved at ændre identifikatorstien. Dette vil påvirke, hvordan eksisterende brugere bliver kortlagt. Brugere, der tidligere har logget ind gennem denne identitetsudbyder, genkendes muligvis ikke længere som de samme brugere.",
+    "idpIdentifierChangeConfirmMessage": "Jeg bekræfter",
+    "idpIdentifierChangeWarningText": "Dette vil påvirke, hvordan eksisterende brugere bliver kortlagt",
    "idpJmespathEmailPathOptional": "E-mailsti (Valgfrit)",
    "idpJmespathEmailPathOptionalDescription": "Stien til brugerens e-mailadresse i ID-tokenet",
    "idpJmespathNamePathOptional": "Navn Sti (Valgfrit)",
@@ -1573,6 +1577,8 @@
    "search": "Søg…",
    "searchPlaceholder": "Søg...",
    "emptySearchOptions": "Ingen valg fundet",
+    "ipFilterSearchPlaceholder": "Indtast en IP-adresse…",
+    "ipFilterEmptyMessage": "Indtast en IP-adresse for at filtrere efter",
    "create": "Opret",
    "orgs": "Organisationer",
    "loginError": "Der opstod en uventet fejl. Prøv venligst igen.",
@@ -1785,7 +1791,7 @@
    "aiClientConfigDescriptionClaude": "Anthropics agentikodningsværktøj til terminalen.",
    "aiClientConfigDescriptionCodex": "OpenAIs agentikodningsværktøj til terminalen.",
    "aiClientConfigDescriptionOpencode": "Open source terminal kodningsagent.",
-    "aiClientConfigDescriptionCursor": "AI-kodeeditor bygget på VS Code.",
+    "aiClientConfigDescriptionGemini": "Googles agentiske kodningsværktøj til terminalen.",
    "aiClientConfigSetup": "Opsætning",
    "aiClientConfigTabCli": "Automatisk (CLI)",
    "aiClientConfigTabManual": "Manuel Konfiguration",
@@ -1891,6 +1897,7 @@
    "aiProviderRoutingModeTargetDescription": "Rute gennem mål på dine steder",
    "aiProviderRoutingModeTargetNote": "Efter oprettelse af denne udbyder, konfigurer mål på Netværksindstillinger fanen.",
    "aiProviderTargetNoOne": "Denne udbyder har ingen mål. Tilføj et mål for at rute forespørgsler gennem dine steder.",
+    "aiProviderRemoteNodeTargetsWarning": "Websteder, der er forbundet til eksterne noder, kan ikke tilgås for at blive dirigeret til via AI Gateway-udbydere.",
    "aiProviderSkipTlsVerification": "Spring TLS-verifikation over",
    "aiProviderSkipTlsVerificationDescription": "Deaktiver TLS-certifikat verifikation for opstrømsforbindelsen",
    "aiProviderBudget": "Budget",
@@ -1923,6 +1930,8 @@
    "aiCapabilityOpenaiResponsesDescription": "Understøtter /v1/responses",
    "aiCapabilityAnthropicMessages": "Anthropic Beskeder",
    "aiCapabilityAnthropicMessagesDescription": "Understøtter /v1/messages",
+    "aiCapabilityV1Models": "Model Liste",
+    "aiCapabilityV1ModelsDescription": "Understøtter opdagelse af /v1/models modeller",
    "aiCapabilityGeminiGenerateContent": "Gemini Generer Indhold",
    "aiCapabilityGeminiGenerateContentDescription": "Understøtter den direkte Gemini API",
    "aiCapabilityBedrockModelInvoke": "Bedrock Modeller Invoker",
@@ -2593,6 +2602,7 @@
    "createDomainType": "Type:",
    "createDomainName": "Navn:",
    "createDomainValue": "Værdi:",
+    "multiSelectFilterCount": "{count} valgt",
    "createDomainCnameRecords": "CNAME-poster",
    "createDomainARecords": "A-poster",
    "createDomainRecordNumber": "Post {number}",
@@ -2707,6 +2717,7 @@
    "healthScheme": "Metode",
    "healthSelectScheme": "Vælg metode",
    "healthCheckPortInvalid": "Porten skal være mellem 1 og 65535",
+    "healthCheckHostnameInvalid": "Værtsnavnet må ikke indeholde mellemrum",
    "healthCheckPath": "Sti",
    "healthHostname": "IP / Vært",
    "healthPort": "Port",
@@ -2990,7 +3001,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Tilføj et CIDR-område (f.eks. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Kunne ikke indlæse subnets",
    "remoteExitNodeNetworkingLabelsTitle": "Præference Etiketter",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites med disse etiketter vil blive tvunget til at oprette forbindelse gennem denne fjerne exit-node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Sider med disse etiketter vil foretrække at forbinde gennem denne fjernudgarnknude.",
    "remoteExitNodeNetworkingLabelsButtonText": "Vælg etiketter...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Søg efter etiketter...",
    "remoteExitNodeNetworkingLabelsLoadError": "Kunne ikke indlæse etiketter",
@@ -3548,6 +3559,9 @@
    "sidebarLogsAction": "Handlingsloger",
    "logRetention": "Logopbevaring",
    "logRetentionDescription": "Håndter hvor længe ulike typer logs beholdes for denne organisation, eller deaktivér dem",
+    "logRetentionDisabledWarningTitle": "Logbevaring deaktiveret",
+    "logRetentionDisabledWarningDescription": "{logType} gemmes ikke for denne organisation, så nye aktiviteter vises ikke her. Aktiver logbevaring i sikkerhedsindstillingerne for at begynde at indsamle disse logs.",
+    "logRetentionDisabledWarningButton": "Gå til sikkerhedsindstillinger",
    "requestLogsDescription": "Se detaljerede forespørgselslogs for ressourcer i denne organisation",
    "aiSessionLogs": "AI Gateway Øktsprotokoller",
    "aiSessionLogsDescription": "Se prompt og svarudskrifter for AI gateway forespørgsler i denne organisation",
@@ -4081,6 +4095,8 @@
    "httpDestConnectionLogsDescription": "Udstyrs- og tunnelforbindelseshændelser, inklusive forbindelser og frakobling.",
    "httpDestRequestLogsTitle": "HTTP-forespørgselslogs",
    "httpDestRequestLogsDescription": "HTTP-forespørgsel logs for bekræftede ressourcer, inklusive metode, sti og responskode.",
+    "httpDestAISessionLogsTitle": "AI-session Logs",
+    "httpDestAISessionLogsDescription": "AI-gateway anmodninger og respons-sessioner, inklusive prompts, modelresponser og tokenforbrug.",
    "httpDestSaveChanges": "Gem ændringer",
    "httpDestCreateDestination": "Opret mål",
    "httpDestUpdatedSuccess": "Målet er opdateret",
@@ -1176,6 +1176,10 @@
    "idpJmespathAboutDescriptionLink": "Mehr über JMESPath erfahren",
    "idpJmespathLabel": "Identifikationspfad",
    "idpJmespathLabelDescription": "Der JMESPath zum Benutzeridentifikator im ID-Token",
+    "idpIdentifierChangeTitle": "Warnung zur Änderung des Identifikatorpfads",
+    "idpIdentifierChangeDescription": "Sie stehen kurz davor, den Identifikatorpfad zu ändern. Dies wird beeinflussen, wie bestehende Benutzer zugeordnet werden. Benutzer, die sich zuvor über diesen Identitätsanbieter angemeldet haben, werden möglicherweise nicht mehr als dieselben Benutzer erkannt.",
+    "idpIdentifierChangeConfirmMessage": "Ich bestätige",
+    "idpIdentifierChangeWarningText": "Dies wird beeinflussen, wie bestehende Benutzer zugeordnet werden",
    "idpJmespathEmailPathOptional": "E-Mail-Pfad (Optional)",
    "idpJmespathEmailPathOptionalDescription": "Der JMESPath zur E-Mail-Adresse des Benutzers im ID-Token",
    "idpJmespathNamePathOptional": "Namenspfad (Optional)",
@@ -1573,6 +1577,8 @@
    "search": "Suche…",
    "searchPlaceholder": "Suche...",
    "emptySearchOptions": "Keine Optionen gefunden",
+    "ipFilterSearchPlaceholder": "Geben Sie eine IP-Adresse ein…",
+    "ipFilterEmptyMessage": "Geben Sie eine IP-Adresse zur Filterung ein",
    "create": "Erstellen",
    "orgs": "Organisationen",
    "loginError": "Ein unerwarteter Fehler ist aufgetreten. Bitte versuchen Sie es erneut.",
@@ -1785,7 +1791,7 @@
    "aiClientConfigDescriptionClaude": "Agentisches Codierwerkzeug von Anthropic für das Terminal.",
    "aiClientConfigDescriptionCodex": "Agentisches Codierwerkzeug von OpenAI für das Terminal.",
    "aiClientConfigDescriptionOpencode": "Open-Source-Coding-Agent für das Terminal.",
-    "aiClientConfigDescriptionCursor": "KI-Code-Editor basierend auf VS Code.",
+    "aiClientConfigDescriptionGemini": "Googles agentic Coding-Tool für das Terminal.",
    "aiClientConfigSetup": "Einrichtung",
    "aiClientConfigTabCli": "Automatisch (CLI)",
    "aiClientConfigTabManual": "Manuelle Konfiguration",
@@ -1891,6 +1897,7 @@
    "aiProviderRoutingModeTargetDescription": "Über Ziele auf Ihren Sites routen",
    "aiProviderRoutingModeTargetNote": "Konfigurieren Sie nach der Erstellung dieses Anbieters Site-Ziele auf der Registerkarte 'Netzwerkeinstellungen'.",
    "aiProviderTargetNoOne": "Dieser Anbieter hat keine Ziele. Fügen Sie ein Ziel hinzu, um Anfragen über Ihre Sites zu leiten.",
+    "aiProviderRemoteNodeTargetsWarning": "Sites, die mit entfernten Knoten verbunden sind, können bei AI-Gateway-Anbietern nicht weitergeleitet werden.",
    "aiProviderSkipTlsVerification": "TLS-Überprüfung überspringen",
    "aiProviderSkipTlsVerificationDescription": "TLS-Zertifikatsüberprüfung für die Upstream-Verbindung deaktivieren",
    "aiProviderBudget": "Budget",
@@ -1923,6 +1930,8 @@
    "aiCapabilityOpenaiResponsesDescription": "Unterstützt /v1/antworten",
    "aiCapabilityAnthropicMessages": "Anthropic Nachrichten",
    "aiCapabilityAnthropicMessagesDescription": "Unterstützt /v1/nachrichten",
+    "aiCapabilityV1Models": "Modellliste",
+    "aiCapabilityV1ModelsDescription": "Unterstützt /v1/models Modellentdeckung",
    "aiCapabilityGeminiGenerateContent": "Gemini Inhalt erzeugen",
    "aiCapabilityGeminiGenerateContentDescription": "Unterstützt die direkte Gemini-API",
    "aiCapabilityBedrockModelInvoke": "Bedrock Modell Aufruf",
@@ -2593,6 +2602,7 @@
    "createDomainType": "Typ:",
    "createDomainName": "Name:",
    "createDomainValue": "Wert:",
+    "multiSelectFilterCount": "{count} ausgewählt",
    "createDomainCnameRecords": "CNAME-Einträge",
    "createDomainARecords": "A-Aufzeichnungen",
    "createDomainRecordNumber": "Eintrag {number}",
@@ -2707,6 +2717,7 @@
    "healthScheme": "Methode",
    "healthSelectScheme": "Methode auswählen",
    "healthCheckPortInvalid": "Der Port muss zwischen 1 und 65535 liegen",
+    "healthCheckHostnameInvalid": "Der Hostname darf keinen Leerraum enthalten",
    "healthCheckPath": "Pfad",
    "healthHostname": "IP / Host",
    "healthPort": "Port",
@@ -2990,7 +3001,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Fügen Sie einen CIDR-Bereich hinzu (z.B. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Fehler beim Laden der Subnetze",
    "remoteExitNodeNetworkingLabelsTitle": "Präferenzetiketten",
-    "remoteExitNodeNetworkingLabelsDescription": "Standorte mit diesen Etiketten werden gezwungen, über diesen Remote Exit Node zu verbinden.",
+    "remoteExitNodeNetworkingLabelsDescription": "Standorte mit diesen Labels bevorzugen die Verbindung über diesen Remote-Exit-Knoten.",
    "remoteExitNodeNetworkingLabelsButtonText": "Etiketten auswählen...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Etiketten suchen...",
    "remoteExitNodeNetworkingLabelsLoadError": "Fehler beim Laden der Etiketten",
@@ -3548,6 +3559,9 @@
    "sidebarLogsAction": "Aktionsprotokolle",
    "logRetention": "Log-Speicherung",
    "logRetentionDescription": "Verwalten, wie lange verschiedene Logs für diese Organisation gespeichert werden oder deaktivieren",
+    "logRetentionDisabledWarningTitle": "Protokoll-Aufbewahrung deaktiviert",
+    "logRetentionDisabledWarningDescription": "{logType} werden für diese Organisation nicht aufbewahrt, daher erscheinen neue Aktivitäten hier nicht. Aktivieren Sie die Aufbewahrung in den Sicherheitseinstellungen, um diese Protokolle zu sammeln.",
+    "logRetentionDisabledWarningButton": "Zu den Sicherheitseinstellungen gehen",
    "requestLogsDescription": "Detaillierte Request-Logs für Ressourcen in dieser Organisation anzeigen",
    "aiSessionLogs": "AI-Gateway Sitzungsprotokolle",
    "aiSessionLogsDescription": "Zeigen Sie Aufforderungs- und Antwortprotokolle für Anfragen des KI-Gateways in dieser Organisation an",
@@ -4081,6 +4095,8 @@
    "httpDestConnectionLogsDescription": "Site- und Tunnelverbindungen, einschließlich Verbindungen und Trennungen.",
    "httpDestRequestLogsTitle": "HTTP Anforderungsprotokolle",
    "httpDestRequestLogsDescription": "HTTP-Request-Protokolle für proxiierte Ressourcen, einschließlich Methode, Pfad und Antwort-Code.",
+    "httpDestAISessionLogsTitle": "AI-Sitzungsprotokolle",
+    "httpDestAISessionLogsDescription": "AI-Gateway-Anfrage- und Antwortsitzungen, einschließlich Eingabeaufforderungen, Modellantworten und Token-Nutzung.",
    "httpDestSaveChanges": "Änderungen speichern",
    "httpDestCreateDestination": "Ziel erstellen",
    "httpDestUpdatedSuccess": "Ziel erfolgreich aktualisiert",
@@ -1176,6 +1176,10 @@
    "idpJmespathAboutDescriptionLink": "Learn more about JMESPath",
    "idpJmespathLabel": "Identifier Path",
    "idpJmespathLabelDescription": "The path to the user identifier in the ID token",
+    "idpIdentifierChangeTitle": "Identifier Path Change Warning",
+    "idpIdentifierChangeDescription": "You are about to change the identifier path. This will affect how existing users are mapped. Users who previously signed in through this identity provider may no longer be recognized as the same users.",
+    "idpIdentifierChangeConfirmMessage": "I confirm",
+    "idpIdentifierChangeWarningText": "This will affect how existing users are mapped",
    "idpJmespathEmailPathOptional": "Email Path (Optional)",
    "idpJmespathEmailPathOptionalDescription": "The path to the user's email in the ID token",
    "idpJmespathNamePathOptional": "Name Path (Optional)",
@@ -1573,6 +1577,8 @@
    "search": "Search…",
    "searchPlaceholder": "Search...",
    "emptySearchOptions": "No options found",
+    "ipFilterSearchPlaceholder": "Enter an IP address…",
+    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Create",
    "orgs": "Organizations",
    "loginError": "An unexpected error occurred. Please try again.",
@@ -1785,6 +1791,7 @@
    "aiClientConfigDescriptionClaude": "Anthropic's agentic coding tool for the terminal.",
    "aiClientConfigDescriptionCodex": "OpenAI's agentic coding tool for the terminal.",
    "aiClientConfigDescriptionOpencode": "Open source terminal coding agent.",
+    "aiClientConfigDescriptionGemini": "Google's agentic coding tool for the terminal.",
    "aiClientConfigSetup": "Setup",
    "aiClientConfigTabCli": "Automatic (CLI)",
    "aiClientConfigTabManual": "Manual Configuration",
@@ -1890,6 +1897,7 @@
    "aiProviderRoutingModeTargetDescription": "Route through targets on your sites",
    "aiProviderRoutingModeTargetNote": "After creating this provider, configure site targets on the Network Settings tab.",
    "aiProviderTargetNoOne": "This provider doesn't have any targets. Add a target to route requests through your sites.",
+    "aiProviderRemoteNodeTargetsWarning": "Sites connected to remote nodes are inaccessable to be routed to on AI Gateway providers.",
    "aiProviderSkipTlsVerification": "Skip TLS Verification",
    "aiProviderSkipTlsVerificationDescription": "Disable TLS certificate verification for the upstream connection",
    "aiProviderBudget": "Budget",
@@ -1922,6 +1930,8 @@
    "aiCapabilityOpenaiResponsesDescription": "Supports /v1/responses",
    "aiCapabilityAnthropicMessages": "Anthropic Messages",
    "aiCapabilityAnthropicMessagesDescription": "Supports /v1/messages",
+    "aiCapabilityV1Models": "Models List",
+    "aiCapabilityV1ModelsDescription": "Supports /v1/models model discovery",
    "aiCapabilityGeminiGenerateContent": "Gemini Generate Content",
    "aiCapabilityGeminiGenerateContentDescription": "Supports the direct Gemini API",
    "aiCapabilityBedrockModelInvoke": "Bedrock Model Invoke",
@@ -2592,6 +2602,7 @@
    "createDomainType": "Type:",
    "createDomainName": "Name:",
    "createDomainValue": "Value:",
+    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "CNAME Records",
    "createDomainARecords": "A Records",
    "createDomainRecordNumber": "Record {number}",
@@ -2706,6 +2717,7 @@
    "healthScheme": "Method",
    "healthSelectScheme": "Select Method",
    "healthCheckPortInvalid": "Port must be between 1 and 65535",
+    "healthCheckHostnameInvalid": "Hostname must not contain whitespace",
    "healthCheckPath": "Path",
    "healthHostname": "IP / Host",
    "healthPort": "Port",
@@ -2989,7 +3001,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Add a CIDR range (e.g. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Failed to load subnets",
    "remoteExitNodeNetworkingLabelsTitle": "Preference Labels",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will be enforced to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
    "remoteExitNodeNetworkingLabelsButtonText": "Select labels...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Search labels...",
    "remoteExitNodeNetworkingLabelsLoadError": "Failed to load labels",
@@ -4083,6 +4095,8 @@
    "httpDestConnectionLogsDescription": "Site and tunnel connection events, including connects and disconnects.",
    "httpDestRequestLogsTitle": "HTTP Request Logs",
    "httpDestRequestLogsDescription": "HTTP request logs for proxied resources, including method, path, and response code.",
+    "httpDestAISessionLogsTitle": "AI Session Logs",
+    "httpDestAISessionLogsDescription": "AI gateway request and response sessions, including prompts, model responses, and token usage.",
    "httpDestSaveChanges": "Save Changes",
    "httpDestCreateDestination": "Create Destination",
    "httpDestUpdatedSuccess": "Destination updated successfully",
@@ -1176,6 +1176,10 @@
    "idpJmespathAboutDescriptionLink": "Más información sobre JMESPath",
    "idpJmespathLabel": "Ruta del identificador",
    "idpJmespathLabelDescription": "La ruta al identificador de usuario en el token de ID",
+    "idpIdentifierChangeTitle": "Advertencia de Cambio de Ruta de Identificador",
+    "idpIdentifierChangeDescription": "Está a punto de cambiar la ruta del identificador. Esto afectará cómo se asignan los usuarios existentes. Los usuarios que anteriormente iniciaron sesión a través de este proveedor de identidad pueden ya no ser reconocidos como los mismos usuarios.",
+    "idpIdentifierChangeConfirmMessage": "Confirmo",
+    "idpIdentifierChangeWarningText": "Esto afectará cómo se asignan los usuarios existentes",
    "idpJmespathEmailPathOptional": "Ruta de correo (opcional)",
    "idpJmespathEmailPathOptionalDescription": "La ruta al correo electrónico del usuario en el token de ID",
    "idpJmespathNamePathOptional": "Ruta del nombre (opcional)",
@@ -1573,6 +1577,8 @@
    "search": "Buscar…",
    "searchPlaceholder": "Buscar...",
    "emptySearchOptions": "No se encontraron opciones",
+    "ipFilterSearchPlaceholder": "Introduzca una dirección IP…",
+    "ipFilterEmptyMessage": "Introduzca una dirección IP para filtrar por",
    "create": "Crear",
    "orgs": "Organizaciones",
    "loginError": "Ocurrió un error inesperado. Por favor, inténtelo de nuevo.",
@@ -1785,7 +1791,7 @@
    "aiClientConfigDescriptionClaude": "Herramienta de codificación agentic de Anthropic para el terminal.",
    "aiClientConfigDescriptionCodex": "Herramienta de codificación agentic de OpenAI para el terminal.",
    "aiClientConfigDescriptionOpencode": "Agente de codificación de terminal de código abierto.",
-    "aiClientConfigDescriptionCursor": "Editor de código AI construido sobre VS Code.",
+    "aiClientConfigDescriptionGemini": "La herramienta de codificación de agente de Google para el terminal.",
    "aiClientConfigSetup": "Configuración",
    "aiClientConfigTabCli": "Automático (CLI)",
    "aiClientConfigTabManual": "Configuración manual",
@@ -1891,6 +1897,7 @@
    "aiProviderRoutingModeTargetDescription": "Ruta a través de objetivos en sus sitios",
    "aiProviderRoutingModeTargetNote": "Después de crear este proveedor, configure objetivos de sitio en la pestaña de Configuración de Red.",
    "aiProviderTargetNoOne": "Este proveedor no tiene objetivos. Agregue un objetivo para enrutar solicitudes a través de sus sitios.",
+    "aiProviderRemoteNodeTargetsWarning": "Los sitios conectados a nodos remotos son inaccesibles para ser enrutados a los proveedores de AI Gateway.",
    "aiProviderSkipTlsVerification": "Omitir verificación de TLS",
    "aiProviderSkipTlsVerificationDescription": "Deshabilitar la verificación del certificado TLS para la conexión de upstream",
    "aiProviderBudget": "Presupuesto",
@@ -1923,6 +1930,8 @@
    "aiCapabilityOpenaiResponsesDescription": "Admite /v1/responses",
    "aiCapabilityAnthropicMessages": "Mensajes Antropicos",
    "aiCapabilityAnthropicMessagesDescription": "Admite /v1/messages",
+    "aiCapabilityV1Models": "Lista de Modelos",
+    "aiCapabilityV1ModelsDescription": "Soporta el descubrimiento de modelos /v1/models",
    "aiCapabilityGeminiGenerateContent": "Generar contenido Gemini",
    "aiCapabilityGeminiGenerateContentDescription": "Admite la API directa de Gemini",
    "aiCapabilityBedrockModelInvoke": "Invocar modelo de Bedrock",
@@ -2593,6 +2602,7 @@
    "createDomainType": "Tipo:",
    "createDomainName": "Nombre:",
    "createDomainValue": "Valor:",
+    "multiSelectFilterCount": "{count} seleccionado",
    "createDomainCnameRecords": "Registros CNAME",
    "createDomainARecords": "Registros A",
    "createDomainRecordNumber": "Registro {number}",
@@ -2707,6 +2717,7 @@
    "healthScheme": "Método",
    "healthSelectScheme": "Seleccionar método",
    "healthCheckPortInvalid": "El puerto debe estar entre 1 y 65535",
+    "healthCheckHostnameInvalid": "El nombre de host no debe contener espacios en blanco",
    "healthCheckPath": "Ruta",
    "healthHostname": "IP / Nombre del host",
    "healthPort": "Puerto",
@@ -2990,7 +3001,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Añadir un rango CIDR (e.g. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Error al cargar las subredes",
    "remoteExitNodeNetworkingLabelsTitle": "Etiquetas de Preferencias",
-    "remoteExitNodeNetworkingLabelsDescription": "Los sitios con estas etiquetas se verán obligados a conectarse a través de este nodo de salida remoto.",
+    "remoteExitNodeNetworkingLabelsDescription": "Los sitios con estas etiquetas preferirán conectarse a través de este nodo de salida remoto.",
    "remoteExitNodeNetworkingLabelsButtonText": "Seleccionar etiquetas...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Buscar etiquetas...",
    "remoteExitNodeNetworkingLabelsLoadError": "Error al cargar las etiquetas",
@@ -3548,6 +3559,9 @@
    "sidebarLogsAction": "Registros de acción",
    "logRetention": "Retención de Log",
    "logRetentionDescription": "Administrar cuánto tiempo se conservan los diferentes tipos de registros para esta organización o desactivarlos",
+    "logRetentionDisabledWarningTitle": "Retención de Registros Deshabilitada",
+    "logRetentionDisabledWarningDescription": "{logType} no se están reteniendo para esta organización, por lo que la nueva actividad no aparecerá aquí. Habilita la retención en la configuración de seguridad para comenzar a recopilar estos registros.",
+    "logRetentionDisabledWarningButton": "Ir a Configuración de Seguridad",
    "requestLogsDescription": "Ver registros de solicitudes detallados para los recursos de esta organización",
    "aiSessionLogs": "Registros de Sesiones del Portal de IA",
    "aiSessionLogsDescription": "Ver transcripciones de solicitud y respuesta para solicitudes del portal de IA en esta organización",
@@ -4081,6 +4095,8 @@
    "httpDestConnectionLogsDescription": "Eventos de conexión de sitios y túneles, incluyendo conexiones y desconexiones.",
    "httpDestRequestLogsTitle": "Registros de Solicitud HTTP",
    "httpDestRequestLogsDescription": "Registros de peticiones HTTP para recursos proxyficados, incluyendo método, ruta y código de respuesta.",
+    "httpDestAISessionLogsTitle": "Registros de Sesión AI",
+    "httpDestAISessionLogsDescription": "Sesiones de solicitud y respuesta de AI gateway, incluyendo indicaciones, respuestas de modelos, y uso de tokens.",
    "httpDestSaveChanges": "Guardar Cambios",
    "httpDestCreateDestination": "Crear destino",
    "httpDestUpdatedSuccess": "Destino actualizado correctamente",
@@ -1176,6 +1176,10 @@
    "idpJmespathAboutDescriptionLink": "En savoir plus sur JMESPath",
    "idpJmespathLabel": "Chemin d'identification",
    "idpJmespathLabelDescription": "Le JMESPath vers l'identifiant de l'utilisateur dans le jeton ID",
+    "idpIdentifierChangeTitle": "Avertissement de changement de chemin d'identification",
+    "idpIdentifierChangeDescription": "Vous êtes sur le point de modifier le chemin d'identification. Cela affectera la manière dont les utilisateurs existants sont mappés. Les utilisateurs qui se sont connectés via ce fournisseur d'identité peuvent ne plus être reconnus comme les mêmes utilisateurs.",
+    "idpIdentifierChangeConfirmMessage": "Je confirme",
+    "idpIdentifierChangeWarningText": "Cela affectera la manière dont les utilisateurs existants sont mappés",
    "idpJmespathEmailPathOptional": "Chemin de l'email (Optionnel)",
    "idpJmespathEmailPathOptionalDescription": "Le JMESPath vers l'email de l'utilisateur dans le jeton ID",
    "idpJmespathNamePathOptional": "Chemin du nom (Optionnel)",
@@ -1573,6 +1577,8 @@
    "search": "Rechercher…",
    "searchPlaceholder": "Recherche...",
    "emptySearchOptions": "Aucune option trouvée",
+    "ipFilterSearchPlaceholder": "Entrez une adresse IP…",
+    "ipFilterEmptyMessage": "Entrez une adresse IP pour filtrer",
    "create": "Créer",
    "orgs": "Organisations",
    "loginError": "Une erreur inattendue s'est produite. Veuillez réessayer.",
@@ -1785,7 +1791,7 @@
    "aiClientConfigDescriptionClaude": "Outil de codage agentique d'Anthropic pour le terminal.",
    "aiClientConfigDescriptionCodex": "Outil de codage agentique d'OpenAI pour le terminal.",
    "aiClientConfigDescriptionOpencode": "Agent de codage terminal open source.",
-    "aiClientConfigDescriptionCursor": "Éditeur de code IA basé sur VS Code.",
+    "aiClientConfigDescriptionGemini": "Outil de codage agentique de Google pour le terminal.",
    "aiClientConfigSetup": "Configuration",
    "aiClientConfigTabCli": "Automatique (CLI)",
    "aiClientConfigTabManual": "Configuration manuelle",
@@ -1891,6 +1897,7 @@
    "aiProviderRoutingModeTargetDescription": "Route à travers les cibles sur vos sites",
    "aiProviderRoutingModeTargetNote": "Après avoir créé ce fournisseur, configurez les cibles du site dans l'onglet Paramètres du réseau.",
    "aiProviderTargetNoOne": "Ce fournisseur n'a aucune cible. Ajoutez une cible pour acheminer les requêtes via vos sites.",
+    "aiProviderRemoteNodeTargetsWarning": "Les sites connectés à des nœuds distants sont inaccessibles pour être routés vers les fournisseurs de passerelles AI.",
    "aiProviderSkipTlsVerification": "Ignorer la vérification TLS",
    "aiProviderSkipTlsVerificationDescription": "Désactiver la vérification du certificat TLS pour la connexion amont",
    "aiProviderBudget": "Budget",
@@ -1923,6 +1930,8 @@
    "aiCapabilityOpenaiResponsesDescription": "Prend en charge /v1/responses",
    "aiCapabilityAnthropicMessages": "Messages Anthropiques",
    "aiCapabilityAnthropicMessagesDescription": "Prend en charge /v1/messages",
+    "aiCapabilityV1Models": "Liste des modèles",
+    "aiCapabilityV1ModelsDescription": "Prise en charge de la découverte de modèles /v1/models",
    "aiCapabilityGeminiGenerateContent": "Générer du Contenu Gemini",
    "aiCapabilityGeminiGenerateContentDescription": "Prend en charge l'API directe de Gemini",
    "aiCapabilityBedrockModelInvoke": "Invocation du Modèle Bedrock",
@@ -2593,6 +2602,7 @@
    "createDomainType": "Type :",
    "createDomainName": "Nom :",
    "createDomainValue": "Valeur :",
+    "multiSelectFilterCount": "{count} sélectionné",
    "createDomainCnameRecords": "Enregistrements CNAME",
    "createDomainARecords": "Enregistrements A",
    "createDomainRecordNumber": "Enregistrement {number}",
@@ -2707,6 +2717,7 @@
    "healthScheme": "Méthode",
    "healthSelectScheme": "Sélectionnez la méthode",
    "healthCheckPortInvalid": "Le port doit être compris entre 1 et 65535",
+    "healthCheckHostnameInvalid": "Le nom d'hôte ne doit pas contenir d'espaces blancs",
    "healthCheckPath": "Chemin d'accès",
    "healthHostname": "IP / Hôte",
    "healthPort": "Port",
@@ -2990,7 +3001,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Ajouter une plage CIDR (par exemple 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Échec du chargement des sous-réseaux",
    "remoteExitNodeNetworkingLabelsTitle": "Étiquettes de préférences",
-    "remoteExitNodeNetworkingLabelsDescription": "Les sites avec ces étiquettes devront se connecter via ce nœud de sortie distant.",
+    "remoteExitNodeNetworkingLabelsDescription": "Les sites dotés de ces étiquettes préféreront se connecter via ce nœud de sortie distant.",
    "remoteExitNodeNetworkingLabelsButtonText": "Sélectionner des étiquettes...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Chercher des étiquettes...",
    "remoteExitNodeNetworkingLabelsLoadError": "Échec du chargement des étiquettes",
@@ -3548,6 +3559,9 @@
    "sidebarLogsAction": "Journaux des actions",
    "logRetention": "Journaliser la rétention",
    "logRetentionDescription": "Gérer la durée de conservation des différents types de logs pour cette organisation ou les désactiver",
+    "logRetentionDisabledWarningTitle": "Conservation des journaux désactivée",
+    "logRetentionDisabledWarningDescription": "{logType} ne sont pas conservés pour cette organisation, donc aucune nouvelle activité n’apparaîtra ici. Activez la conservation dans les paramètres de sécurité pour commencer à collecter ces journaux.",
+    "logRetentionDisabledWarningButton": "Aller aux paramètres de sécurité",
    "requestLogsDescription": "Voir les journaux détaillés des requêtes pour les ressources de cette organisation",
    "aiSessionLogs": "Journaux de Session du Portail AI",
    "aiSessionLogsDescription": "Voir les transcriptions de l'invite et de la réponse pour les requêtes de portail AI dans cette organisation",
@@ -4081,6 +4095,8 @@
    "httpDestConnectionLogsDescription": "Événements de connexion du site et du tunnel, y compris les connexions et les déconnexions.",
    "httpDestRequestLogsTitle": "Journal des Requêtes HTTP",
    "httpDestRequestLogsDescription": "Journaux des requêtes HTTP pour les ressources proxiées, y compris la méthode, le chemin et le code de réponse.",
+    "httpDestAISessionLogsTitle": "Journaux de session AI",
+    "httpDestAISessionLogsDescription": "Sessions de requête et de réponse de la passerelle AI, y compris les invites, les réponses du modèle et l'utilisation des jetons.",
    "httpDestSaveChanges": "Enregistrer les modifications",
    "httpDestCreateDestination": "Créer une destination",
    "httpDestUpdatedSuccess": "Destination mise à jour avec succès",
@@ -1176,6 +1176,10 @@
    "idpJmespathAboutDescriptionLink": "Scopri di più su JMESPath",
    "idpJmespathLabel": "Percorso Identificativo",
    "idpJmespathLabelDescription": "Il JMESPath per l'identificatore dell'utente nel token ID",
+    "idpIdentifierChangeTitle": "Avviso di cambio percorso identificatore",
+    "idpIdentifierChangeDescription": "Stai per cambiare il percorso identificativo. Questo influirà su come gli utenti esistenti sono mappati. Gli utenti che in precedenza hanno effettuato l'accesso attraverso questo provider di identità potrebbero non essere più riconosciuti come gli stessi utenti.",
+    "idpIdentifierChangeConfirmMessage": "Confermo",
+    "idpIdentifierChangeWarningText": "Questo influirà su come gli utenti esistenti sono mappati",
    "idpJmespathEmailPathOptional": "Percorso Email (Opzionale)",
    "idpJmespathEmailPathOptionalDescription": "Il JMESPath per l'email dell'utente nel token ID",
    "idpJmespathNamePathOptional": "Percorso Nome (Opzionale)",
@@ -1573,6 +1577,8 @@
    "search": "Cerca…",
    "searchPlaceholder": "Cerca...",
    "emptySearchOptions": "Nessuna opzione trovata",
+    "ipFilterSearchPlaceholder": "Inserisci un indirizzo IP…",
+    "ipFilterEmptyMessage": "Inserisci un indirizzo IP per filtrare",
    "create": "Crea",
    "orgs": "Organizzazioni",
    "loginError": "Si è verificato un errore imprevisto. Riprova.",
@@ -1785,7 +1791,7 @@
    "aiClientConfigDescriptionClaude": "Strumento di coding agente di Anthropic per il terminale.",
    "aiClientConfigDescriptionCodex": "Strumento di coding agente di OpenAI per il terminale.",
    "aiClientConfigDescriptionOpencode": "Agente di coding open source per il terminale.",
-    "aiClientConfigDescriptionCursor": "Editor di codice AI basato su VS Code.",
+    "aiClientConfigDescriptionGemini": "Lo strumento di codifica agentica di Google per il terminale.",
    "aiClientConfigSetup": "Impostazione",
    "aiClientConfigTabCli": "Automatico (CLI)",
    "aiClientConfigTabManual": "Configurazione Manuale",
@@ -1891,6 +1897,7 @@
    "aiProviderRoutingModeTargetDescription": "Instrada tramite target sui tuoi siti",
    "aiProviderRoutingModeTargetNote": "Dopo aver creato questo provider, configura i target del sito nella scheda Impostazioni di Rete.",
    "aiProviderTargetNoOne": "Questo provider non ha alcun target. Aggiungi un target per instradare le richieste attraverso i tuoi siti.",
+    "aiProviderRemoteNodeTargetsWarning": "I siti collegati a nodi remoti non sono accessibili per essere instradati sui fornitori di AI Gateway.",
    "aiProviderSkipTlsVerification": "Salta la verifica TLS",
    "aiProviderSkipTlsVerificationDescription": "Disabilita la verifica del certificato TLS per la connessione a monte",
    "aiProviderBudget": "Budget",
@@ -1923,6 +1930,8 @@
    "aiCapabilityOpenaiResponsesDescription": "Supporta /v1/responses",
    "aiCapabilityAnthropicMessages": "Messaggi Anthropic",
    "aiCapabilityAnthropicMessagesDescription": "Supporta /v1/messages",
+    "aiCapabilityV1Models": "Elenco dei Modelli",
+    "aiCapabilityV1ModelsDescription": "Supporta la scoperta del modello /v1/models",
    "aiCapabilityGeminiGenerateContent": "Generazione di Contenuti Gemini",
    "aiCapabilityGeminiGenerateContentDescription": "Supporta l'API diretta di Gemini",
    "aiCapabilityBedrockModelInvoke": "Invoca Modello Bedrock",
@@ -2593,6 +2602,7 @@
    "createDomainType": "Tipo:",
    "createDomainName": "Nome:",
    "createDomainValue": "Valore:",
+    "multiSelectFilterCount": "{count} selezionato",
    "createDomainCnameRecords": "Record CNAME",
    "createDomainARecords": "Record A",
    "createDomainRecordNumber": "Record {number}",
@@ -2707,6 +2717,7 @@
    "healthScheme": "Metodo",
    "healthSelectScheme": "Seleziona Metodo",
    "healthCheckPortInvalid": "La porta deve essere compresa tra 1 e 65535",
+    "healthCheckHostnameInvalid": "Il nome dell'host non deve contenere spazi",
    "healthCheckPath": "Percorso",
    "healthHostname": "IP / Nome host",
    "healthPort": "Porta",
@@ -2990,7 +3001,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Aggiungi un intervallo CIDR (ad esempio 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Caricamento sottoreti fallito",
    "remoteExitNodeNetworkingLabelsTitle": "Etichette Preferenze",
-    "remoteExitNodeNetworkingLabelsDescription": "I siti con queste etichette saranno collegati attraverso questo nodo di uscita remoto.",
+    "remoteExitNodeNetworkingLabelsDescription": "I siti con queste etichette preferiranno connettersi tramite questo nodo di uscita remoto.",
    "remoteExitNodeNetworkingLabelsButtonText": "Seleziona etichette...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Cerca etichette...",
    "remoteExitNodeNetworkingLabelsLoadError": "Caricamento etichette fallito",
@@ -3548,6 +3559,9 @@
    "sidebarLogsAction": "Log Azioni",
    "logRetention": "Ritenzione Registro",
    "logRetentionDescription": "Gestisci per quanto tempo i diversi tipi di log sono mantenuti per questa organizzazione o disabilitali",
+    "logRetentionDisabledWarningTitle": "Conservazione del Log Disabilitata",
+    "logRetentionDisabledWarningDescription": "{logType} non vengono conservati per questa organizzazione, quindi le nuove attività non appariranno qui. Abilita la conservazione nelle impostazioni di sicurezza per iniziare a raccogliere questi log.",
+    "logRetentionDisabledWarningButton": "Vai alle Impostazioni di Sicurezza",
    "requestLogsDescription": "Visualizza i registri di richiesta dettagliati per le risorse in questa organizzazione",
    "aiSessionLogs": "Log delle Sessioni AI Gateway",
    "aiSessionLogsDescription": "Visualizza trascrizioni di prompt e risposte per le richieste del gateway AI in questa organizzazione",
@@ -4081,6 +4095,8 @@
    "httpDestConnectionLogsDescription": "Eventi di connessione al sito e al tunnel, inclusi collegamenti e disconnessioni.",
    "httpDestRequestLogsTitle": "Log Richieste HTTP",
    "httpDestRequestLogsDescription": "Registri di richiesta HTTP per le risorse proxy, inclusi metodo, percorso e codice di risposta.",
+    "httpDestAISessionLogsTitle": "Log di Sessione AI",
+    "httpDestAISessionLogsDescription": "Sessioni di richiesta e risposta AI gateway, comprese le domande, le risposte del modello e l'utilizzo dei token.",
    "httpDestSaveChanges": "Salva Modifiche",
    "httpDestCreateDestination": "Crea Destinazione",
    "httpDestUpdatedSuccess": "Destinazione aggiornata con successo",
@@ -1176,6 +1176,10 @@
    "idpJmespathAboutDescriptionLink": "JMESPath에 대해 더 알아보기",
    "idpJmespathLabel": "식별자 경로",
    "idpJmespathLabelDescription": "ID 토큰에서 사용자 식별자에 대한 경로",
+    "idpIdentifierChangeTitle": "식별자 경로 변경 경고",
+    "idpIdentifierChangeDescription": "식별자 경로를 변경하려고 합니다. 이는 기존 사용자의 매핑 방법에 영향을 미칩니다. 이전에 이 ID 공급자를 통해 로그인한 사용자는 더 이상 동일한 사용자로 인식되지 않을 수 있습니다. ",
+    "idpIdentifierChangeConfirmMessage": "확인합니다",
+    "idpIdentifierChangeWarningText": "이는 기존 사용자의 매핑 방법에 영향을 미칩니다",
    "idpJmespathEmailPathOptional": "이메일 경로 (선택 사항)",
    "idpJmespathEmailPathOptionalDescription": "ID 토큰에서 사용자의 이메일 경로",
    "idpJmespathNamePathOptional": "이름 경로 (선택 사항)",
@@ -1573,6 +1577,8 @@
    "search": "검색…",
    "searchPlaceholder": "검색...",
    "emptySearchOptions": "옵션이 없습니다",
+    "ipFilterSearchPlaceholder": "IP 주소를 입력하세요…",
+    "ipFilterEmptyMessage": "필터링할 IP 주소를 입력하세요",
    "create": "생성",
    "orgs": "조직",
    "loginError": "예기치 않은 오류가 발생했습니다. 다시 시도해주세요.",
@@ -1785,7 +1791,7 @@
    "aiClientConfigDescriptionClaude": "Anthropic의 터미널 에이전트 코딩 도구입니다.",
    "aiClientConfigDescriptionCodex": "OpenAI의 터미널 에이전트 코딩 도구입니다.",
    "aiClientConfigDescriptionOpencode": "오픈 소스 터미널 코딩 에이전트.",
-    "aiClientConfigDescriptionCursor": "VS Code를 기반으로 한 AI 코드 편집기.",
+    "aiClientConfigDescriptionGemini": "터미널용 구글의 에이전시 코딩 도구.",
    "aiClientConfigSetup": "설정",
    "aiClientConfigTabCli": "자동 (CLI)",
    "aiClientConfigTabManual": "수동 구성",
@@ -1891,6 +1897,7 @@
    "aiProviderRoutingModeTargetDescription": "사이트의 타겟을 통해 라우트",
    "aiProviderRoutingModeTargetNote": "이 공급자를 생성한 후 네트워크 설정 탭에 사이트 타겟을 구성합니다.",
    "aiProviderTargetNoOne": "이 공급자에게 타겟이 없습니다. 사이트를 통해 요청을 라우트하기 위한 타겟을 추가하십시오.",
+    "aiProviderRemoteNodeTargetsWarning": "원격 노드에 연결된 사이트는 AI 게이트웨이 공급자에게 라우팅되지 않습니다.",
    "aiProviderSkipTlsVerification": "TLS 검증 건너뛰기",
    "aiProviderSkipTlsVerificationDescription": "상류 연결에 대한 TLS 인증서 검증 비활성화",
    "aiProviderBudget": "예산",
@@ -1923,6 +1930,8 @@
    "aiCapabilityOpenaiResponsesDescription": "/v1/responses 지원",
    "aiCapabilityAnthropicMessages": "Anthropic 메시지",
    "aiCapabilityAnthropicMessagesDescription": "/v1/messages 지원",
+    "aiCapabilityV1Models": "모델 목록",
+    "aiCapabilityV1ModelsDescription": "/v1/models 모델 검색 지원",
    "aiCapabilityGeminiGenerateContent": "Gemini 콘텐츠 생성",
    "aiCapabilityGeminiGenerateContentDescription": "직접 Gemini API 지원",
    "aiCapabilityBedrockModelInvoke": "Bedrock 모델 실행",
@@ -2593,6 +2602,7 @@
    "createDomainType": "유형:",
    "createDomainName": "이름:",
    "createDomainValue": "값:",
+    "multiSelectFilterCount": "{count} 선택됨",
    "createDomainCnameRecords": "CNAME 레코드",
    "createDomainARecords": "A 레코드",
    "createDomainRecordNumber": "레코드 {number}",
@@ -2707,6 +2717,7 @@
    "healthScheme": "방법",
    "healthSelectScheme": "방법 선택",
    "healthCheckPortInvalid": "포트는 1에서 65535 사이여야 합니다",
+    "healthCheckHostnameInvalid": "호스트 이름에는 공백이 포함될 수 없습니다",
    "healthCheckPath": "경로",
    "healthHostname": "IP / 호스트",
    "healthPort": "포트",
@@ -2990,7 +3001,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "CIDR 범위 추가 (예: 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "서브넷 로드 실패",
    "remoteExitNodeNetworkingLabelsTitle": "우선순위 레이블",
-    "remoteExitNodeNetworkingLabelsDescription": "이 레이블이 있는 사이트는 이 원격 출구 노드를 통해 연결됩니다.",
+    "remoteExitNodeNetworkingLabelsDescription": "이 레이블이 있는 사이트는 이 원격 종료 노드를 통해 연결하는 것을 선호합니다.",
    "remoteExitNodeNetworkingLabelsButtonText": "레이블 선택...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "레이블 검색...",
    "remoteExitNodeNetworkingLabelsLoadError": "레이블 로드 실패",
@@ -3548,6 +3559,9 @@
    "sidebarLogsAction": "작업 로그",
    "logRetention": "로그 보관",
    "logRetentionDescription": "다양한 유형의 로그를 이 조직에 대해 얼마나 오래 보관할지 관리하거나 비활성화합니다",
+    "logRetentionDisabledWarningTitle": "로그 보존 비활성화",
+    "logRetentionDisabledWarningDescription": "{logType}이/가 이 조직에 대해 보존되지 않으므로 새로운 활동이 여기에 나타나지 않습니다. 보안을 설정해서 보존을 활성화하여 이러한 로그를 수집하기 시작하세요.",
+    "logRetentionDisabledWarningButton": "보안 설정으로 이동",
    "requestLogsDescription": "이 조직의 자원에 대한 상세한 요청 로그를 봅니다",
    "aiSessionLogs": "AI 게이트웨이 세션 로그",
    "aiSessionLogsDescription": "이 조직의 AI 게이트웨이 요청에 대한 프롬프트 및 응답 대본을 봅니다",
@@ -4081,6 +4095,8 @@
    "httpDestConnectionLogsDescription": "사이트 및 터널 연결 이벤트, 연결 및 연결 끊기를 포함합니다.",
    "httpDestRequestLogsTitle": "HTTP 요청 로그",
    "httpDestRequestLogsDescription": "프록시된 리소스에 대한 HTTP 요청 로그, 메서드, 경로 및 응답 코드를 포함합니다.",
+    "httpDestAISessionLogsTitle": "AI 세션 로그",
+    "httpDestAISessionLogsDescription": "AI 게이트웨이 요청 및 응답 세션, 프롬프트, 모델 응답 및 토큰 사용을 포함합니다.",
    "httpDestSaveChanges": "변경 사항 저장",
    "httpDestCreateDestination": "대상지 생성",
    "httpDestUpdatedSuccess": "대상지가 성공적으로 업데이트되었습니다",
@@ -1176,6 +1176,10 @@
    "idpJmespathAboutDescriptionLink": "Lær mer om JMESPath",
    "idpJmespathLabel": "Identifikatorsti",
    "idpJmespathLabelDescription": "Stien til brukeridentifikatoren i ID-tokenet",
+    "idpIdentifierChangeTitle": "Advarsel om identifikatorbanendring",
+    "idpIdentifierChangeDescription": "Du er i ferd med å endre identifikatorbanen. Dette vil påvirke hvordan eksisterende brukere kartlegges. Brukere som tidligere logget inn gjennom denne identitetsleverandøren kan ikke lenger bli gjenkjent som de samme brukerne.",
+    "idpIdentifierChangeConfirmMessage": "Jeg bekrefter",
+    "idpIdentifierChangeWarningText": "Dette vil påvirke hvordan eksisterende brukere kartlegges",
    "idpJmespathEmailPathOptional": "E-poststi (Valgfritt)",
    "idpJmespathEmailPathOptionalDescription": "Stien til brukerens e-postadresse i ID-tokenet",
    "idpJmespathNamePathOptional": "Navn Sti (Valgfritt)",
@@ -1573,6 +1577,8 @@
    "search": "Søk…",
    "searchPlaceholder": "Søk...",
    "emptySearchOptions": "Ingen valg funnet",
+    "ipFilterSearchPlaceholder": "Angi en IP-adresse…",
+    "ipFilterEmptyMessage": "Angi en IP-adresse å filtrere etter",
    "create": "Opprett",
    "orgs": "Organisasjoner",
    "loginError": "En uventet feil oppstod. Vennligst prøv igjen.",
@@ -1785,7 +1791,7 @@
    "aiClientConfigDescriptionClaude": "Anthropics agentiske kodingsverktøy for terminalen.",
    "aiClientConfigDescriptionCodex": "OpenAIs agentiske kodingsverktøy for terminalen.",
    "aiClientConfigDescriptionOpencode": "Åpen kildekode terminal kodeagent.",
-    "aiClientConfigDescriptionCursor": "AI-kodeeditor bygget på VS Code.",
+    "aiClientConfigDescriptionGemini": "Googles agentiske koding verktøy for terminalen.",
    "aiClientConfigSetup": "Oppsett",
    "aiClientConfigTabCli": "Automatisk (CLI)",
    "aiClientConfigTabManual": "Manuell konfigurasjon",
@@ -1891,6 +1897,7 @@
    "aiProviderRoutingModeTargetDescription": "Rute gjennom mål på dine nettsteder",
    "aiProviderRoutingModeTargetNote": "Etter å ha opprettet denne leverandøren, konfigurer områdemål på fanen Nettverksinnstillinger.",
    "aiProviderTargetNoOne": "Denne leverandøren har ingen mål. Legg til et mål for å rute forespørsler gjennom dine nettsteder.",
+    "aiProviderRemoteNodeTargetsWarning": "Nettsteder tilkoblet eksterne noder er utilgjengelige for ruting til på AI Gateway leverandører.",
    "aiProviderSkipTlsVerification": "Hopp over TLS-verifisering",
    "aiProviderSkipTlsVerificationDescription": "Deaktiver TLS-sertifikatverifisering for oppstrøms tilkobling",
    "aiProviderBudget": "Budsjett",
@@ -1923,6 +1930,8 @@
    "aiCapabilityOpenaiResponsesDescription": "Støtter /v1/responser",
    "aiCapabilityAnthropicMessages": "Anthropic Meldinger",
    "aiCapabilityAnthropicMessagesDescription": "Støtter /v1/meldinger",
+    "aiCapabilityV1Models": "Modelliste",
+    "aiCapabilityV1ModelsDescription": "Støtter /v1/modeller modelloppdagelse",
    "aiCapabilityGeminiGenerateContent": "Gemini Generer Innhold",
    "aiCapabilityGeminiGenerateContentDescription": "Støtter direkte Gemini API",
    "aiCapabilityBedrockModelInvoke": "Bedrock Modell Påkalling",
@@ -2593,6 +2602,7 @@
    "createDomainType": "Type:",
    "createDomainName": "Navn:",
    "createDomainValue": "Verdi:",
+    "multiSelectFilterCount": "{count} valgt",
    "createDomainCnameRecords": "CNAME-oppføringer",
    "createDomainARecords": "A-oppføringer",
    "createDomainRecordNumber": "Oppføring {number}",
@@ -2707,6 +2717,7 @@
    "healthScheme": "Metode",
    "healthSelectScheme": "Velg metode",
    "healthCheckPortInvalid": "Porten må være mellom 1 og 65535",
+    "healthCheckHostnameInvalid": "Vertsnavnet må ikke inneholde mellomrom",
    "healthCheckPath": "Sti",
    "healthHostname": "IP / Vert",
    "healthPort": "Port",
@@ -2990,7 +3001,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Legg til et CIDR-område (f.eks. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Feil ved lasting av subnett",
    "remoteExitNodeNetworkingLabelsTitle": "Preferanseetiketter",
-    "remoteExitNodeNetworkingLabelsDescription": "Områder med disse etikettene vil bli tvunget til å koble gjennom denne fjerne utgangsnoden.",
+    "remoteExitNodeNetworkingLabelsDescription": "Nettsteder med disse etikettene vil foretrekke å koble til gjennom denne eksterne utgangsnoden.",
    "remoteExitNodeNetworkingLabelsButtonText": "Velg etiketter...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Søk etiketter...",
    "remoteExitNodeNetworkingLabelsLoadError": "Feil ved lasting av etiketter",
@@ -3548,6 +3559,9 @@
    "sidebarLogsAction": "Handlingslogger",
    "logRetention": "Logg tilbaketrekning",
    "logRetentionDescription": "Håndter hvor lenge ulike typer logger beholdes for denne organisasjonen, eller deaktiver dem",
+    "logRetentionDisabledWarningTitle": "Loggbevaring deaktivert",
+    "logRetentionDisabledWarningDescription": "{logType} blir ikke lagret for denne organisasjonen, så ny aktivitet vises ikke her. Aktiver lagring i sikkerhetsinnstillingene for å begynne å samle inn disse loggene.",
+    "logRetentionDisabledWarningButton": "Gå til sikkerhetsinnstillinger",
    "requestLogsDescription": "Se detaljerte forespørselslogger for ressurser i denne organisasjonen",
    "aiSessionLogs": "AI Portal Sesjonslogger",
    "aiSessionLogsDescription": "Vis stikkord- og responsutskrifter for AI-portal forespørsler i denne organisasjonen",
@@ -4081,6 +4095,8 @@
    "httpDestConnectionLogsDescription": "Utstyrs- og tunneltilkoblingshendelser, inkludert forbindelser og frakobling.",
    "httpDestRequestLogsTitle": "HTTP-forespørselslogger",
    "httpDestRequestLogsDescription": "HTTP-forespørsel logger for bekreftede ressurser, inkludert metode, bane og responskode.",
+    "httpDestAISessionLogsTitle": "AI øktlogger",
+    "httpDestAISessionLogsDescription": "Forespørsels- og svarøkter for AI gateway, inkludert forespørsler, modellresponser og tokenbruk.",
    "httpDestSaveChanges": "Lagre endringer",
    "httpDestCreateDestination": "Opprett mål",
    "httpDestUpdatedSuccess": "Målet er oppdatert",
@@ -1176,6 +1176,10 @@
    "idpJmespathAboutDescriptionLink": "Meer informatie over JMESPath",
    "idpJmespathLabel": "ID pad",
    "idpJmespathLabelDescription": "Het pad naar het gebruiker-id in het ID-token",
+    "idpIdentifierChangeTitle": "Waarschuwing voor Wijziging van ID-pad",
+    "idpIdentifierChangeDescription": "U staat op het punt om het ID-pad te wijzigen. Dit zal invloed hebben op hoe bestaande gebruikers worden gemapt. Gebruikers die voorheen via deze identiteitsprovider inlogden, worden mogelijk niet meer als dezelfde gebruikers herkend.",
+    "idpIdentifierChangeConfirmMessage": "Ik bevestig",
+    "idpIdentifierChangeWarningText": "Dit beïnvloedt hoe bestaande gebruikers worden gemapt",
    "idpJmespathEmailPathOptional": "E-mail pad (optioneel)",
    "idpJmespathEmailPathOptionalDescription": "Het pad naar het e-mailadres van de gebruiker in het ID-token",
    "idpJmespathNamePathOptional": "Naam pad (optioneel)",
@@ -1573,6 +1577,8 @@
    "search": "Zoeken…",
    "searchPlaceholder": "Zoeken...",
    "emptySearchOptions": "Geen opties gevonden",
+    "ipFilterSearchPlaceholder": "Voer een IP-adres in…",
+    "ipFilterEmptyMessage": "Voer een IP-adres in om op te filteren",
    "create": "Aanmaken",
    "orgs": "Organisaties",
    "loginError": "Er is een onverwachte fout opgetreden. Probeer het opnieuw.",
@@ -1785,7 +1791,7 @@
    "aiClientConfigDescriptionClaude": "Anthropic's agentische coderingstool voor de terminal.",
    "aiClientConfigDescriptionCodex": "OpenAI's agentische coderingstool voor de terminal.",
    "aiClientConfigDescriptionOpencode": "Open source terminal coderingsagent.",
-    "aiClientConfigDescriptionCursor": "AI-code-editor gebouwd op VS Code.",
+    "aiClientConfigDescriptionGemini": "Agentisch coderingstool van Google voor de terminal.",
    "aiClientConfigSetup": "Instellen",
    "aiClientConfigTabCli": "Automatisch (CLI)",
    "aiClientConfigTabManual": "Handmatige configuratie",
@@ -1891,6 +1897,7 @@
    "aiProviderRoutingModeTargetDescription": "Routeer door doelen op uw sites",
    "aiProviderRoutingModeTargetNote": "Nadat u deze provider hebt aangemaakt, configureert u site-doelen op het tabblad Netwerkinstellingen.",
    "aiProviderTargetNoOne": "Deze provider heeft geen doelen. Voeg een doel toe om verzoeken via uw sites te routeren.",
+    "aiProviderRemoteNodeTargetsWarning": "Sites die verbonden zijn met externe nodes zijn niet toegankelijk om naar te worden gerouteerd op AI Gateway-providers.",
    "aiProviderSkipTlsVerification": "Sla TLS-verificatie over",
    "aiProviderSkipTlsVerificationDescription": "Schakel TLS-certificaatverificatie voor de upstream-verbinding uit",
    "aiProviderBudget": "Budget",
@@ -1923,6 +1930,8 @@
    "aiCapabilityOpenaiResponsesDescription": "Ondersteunt /v1/responses",
    "aiCapabilityAnthropicMessages": "Anthropic Berichten",
    "aiCapabilityAnthropicMessagesDescription": "Ondersteunt /v1/messages",
+    "aiCapabilityV1Models": "Modellenlijst",
+    "aiCapabilityV1ModelsDescription": "Ondersteunt /v1/models modelontdekking",
    "aiCapabilityGeminiGenerateContent": "Gemini Inhoud Genereren",
    "aiCapabilityGeminiGenerateContentDescription": "Ondersteunt de directe Gemini API",
    "aiCapabilityBedrockModelInvoke": "Bedrock Model Aanroep",
@@ -2593,6 +2602,7 @@
    "createDomainType": "Type:",
    "createDomainName": "Naam:",
    "createDomainValue": "Waarde:",
+    "multiSelectFilterCount": "{count} geselecteerd",
    "createDomainCnameRecords": "CNAME-records",
    "createDomainARecords": "A Records",
    "createDomainRecordNumber": "Record {number}",
@@ -2707,6 +2717,7 @@
    "healthScheme": "Methode",
    "healthSelectScheme": "Selecteer methode",
    "healthCheckPortInvalid": "Poort moet tussen 1 en 65535 zijn",
+    "healthCheckHostnameInvalid": "De hostnaam mag geen witruimtes bevatten",
    "healthCheckPath": "Pad",
    "healthHostname": "IP / Hostnaam",
    "healthPort": "Poort",
@@ -2990,7 +3001,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Voeg een CIDR-bereik toe (bijv. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Kon subnets niet laden",
    "remoteExitNodeNetworkingLabelsTitle": "Voorkeurslabels",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites met deze labels worden verplicht om verbinding te maken via dit externe exit-knooppunt.",
+    "remoteExitNodeNetworkingLabelsDescription": "Sites met deze labels zullen bij voorkeur verbinding maken via deze externe exitnode.",
    "remoteExitNodeNetworkingLabelsButtonText": "Selecteer labels...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Labels zoeken...",
    "remoteExitNodeNetworkingLabelsLoadError": "Kon labels niet laden",
@@ -3548,6 +3559,9 @@
    "sidebarLogsAction": "Actie logs",
    "logRetention": "Log bewaring",
    "logRetentionDescription": "Beheren hoe lang verschillende soorten logs bewaard worden voor deze organisatie of schakel ze uit",
+    "logRetentionDisabledWarningTitle": "Logboekbewaring Uitgeschakeld",
+    "logRetentionDisabledWarningDescription": "{logType} worden niet bewaard voor deze organisatie, dus nieuwe activiteiten zullen hier niet verschijnen. Schakel bewaren in beveiligingsinstellingen in om deze logboeken te verzamelen.",
+    "logRetentionDisabledWarningButton": "Ga naar Beveiligingsinstellingen",
    "requestLogsDescription": "Bekijk gedetailleerde verzoeklogboeken voor resources in deze organisatie",
    "aiSessionLogs": "AI Gateway Sessie Logs",
    "aiSessionLogsDescription": "Bekijk prompt- en reactie-transcripten voor AI-gateway-aanvragen in deze organisatie",
@@ -4081,6 +4095,8 @@
    "httpDestConnectionLogsDescription": "Verbinding met de Site en tunnel maken verbroken, inclusief verbindingen en verbindingen.",
    "httpDestRequestLogsTitle": "HTTP-aanvraaglogboeken",
    "httpDestRequestLogsDescription": "HTTP request logs voor proxied hulpmiddelen, waaronder methode, pad en response code.",
+    "httpDestAISessionLogsTitle": "AI Sessielogboeken",
+    "httpDestAISessionLogsDescription": "AI gateway verzoek- en reactiesessies, inclusief prompts, modelreacties en tokengebruik.",
    "httpDestSaveChanges": "Wijzigingen opslaan",
    "httpDestCreateDestination": "Maak bestemming aan",
    "httpDestUpdatedSuccess": "Bestemming succesvol bijgewerkt",
@@ -1176,6 +1176,10 @@
    "idpJmespathAboutDescriptionLink": "Dowiedz się więcej o JMESPath",
    "idpJmespathLabel": "Ścieżka identyfikatora",
    "idpJmespathLabelDescription": "JMESPath do identyfikatora użytkownika w tokenie ID",
+    "idpIdentifierChangeTitle": "Ostrzeżenie o zmianie ścieżki identyfikatora",
+    "idpIdentifierChangeDescription": "Zaraz zmienisz ścieżkę identyfikatora. To wpłynie na sposób mapowania istniejących użytkowników. Użytkownicy, którzy wcześniej logowali się przez tego dostawcę tożsamości, mogą nie być już rozpoznawani jako ci sami użytkownicy.",
+    "idpIdentifierChangeConfirmMessage": "Potwierdzam",
+    "idpIdentifierChangeWarningText": "To wpłynie na sposób mapowania istniejących użytkowników",
    "idpJmespathEmailPathOptional": "Ścieżka email (Opcjonalnie)",
    "idpJmespathEmailPathOptionalDescription": "JMESPath do emaila użytkownika w tokenie ID",
    "idpJmespathNamePathOptional": "Ścieżka nazwy (Opcjonalnie)",
@@ -1573,6 +1577,8 @@
    "search": "Szukaj…",
    "searchPlaceholder": "Szukaj...",
    "emptySearchOptions": "Nie znaleziono opcji",
+    "ipFilterSearchPlaceholder": "Wprowadź adres IP…",
+    "ipFilterEmptyMessage": "Wprowadź adres IP, aby filtrować",
    "create": "Utwórz",
    "orgs": "Organizacje",
    "loginError": "Wystąpił nieoczekiwany błąd. Spróbuj ponownie.",
@@ -1785,7 +1791,7 @@
    "aiClientConfigDescriptionClaude": "Agent narzędzia kodującego Anthropic dla terminala.",
    "aiClientConfigDescriptionCodex": "Agent narzędzia kodującego OpenAI dla terminala.",
    "aiClientConfigDescriptionOpencode": "Agent open source do kodowania w terminalu.",
-    "aiClientConfigDescriptionCursor": "Edytor kodu AI oparty na VS Code.",
+    "aiClientConfigDescriptionGemini": "Agent narzędzi kodowych Google dla terminala.",
    "aiClientConfigSetup": "Ustawienie",
    "aiClientConfigTabCli": "Automatyczne (CLI)",
    "aiClientConfigTabManual": "Konfiguracja ręczna",
@@ -1891,6 +1897,7 @@
    "aiProviderRoutingModeTargetDescription": "Trasa przez cele na Twoich witrynach",
    "aiProviderRoutingModeTargetNote": "Po utworzeniu tego dostawcy, skonfiguruj cele witryny na karcie Ustawienia sieci.",
    "aiProviderTargetNoOne": "Ten dostawca nie ma żadnych celów. Dodaj cel, aby trasować zapytania przez swoje witryny.",
+    "aiProviderRemoteNodeTargetsWarning": "Witryny podłączone do zdalnych węzłów są niedostępne do trasowania przez dostawców AI Gateway.",
    "aiProviderSkipTlsVerification": "Pomiń weryfikację TLS",
    "aiProviderSkipTlsVerificationDescription": "Wyłącz weryfikację certyfikatu TLS dla połączenia w górę",
    "aiProviderBudget": "Budżet",
@@ -1923,6 +1930,8 @@
    "aiCapabilityOpenaiResponsesDescription": "Obsługuje /v1/responses",
    "aiCapabilityAnthropicMessages": "Anthropic Wiadomości",
    "aiCapabilityAnthropicMessagesDescription": "Obsługuje /v1/messages",
+    "aiCapabilityV1Models": "Lista modeli",
+    "aiCapabilityV1ModelsDescription": "Obsługuje odkrywanie modeli /v1/models",
    "aiCapabilityGeminiGenerateContent": "Gemini Generowanie Treści",
    "aiCapabilityGeminiGenerateContentDescription": "Obsługuje bezpośredni Gemini API",
    "aiCapabilityBedrockModelInvoke": "Model Bedrock Wywołanie",
@@ -2593,6 +2602,7 @@
    "createDomainType": "Typ:",
    "createDomainName": "Nazwa:",
    "createDomainValue": "Wartość:",
+    "multiSelectFilterCount": "{count, plural, one {# wybrany} few {# wybrane} many {# wybranych} other {# wybranych}}",
    "createDomainCnameRecords": "Rekordy CNAME",
    "createDomainARecords": "Rekordy A",
    "createDomainRecordNumber": "Rekord {number}",
@@ -2707,6 +2717,7 @@
    "healthScheme": "Metoda",
    "healthSelectScheme": "Wybierz metodę",
    "healthCheckPortInvalid": "Port musi być pomiędzy 1 a 65535",
+    "healthCheckHostnameInvalid": "Nazwa hosta nie może zawierać spacji",
    "healthCheckPath": "Ścieżka",
    "healthHostname": "IP / Nazwa hosta",
    "healthPort": "Port",
@@ -2990,7 +3001,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Dodaj zakres CIDR (np. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Nie udało się załadować podsieci",
    "remoteExitNodeNetworkingLabelsTitle": "Etykiety preferencji",
-    "remoteExitNodeNetworkingLabelsDescription": "Strony z tymi etykietami będą zmuszone do połączenia się przez ten zdalny węzeł wyjściowy.",
+    "remoteExitNodeNetworkingLabelsDescription": "Strony z tymi etykietami będą preferować połączenie przez ten zdalny węzeł wyjściowy.",
    "remoteExitNodeNetworkingLabelsButtonText": "Wybierz etykiety...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Szukaj etykiet...",
    "remoteExitNodeNetworkingLabelsLoadError": "Nie udało się załadować etykiet",
@@ -3548,6 +3559,9 @@
    "sidebarLogsAction": "Dzienniki działań",
    "logRetention": "Zachowanie dziennika",
    "logRetentionDescription": "Zarządzaj jak długo różne typy logów są zachowane dla tej organizacji lub wyłącz je",
+    "logRetentionDisabledWarningTitle": "Wyłączone przechowywanie logów",
+    "logRetentionDisabledWarningDescription": "{logType} nie są przechowywane dla tej organizacji, więc nowe aktywności nie pojawią się tutaj. Włącz przechowywanie w ustawieniach bezpieczeństwa, aby zacząć zbierać te logi.",
+    "logRetentionDisabledWarningButton": "Przejdź do ustawień bezpieczeństwa",
    "requestLogsDescription": "Zobacz szczegółowe dzienniki żądań zasobów w tej organizacji",
    "aiSessionLogs": "Dzienniki Sesji Bramy AI",
    "aiSessionLogsDescription": "Zobacz transkrypcje podpowiedzi i odpowiedzi dla żądań bramy AI w tej organizacji",
@@ -4081,6 +4095,8 @@
    "httpDestConnectionLogsDescription": "Zdarzenia związane z miejscem i tunelem, w tym połączenia i rozłączenia.",
    "httpDestRequestLogsTitle": "Dzienniki żądań HTTP",
    "httpDestRequestLogsDescription": "Logi żądań HTTP dla zasobów proxy, w tym metody, ścieżki i kodu odpowiedzi.",
+    "httpDestAISessionLogsTitle": "Dzienniki sesji AI",
+    "httpDestAISessionLogsDescription": "Żądania i sesje odpowiedzi bramki AI, w tym zapytania, odpowiedzi modeli i użycie tokenów.",
    "httpDestSaveChanges": "Zapisz zmiany",
    "httpDestCreateDestination": "Utwórz cel",
    "httpDestUpdatedSuccess": "Cel został pomyślnie zaktualizowany",
@@ -1176,6 +1176,10 @@
    "idpJmespathAboutDescriptionLink": "Saiba mais sobre JMESPath",
    "idpJmespathLabel": "Caminho do Identificador",
    "idpJmespathLabelDescription": "O JMESPath para o identificador do utilizador no token ID",
+    "idpIdentifierChangeTitle": "Aviso de Mudança no Caminho do Identificador",
+    "idpIdentifierChangeDescription": "Você está prestes a mudar o caminho do identificador. Isso afetará como os usuários existentes são mapeados. Usuários que anteriormente fizeram login através deste provedor de identidade podem não ser mais reconhecidos como os mesmos usuários.",
+    "idpIdentifierChangeConfirmMessage": "Eu confirmo",
+    "idpIdentifierChangeWarningText": "Isto afetará como os usuários existentes são mapeados",
    "idpJmespathEmailPathOptional": "Caminho do Email (Opcional)",
    "idpJmespathEmailPathOptionalDescription": "O JMESPath para o email do utilizador no token ID",
    "idpJmespathNamePathOptional": "Caminho do Nome (Opcional)",
@@ -1573,6 +1577,8 @@
    "search": "Pesquisar…",
    "searchPlaceholder": "Buscar...",
    "emptySearchOptions": "Nenhuma opção encontrada",
+    "ipFilterSearchPlaceholder": "Insira um endereço IP…",
+    "ipFilterEmptyMessage": "Insira um endereço IP para filtrar",
    "create": "Criar",
    "orgs": "Organizações",
    "loginError": "Ocorreu um erro inesperado. Por favor, tente novamente.",
@@ -1785,7 +1791,7 @@
    "aiClientConfigDescriptionClaude": "Ferramenta de codificação agentic de Anthropic para o terminal.",
    "aiClientConfigDescriptionCodex": "Ferramenta de codificação agentic da OpenAI para o terminal.",
    "aiClientConfigDescriptionOpencode": "Agente de codificação de terminal de código aberto.",
-    "aiClientConfigDescriptionCursor": "Editor de código de IA baseado no VS Code.",
+    "aiClientConfigDescriptionGemini": "Ferramenta de codificação agêntica do terminal do Google.",
    "aiClientConfigSetup": "Configuração",
    "aiClientConfigTabCli": "Automático (CLI)",
    "aiClientConfigTabManual": "Configuração Manual",
@@ -1891,6 +1897,7 @@
    "aiProviderRoutingModeTargetDescription": "Roteie através de alvos em seus sites",
    "aiProviderRoutingModeTargetNote": "Após criar este provedor, configure alvos do site na aba Configurações de Rede.",
    "aiProviderTargetNoOne": "Este provedor não tem alvos. Adicione um alvo para rotear pedidos pelos seus sites.",
+    "aiProviderRemoteNodeTargetsWarning": "Sites conectados a nós remotos estão inacessíveis para serem roteados para os provedores do Gateway de IA.",
    "aiProviderSkipTlsVerification": "Pular Verificação TLS",
    "aiProviderSkipTlsVerificationDescription": "Desativar a verificação de certificado TLS para a conexão upstream",
    "aiProviderBudget": "Orçamento",
@@ -1923,6 +1930,8 @@
    "aiCapabilityOpenaiResponsesDescription": "Suporta /v1/responses",
    "aiCapabilityAnthropicMessages": "Mensagens Antropicas",
    "aiCapabilityAnthropicMessagesDescription": "Suporta /v1/messages",
+    "aiCapabilityV1Models": "Lista de Modelos",
+    "aiCapabilityV1ModelsDescription": "Suporta descoberta de modelos /v1/models",
    "aiCapabilityGeminiGenerateContent": "Gêmeos Gerar Conteúdo",
    "aiCapabilityGeminiGenerateContentDescription": "Suporta a API diretta do Gêmeos",
    "aiCapabilityBedrockModelInvoke": "Modelo Bedrock Invocar",
@@ -2593,6 +2602,7 @@
    "createDomainType": "Tipo:",
    "createDomainName": "Nome:",
    "createDomainValue": "Valor:",
+    "multiSelectFilterCount": "{count} selecionado",
    "createDomainCnameRecords": "Registros CNAME",
    "createDomainARecords": "Registros A",
    "createDomainRecordNumber": "Registrar {number}",
@@ -2707,6 +2717,7 @@
    "healthScheme": "Método",
    "healthSelectScheme": "Selecione o Método",
    "healthCheckPortInvalid": "A porta deve estar entre 1 e 65535",
+    "healthCheckHostnameInvalid": "O nome do host não deve conter espaços em branco",
    "healthCheckPath": "Caminho",
    "healthHostname": "IP / Nome do Host",
    "healthPort": "Porta",
@@ -2990,7 +3001,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Adicione um intervalo de CIDR (por exemplo, 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Falha ao carregar sub-redes",
    "remoteExitNodeNetworkingLabelsTitle": "Etiquetas de Preferência",
-    "remoteExitNodeNetworkingLabelsDescription": "Os sites com essas etiquetas serão forçados a se conectar através deste nó de saída remoto.",
+    "remoteExitNodeNetworkingLabelsDescription": "Sites com estas etiquetas preferirão conectar-se por meio deste nó de saída remoto.",
    "remoteExitNodeNetworkingLabelsButtonText": "Selecionar etiquetas...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Pesquisar etiquetas...",
    "remoteExitNodeNetworkingLabelsLoadError": "Falha ao carregar etiquetas",
@@ -3548,6 +3559,9 @@
    "sidebarLogsAction": "Logs de Ações",
    "logRetention": "Retenção de Log",
    "logRetentionDescription": "Gerenciar quanto tempo os diferentes tipos de logs são mantidos para esta organização ou desativá-los",
+    "logRetentionDisabledWarningTitle": "Retenção de Logs Desativada",
+    "logRetentionDisabledWarningDescription": "{logType} não estão sendo retidos para esta organização, portanto, novas atividades não aparecerão aqui. Ative a retenção nas configurações de segurança para começar a coletar esses logs.",
+    "logRetentionDisabledWarningButton": "Ir para Configurações de Segurança",
    "requestLogsDescription": "Ver registros de pedidos detalhados de recursos nesta organização",
    "aiSessionLogs": "Registros de Sessão do Gateway de IA",
    "aiSessionLogsDescription": "Veja as transcrições de prompt e resposta para solicitações de gateway de IA nesta organização",
@@ -4081,6 +4095,8 @@
    "httpDestConnectionLogsDescription": "Eventos de conexão de site e túnel, incluindo conexões e desconexões.",
    "httpDestRequestLogsTitle": "Registros de Pedidos HTTP",
    "httpDestRequestLogsDescription": "Logs de solicitação HTTP para recursos proxy incluindo o método, o caminho e o código de resposta.",
+    "httpDestAISessionLogsTitle": "Logs de Sessão de IA",
+    "httpDestAISessionLogsDescription": "Sessões de solicitação e resposta de gateway de IA, incluindo prompts, respostas de modelos e uso de tokens.",
    "httpDestSaveChanges": "Salvar as alterações",
    "httpDestCreateDestination": "Criar destino",
    "httpDestUpdatedSuccess": "Destino atualizado com sucesso",
@@ -1176,6 +1176,10 @@
    "idpJmespathAboutDescriptionLink": "Узнать больше о JMESPath",
    "idpJmespathLabel": "Путь идентификатора",
    "idpJmespathLabelDescription": "Путь к идентификатору пользователя в ID токене",
+    "idpIdentifierChangeTitle": "Предупреждение о изменении пути идентификатора",
+    "idpIdentifierChangeDescription": "Вы собираетесь изменить путь идентификатора. Это повлияет на то, как отображаются существующие пользователи. Пользователи, которые ранее входили через этого поставщика идентификации, могут больше не распознаваться как те же пользователи.",
+    "idpIdentifierChangeConfirmMessage": "Я подтверждаю",
+    "idpIdentifierChangeWarningText": "Это повлияет на то, как отображаются существующие пользователи",
    "idpJmespathEmailPathOptional": "Путь к email (необязательно)",
    "idpJmespathEmailPathOptionalDescription": "Путь к email пользователя в ID токене",
    "idpJmespathNamePathOptional": "Путь к имени (необязательно)",
@@ -1573,6 +1577,8 @@
    "search": "Поиск…",
    "searchPlaceholder": "Поиск...",
    "emptySearchOptions": "Опции не найдены",
+    "ipFilterSearchPlaceholder": "Введите IP адрес…",
+    "ipFilterEmptyMessage": "Введите IP адрес для фильтрации",
    "create": "Создать",
    "orgs": "Организации",
    "loginError": "Произошла непредвиденная ошибка. Пожалуйста, попробуйте еще раз.",
@@ -1785,7 +1791,7 @@
    "aiClientConfigDescriptionClaude": "Агентивное кодирующее средство Anthropic для терминала.",
    "aiClientConfigDescriptionCodex": "Агентивное кодирующее средство OpenAI для терминала.",
    "aiClientConfigDescriptionOpencode": "Открытый исходный агент для кодирования в терминале.",
-    "aiClientConfigDescriptionCursor": "AI редактор кода на основе VS Code.",
+    "aiClientConfigDescriptionGemini": "Инструмент программирования Google для терминала.",
    "aiClientConfigSetup": "Настройка",
    "aiClientConfigTabCli": "Автоматическое (CLI)",
    "aiClientConfigTabManual": "Ручная конфигурация",
@@ -1891,6 +1897,7 @@
    "aiProviderRoutingModeTargetDescription": "Маршрутизация через цели на ваших сайтах",
    "aiProviderRoutingModeTargetNote": "После создания этого провайдера настройте целевые сайты на вкладке Сетевые настройки.",
    "aiProviderTargetNoOne": "У этого провайдера нет целей. Добавьте цель для маршрутизации запросов через ваши сайты.",
+    "aiProviderRemoteNodeTargetsWarning": "Сайты, подключенные к удалённым узлам, недоступны для маршрутизации с помощью провайдеров AI Gateway.",
    "aiProviderSkipTlsVerification": "Пропустить проверку TLS",
    "aiProviderSkipTlsVerificationDescription": "Отключить проверку сертификата TLS для исходного соединения",
    "aiProviderBudget": "Бюджет",
@@ -1923,6 +1930,8 @@
    "aiCapabilityOpenaiResponsesDescription": "Поддерживает /v1/responses",
    "aiCapabilityAnthropicMessages": "Сообщения Anthropic",
    "aiCapabilityAnthropicMessagesDescription": "Поддерживает /v1/messages",
+    "aiCapabilityV1Models": "Список моделей",
+    "aiCapabilityV1ModelsDescription": "Поддерживает обнаружение моделей /v1/models",
    "aiCapabilityGeminiGenerateContent": "Gemini Создание контента",
    "aiCapabilityGeminiGenerateContentDescription": "Поддерживает прямой API Gemini",
    "aiCapabilityBedrockModelInvoke": "Вызов модели Bedrock",
@@ -2593,6 +2602,7 @@
    "createDomainType": "Тип:",
    "createDomainName": "Имя:",
    "createDomainValue": "Значение:",
+    "multiSelectFilterCount": "Выбрано: {count}",
    "createDomainCnameRecords": "CNAME Записи",
    "createDomainARecords": "A Записи",
    "createDomainRecordNumber": "Запись {number}",
@@ -2707,6 +2717,7 @@
    "healthScheme": "Метод",
    "healthSelectScheme": "Выберите метод",
    "healthCheckPortInvalid": "Порт должен быть в диапазоне от 1 до 65535",
+    "healthCheckHostnameInvalid": "Имя хоста не должно содержать пробелов",
    "healthCheckPath": "Путь",
    "healthHostname": "IP / хост",
    "healthPort": "Порт",
@@ -2990,7 +3001,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Добавить диапазон CIDR (например, 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Не удалось загрузить подсети",
    "remoteExitNodeNetworkingLabelsTitle": "Этикетки предпочтений",
-    "remoteExitNodeNetworkingLabelsDescription": "Сайты с этими метками будут обязаны подключаться через этот удаленный узел выхода.",
+    "remoteExitNodeNetworkingLabelsDescription": "Сайты с такими метками предпочтут соединяться через этот удаленный узел выхода.",
    "remoteExitNodeNetworkingLabelsButtonText": "Выберите метки...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Поиск меток...",
    "remoteExitNodeNetworkingLabelsLoadError": "Не удалось загрузить метки",
@@ -3548,6 +3559,9 @@
    "sidebarLogsAction": "Журнал действий",
    "logRetention": "Сохранение журнала",
    "logRetentionDescription": "Управление сохранением различных типов журналов для этой организации или отключение их",
+    "logRetentionDisabledWarningTitle": "Хранение логов отключено",
+    "logRetentionDisabledWarningDescription": "Логи {logType} не сохраняются для этой организации, поэтому здесь не будет отображаться новая активность. Включите хранение в настройках безопасности, чтобы начать собирать эти логи.",
+    "logRetentionDisabledWarningButton": "Перейти в настройки безопасности",
    "requestLogsDescription": "Просмотреть подробные журналы запроса ресурсов в этой организации",
    "aiSessionLogs": "AI Логи сессии шлюза",
    "aiSessionLogsDescription": "Просмотр транскриптов запросов и ответов для шлюзов AI в этой организации",
@@ -4081,6 +4095,8 @@
    "httpDestConnectionLogsDescription": "События связи с сайтами и туннелями, включая соединения и отключения.",
    "httpDestRequestLogsTitle": "HTTP Запросы Логи",
    "httpDestRequestLogsDescription": "Журналы запросов HTTP для проксируемых ресурсов, включая метод, путь и код ответа.",
+    "httpDestAISessionLogsTitle": "Логи AI сессий",
+    "httpDestAISessionLogsDescription": "Запросы и ответы AI gateway, включая подсказки, ответы моделей и использование токенов.",
    "httpDestSaveChanges": "Сохранить изменения",
    "httpDestCreateDestination": "Создать адрес назначения",
    "httpDestUpdatedSuccess": "Адрес назначения успешно обновлен",
@@ -1176,6 +1176,10 @@
    "idpJmespathAboutDescriptionLink": "JMESPath hakkında daha fazla bilgi edinin",
    "idpJmespathLabel": "Tanımlayıcı Yolu",
    "idpJmespathLabelDescription": "The JMESPath to the user identifier in the ID token",
+    "idpIdentifierChangeTitle": "Tanımlayıcı Yol Değişikliği Uyarısı",
+    "idpIdentifierChangeDescription": "Tanımlayıcı yolu değiştirmek üzeresiniz. Bu, mevcut kullanıcıların nasıl eşleneceğini etkileyecektir. Bu kimlik sağlayıcı üzerinden daha önce oturum açmış olan kullanıcılar artık aynı kullanıcılar olarak tanınmayabilir.",
+    "idpIdentifierChangeConfirmMessage": "Onaylıyorum",
+    "idpIdentifierChangeWarningText": "Bu, mevcut kullanıcıların nasıl eşleneceğini etkileyecek",
    "idpJmespathEmailPathOptional": "E-posta Yolu (İsteğe Bağlı)",
    "idpJmespathEmailPathOptionalDescription": "The JMESPath to the user's email in the ID token",
    "idpJmespathNamePathOptional": "Ad Yolu (İsteğe Bağlı)",
@@ -1573,6 +1577,8 @@
    "search": "Ara…",
    "searchPlaceholder": "Ara...",
    "emptySearchOptions": "Seçenek bulunamadı",
+    "ipFilterSearchPlaceholder": "Bir IP adresi girin…",
+    "ipFilterEmptyMessage": "Filtrelemek için bir IP adresi girin",
    "create": "Oluştur",
    "orgs": "Organizasyonlar",
    "loginError": "Beklenmeyen bir hata oluştu. Lütfen tekrar deneyin.",
@@ -1785,7 +1791,7 @@
    "aiClientConfigDescriptionClaude": "Anthropic'in terminal için aracılık kodlama aracı.",
    "aiClientConfigDescriptionCodex": "OpenAI'nin terminal için aracılık kodlama aracı.",
    "aiClientConfigDescriptionOpencode": "Açık kaynak terminal kodlama aracı.",
-    "aiClientConfigDescriptionCursor": "VS Code üzerine kurulu yapay zeka kod editörü.",
+    "aiClientConfigDescriptionGemini": "Google'un terminal için agentik kodlama aracı.",
    "aiClientConfigSetup": "Kurulum",
    "aiClientConfigTabCli": "Otomatik (CLI)",
    "aiClientConfigTabManual": "Manuel Yapılandırma",
@@ -1891,6 +1897,7 @@
    "aiProviderRoutingModeTargetDescription": "Siteniz üzerindeki hedefler üzerinden yönlendirin",
    "aiProviderRoutingModeTargetNote": "Bu sağlayıcıyı oluşturduktan sonra, site hedeflerini Ağ Ayarları sekmesinde yapılandırın.",
    "aiProviderTargetNoOne": "Bu sağlayıcının herhangi bir hedefi yok. Sitemiz üzerinden istekleri yönlendirmek için bir hedef ekleyin.",
+    "aiProviderRemoteNodeTargetsWarning": "Uzaktaki düğümlere bağlı siteler, AI Geçidi sağlayıcılarına yönlendirilemez durumda.",
    "aiProviderSkipTlsVerification": "TLS Doğrulamayı Atla",
    "aiProviderSkipTlsVerificationDescription": "Yukarı akış bağlantısı için TLS sertifika doğrulamasını devre dışı bırakın",
    "aiProviderBudget": "Bütçe",
@@ -1923,6 +1930,8 @@
    "aiCapabilityOpenaiResponsesDescription": "/v1/yanıtlar desteği sağlar",
    "aiCapabilityAnthropicMessages": "Anthropic Mesajlar",
    "aiCapabilityAnthropicMessagesDescription": "/v1/mesajlar desteği sağlar",
+    "aiCapabilityV1Models": "Modeller Listesi",
+    "aiCapabilityV1ModelsDescription": "T /v1/models model keşfini destekler",
    "aiCapabilityGeminiGenerateContent": "Gemini İçerik Üret",
    "aiCapabilityGeminiGenerateContentDescription": "Doğrudan Gemini API desteği sağlar",
    "aiCapabilityBedrockModelInvoke": "Bedrock Modeli Çağır",
@@ -2593,6 +2602,7 @@
    "createDomainType": "Tür:",
    "createDomainName": "Ad:",
    "createDomainValue": "Değer:",
+    "multiSelectFilterCount": "{count} seçildi",
    "createDomainCnameRecords": "CNAME Kayıtları",
    "createDomainARecords": "A Kayıtları",
    "createDomainRecordNumber": "Kayıt {number}",
@@ -2707,6 +2717,7 @@
    "healthScheme": "Yöntem",
    "healthSelectScheme": "Yöntem Seç",
    "healthCheckPortInvalid": "Bağlantı noktası 1 ile 65535 arasında olmalıdır",
+    "healthCheckHostnameInvalid": "Ana bilgisayar adı boşluk içermemelidir",
    "healthCheckPath": "Yol",
    "healthHostname": "IP / Hostname",
    "healthPort": "Bağlantı Noktası",
@@ -2990,7 +3001,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Bir CIDR aralığı ekle (örneğin, 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Alt ağlar yüklenemedi",
    "remoteExitNodeNetworkingLabelsTitle": "Tercih Etiketleri",
-    "remoteExitNodeNetworkingLabelsDescription": "Bu etiketlere sahip siteler, bu uzak çıkış düğümü üzerinden bağlantı kurmaya zorlanacaktır.",
+    "remoteExitNodeNetworkingLabelsDescription": "Bu etiketlere sahip siteler, bağlantıyı bu uzak çıkış düğümü üzerinden tercih edecektir.",
    "remoteExitNodeNetworkingLabelsButtonText": "Etiketleri seç...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Etiketleri ara...",
    "remoteExitNodeNetworkingLabelsLoadError": "Etiketler yüklenemedi",
@@ -3548,6 +3559,9 @@
    "sidebarLogsAction": "Eylem Günlükleri",
    "logRetention": "Kayıt Saklama",
    "logRetentionDescription": "Bu organizasyon için farklı türdeki günlüklerin ne kadar süre saklanacağını yönetin veya devre dışı bırakın",
+    "logRetentionDisabledWarningTitle": "Günlük Saklama Devre Dışı Bırakıldı",
+    "logRetentionDisabledWarningDescription": "{logType} bu organizasyon için saklanmıyor, bu nedenle yeni etkinlikler burada görünmeyecek. Bu günlükleri toplamak için güvenlik ayarlarında saklamayı etkinleştirin.",
+    "logRetentionDisabledWarningButton": "Güvenlik Ayarlarına Git",
    "requestLogsDescription": "Bu organizasyondaki kaynaklar için ayrıntılı istek günlüklerini görüntüleyin",
    "aiSessionLogs": "AI Ağ Geçidi Oturum Günlükleri",
    "aiSessionLogsDescription": "Bu organizasyondaki AI ağ geçidi isteklerinin istem ve yanıt transkriptlerini görüntüleyin",
@@ -4081,6 +4095,8 @@
    "httpDestConnectionLogsDescription": "Site ve tünel bağlantı olayları, bağlantılar ve bağlantı kesilmeleri dahil.",
    "httpDestRequestLogsTitle": "HTTP İstek Günlükleri",
    "httpDestRequestLogsDescription": "Yönlendirilmiş kaynaklar için HTTP istek kayıtları, yöntem, yol ve yanıt kodu dahil.",
+    "httpDestAISessionLogsTitle": "AI Oturum Günlükleri",
+    "httpDestAISessionLogsDescription": "AI geçidi istek ve yanıt oturumları, istemler, model yanıtları ve token kullanımı dahil.",
    "httpDestSaveChanges": "Değişiklikleri Kaydet",
    "httpDestCreateDestination": "Hedef Oluştur",
    "httpDestUpdatedSuccess": "Hedef başarıyla güncellendi",
@@ -1176,6 +1176,10 @@
    "idpJmespathAboutDescriptionLink": "了解更多 JMESPath 信息",
    "idpJmespathLabel": "标识符路径",
    "idpJmespathLabelDescription": "ID 令牌中用户标识符的路径",
+    "idpIdentifierChangeTitle": "标识符路径更改警告",
+    "idpIdentifierChangeDescription": "您即将更改标识符路径。这将影响现有用户的映射方式。以前通过此身份提供者登录的用户可能将不再被识别为相同用户。",
+    "idpIdentifierChangeConfirmMessage": "我确认",
+    "idpIdentifierChangeWarningText": "这将影响现有用户的映射方式",
    "idpJmespathEmailPathOptional": "邮箱路径（可选）",
    "idpJmespathEmailPathOptionalDescription": "ID 令牌中用户邮箱的路径",
    "idpJmespathNamePathOptional": "用户名路径（可选）",
@@ -1573,6 +1577,8 @@
    "search": "搜索…",
    "searchPlaceholder": "搜索...",
    "emptySearchOptions": "未找到选项",
+    "ipFilterSearchPlaceholder": "输入IP地址…",
+    "ipFilterEmptyMessage": "输入要筛选的IP地址",
    "create": "创建",
    "orgs": "组织",
    "loginError": "发生意外错误。请重试。",
@@ -1785,7 +1791,7 @@
    "aiClientConfigDescriptionClaude": "Anthropic 的终端代理编码工具。",
    "aiClientConfigDescriptionCodex": "OpenAI 的终端代理编码工具。",
    "aiClientConfigDescriptionOpencode": "开源终端编码代理。",
-    "aiClientConfigDescriptionCursor": "基于 VS Code 的 AI 代码编辑器。",
+    "aiClientConfigDescriptionGemini": "Google的终端代理编码工具。",
    "aiClientConfigSetup": "设置",
    "aiClientConfigTabCli": "自动 (CLI)",
    "aiClientConfigTabManual": "手动配置",
@@ -1891,6 +1897,7 @@
    "aiProviderRoutingModeTargetDescription": "通过您站点上的目标进行路由",
    "aiProviderRoutingModeTargetNote": "创建此提供商后，在“网络设置”选项卡中配置站点目标。",
    "aiProviderTargetNoOne": "该提供商没有任何目标。 添加目标以通过您的站点路由请求。",
+    "aiProviderRemoteNodeTargetsWarning": "连接到远程节点的站点无法在AI网关供应商上被路由。",
    "aiProviderSkipTlsVerification": "跳过TLS验证",
    "aiProviderSkipTlsVerificationDescription": "禁用上游连接的TLS证书验证",
    "aiProviderBudget": "预算",
@@ -1923,6 +1930,8 @@
    "aiCapabilityOpenaiResponsesDescription": "支持 /v1/responses",
    "aiCapabilityAnthropicMessages": "Anthropic 消息",
    "aiCapabilityAnthropicMessagesDescription": "支持 /v1/messages",
+    "aiCapabilityV1Models": "模型列表",
+    "aiCapabilityV1ModelsDescription": "支持/v1/models模型发现",
    "aiCapabilityGeminiGenerateContent": "Gemini 生成内容",
    "aiCapabilityGeminiGenerateContentDescription": "支持直接Gemini API",
    "aiCapabilityBedrockModelInvoke": "Bedrock 模型调用",
@@ -2593,6 +2602,7 @@
    "createDomainType": "类型:",
    "createDomainName": "名称:",
    "createDomainValue": "值:",
+    "multiSelectFilterCount": "{count} 已选择",
    "createDomainCnameRecords": "CNAME 记录",
    "createDomainARecords": "A记录",
    "createDomainRecordNumber": "记录 {number}",
@@ -2707,6 +2717,7 @@
    "healthScheme": "方法",
    "healthSelectScheme": "选择方法",
    "healthCheckPortInvalid": "端口必须在 1 和 65535 之间",
+    "healthCheckHostnameInvalid": "主机名不得包含空格",
    "healthCheckPath": "路径",
    "healthHostname": "IP / 主机",
    "healthPort": "端口",
@@ -2990,7 +3001,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "添加CIDR范围（例如10.0.0.0/8）",
    "remoteExitNodeNetworkingSubnetsLoadError": "无法加载子网",
    "remoteExitNodeNetworkingLabelsTitle": "首选标签",
-    "remoteExitNodeNetworkingLabelsDescription": "拥有这些标签的站点将强制通过此远程出口节点连接。",
+    "remoteExitNodeNetworkingLabelsDescription": "带有这些标签的站点将优先通过此远程出口节点进行连接。",
    "remoteExitNodeNetworkingLabelsButtonText": "选择标签……",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "搜索标签……",
    "remoteExitNodeNetworkingLabelsLoadError": "无法加载标签",
@@ -3548,6 +3559,9 @@
    "sidebarLogsAction": "操作日志",
    "logRetention": "日志保留",
    "logRetentionDescription": "管理不同类型的日志为这个机构保留多长时间或禁用这些日志",
+    "logRetentionDisabledWarningTitle": "日志保留已禁用",
+    "logRetentionDisabledWarningDescription": "{logType}未在此组织中被保留，因此新活动不会显示在此处。请在安全设置中启用日志保留以开始收集这些日志。",
+    "logRetentionDisabledWarningButton": "转到安全设置",
    "requestLogsDescription": "查看此机构资源的详细请求日志",
    "aiSessionLogs": "AI 网关会话日志",
    "aiSessionLogsDescription": "查看此组织中AI网关请求的提示和响应记录",
@@ -4081,6 +4095,8 @@
    "httpDestConnectionLogsDescription": "站点和隧道连接事件，包括连接和断开连接。",
    "httpDestRequestLogsTitle": "请求日志",
    "httpDestRequestLogsDescription": "HTTP 请求代理资源日志，包括方法、路径和响应代码。",
+    "httpDestAISessionLogsTitle": "AI会话日志",
+    "httpDestAISessionLogsDescription": "AI网关请求和响应会话，包括提示、模型响应和令牌使用。",
    "httpDestSaveChanges": "保存更改",
    "httpDestCreateDestination": "创建目标",
    "httpDestUpdatedSuccess": "目标已成功更新",
@@ -32,49 +32,49 @@
        "format": "prettier --write ."
    },
    "dependencies": {
-        "@asteasolutions/zod-to-openapi": "8.5.0",
-        "@aws-sdk/client-s3": "3.1056.0",
+        "@asteasolutions/zod-to-openapi": "9.1.0",
+        "@aws-sdk/client-s3": "3.1123.0",
        "@devolutions/iron-remote-desktop": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-0.0.0.tgz",
        "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
        "@headlessui/react": "2.2.10",
-        "@hookform/resolvers": "5.4.0",
+        "@hookform/resolvers": "5.9.1",
        "@monaco-editor/react": "4.7.0",
-        "@node-rs/argon2": "2.0.2",
+        "@node-rs/argon2": "2.2.0",
        "@novnc/novnc": "^1.7.0",
        "@oslojs/crypto": "1.0.1",
        "@oslojs/encoding": "1.1.0",
-        "@radix-ui/react-avatar": "1.1.11",
-        "@radix-ui/react-checkbox": "1.3.3",
-        "@radix-ui/react-collapsible": "1.1.12",
-        "@radix-ui/react-dialog": "1.1.15",
-        "@radix-ui/react-dropdown-menu": "2.1.16",
+        "@radix-ui/react-avatar": "1.2.6",
+        "@radix-ui/react-checkbox": "1.3.11",
+        "@radix-ui/react-collapsible": "1.1.20",
+        "@radix-ui/react-dialog": "1.1.23",
+        "@radix-ui/react-dropdown-menu": "2.1.24",
        "@radix-ui/react-icons": "1.3.2",
-        "@radix-ui/react-label": "2.1.8",
-        "@radix-ui/react-popover": "1.1.15",
-        "@radix-ui/react-progress": "1.1.8",
-        "@radix-ui/react-radio-group": "1.3.8",
-        "@radix-ui/react-scroll-area": "1.2.10",
-        "@radix-ui/react-select": "2.2.6",
-        "@radix-ui/react-separator": "1.1.8",
-        "@radix-ui/react-slot": "1.2.4",
-        "@radix-ui/react-switch": "1.2.6",
-        "@radix-ui/react-tabs": "1.1.13",
-        "@radix-ui/react-toast": "1.2.15",
-        "@radix-ui/react-tooltip": "1.2.8",
+        "@radix-ui/react-label": "2.1.15",
+        "@radix-ui/react-popover": "1.1.23",
+        "@radix-ui/react-progress": "1.1.16",
+        "@radix-ui/react-radio-group": "1.4.7",
+        "@radix-ui/react-scroll-area": "1.2.18",
+        "@radix-ui/react-select": "2.3.7",
+        "@radix-ui/react-separator": "1.1.15",
+        "@radix-ui/react-slot": "1.3.3",
+        "@radix-ui/react-switch": "1.3.7",
+        "@radix-ui/react-tabs": "1.1.21",
+        "@radix-ui/react-toast": "1.2.23",
+        "@radix-ui/react-tooltip": "1.2.16",
        "@react-email/body": "0.3.0",
        "@react-email/components": "1.0.12",
-        "@react-email/render": "2.0.8",
+        "@react-email/render": "2.1.0",
        "@react-email/tailwind": "2.0.7",
        "@simplewebauthn/browser": "13.3.0",
-        "@simplewebauthn/server": "13.3.1",
+        "@simplewebauthn/server": "13.3.3",
        "@tailwindcss/forms": "0.5.11",
-        "@tanstack/react-query": "5.100.14",
-        "@tanstack/react-table": "8.21.3",
+        "@tanstack/react-query": "5.102.8",
+        "@tanstack/react-table": "9.2.4",
        "@xterm/addon-fit": "^0.11.0",
        "@xterm/addon-web-links": "^0.12.0",
        "@xterm/xterm": "^6.0.0",
        "arctic": "3.7.0",
-        "axios": "1.18.0",
+        "axios": "1.20.0",
        "better-sqlite3": "11.9.1",
        "canvas-confetti": "1.9.4",
        "class-variance-authority": "0.7.1",
@@ -86,62 +86,62 @@
        "d3": "7.9.0",
        "drizzle-orm": "0.45.2",
        "express": "5.2.1",
-        "express-rate-limit": "8.5.2",
+        "express-rate-limit": "8.7.0",
        "glob": "13.0.6",
-        "gpt-tokenizer": "^3.4.0",
-        "helmet": "8.2.0",
+        "gpt-tokenizer": "^4.0.0",
+        "helmet": "8.3.0",
        "http-errors": "2.0.1",
-        "input-otp": "1.4.2",
-        "ioredis": "5.11.0",
+        "input-otp": "1.5.0",
+        "ioredis": "6.0.0",
        "jmespath": "0.16.0",
-        "js-yaml": "4.3.1",
+        "js-yaml": "5.4.1",
        "jsonwebtoken": "9.0.3",
-        "lucide-react": "1.17.0",
-        "maxmind": "5.0.6",
+        "lucide-react": "1.38.0",
+        "maxmind": "5.0.7",
        "moment": "2.30.1",
-        "next": "16.3.1",
-        "next-intl": "4.13.0",
+        "next": "16.3.4",
+        "next-intl": "4.14.1",
        "next-themes": "0.4.6",
        "nextjs-toploader": "3.9.17",
        "node-cache": "5.1.2",
-        "nodemailer": "9.0.1",
+        "nodemailer": "9.1.0",
        "oslo": "1.2.1",
-        "pg": "8.21.0",
-        "posthog-node": "5.35.6",
+        "pg": "8.23.0",
+        "posthog-node": "5.51.4",
        "qrcode.react": "4.2.0",
-        "react": "19.2.6",
-        "react-day-picker": "9.14.0",
-        "react-dom": "19.2.6",
+        "react": "19.2.8",
+        "react-day-picker": "10.0.1",
+        "react-dom": "19.2.8",
        "react-easy-sort": "1.8.0",
-        "react-hook-form": "7.76.1",
-        "react-icons": "5.6.0",
-        "recharts": "3.8.1",
+        "react-hook-form": "7.87.0",
+        "react-icons": "5.7.0",
+        "recharts": "3.10.1",
        "reodotdev": "1.1.0",
-        "semver": "7.8.1",
+        "semver": "7.8.5",
        "sshpk": "1.18.0",
-        "stripe": "22.2.0",
+        "stripe": "22.6.0",
        "swagger-ui-express": "5.0.1",
        "tailwind-merge": "3.6.0",
        "topojson-client": "3.1.0",
        "tw-animate-css": "1.4.0",
        "use-debounce": "10.1.1",
-        "uuid": "14.0.0",
+        "uuid": "14.0.2",
        "vaul": "1.1.2",
        "visionscarto-world-atlas": "1.0.0",
        "winston": "3.19.0",
        "winston-daily-rotate-file": "5.0.0",
-        "ws": "8.21.0",
+        "ws": "8.21.3",
        "yaml": "2.9.0",
-        "yargs": "18.0.0",
-        "zod": "4.4.3",
+        "yargs": "18.1.0",
+        "zod": "4.5.4",
        "zod-validation-error": "5.0.0"
    },
    "devDependencies": {
-        "@dotenvx/dotenvx": "1.69.1",
+        "@dotenvx/dotenvx": "2.23.0",
        "@esbuild-plugins/tsconfig-paths": "0.1.2",
-        "@react-email/ui": "^6.9.2",
-        "@tailwindcss/postcss": "4.3.0",
-        "@tanstack/react-query-devtools": "5.100.14",
+        "@react-email/ui": "^6.9.3",
+        "@tailwindcss/postcss": "4.3.3",
+        "@tanstack/react-query-devtools": "5.102.8",
        "@types/better-sqlite3": "7.6.13",
        "@types/cookie-parser": "1.4.10",
        "@types/cors": "2.8.19",
@@ -152,36 +152,36 @@
        "@types/jmespath": "0.15.2",
        "@types/js-yaml": "4.0.9",
        "@types/jsonwebtoken": "9.0.10",
-        "@types/node": "25.9.1",
-        "@types/nodemailer": "8.0.0",
+        "@types/node": "26.4.0",
+        "@types/nodemailer": "8.0.1",
        "@types/nprogress": "0.2.3",
-        "@types/pg": "8.20.0",
-        "@types/react": "19.2.15",
-        "@types/react-dom": "19.2.3",
-        "@types/semver": "7.7.1",
-        "@types/sshpk": "1.17.4",
+        "@types/pg": "8.23.1",
+        "@types/react": "19.2.18",
+        "@types/react-dom": "19.2.5",
+        "@types/semver": "7.8.0",
+        "@types/sshpk": "1.17.5",
        "@types/swagger-ui-express": "4.1.8",
        "@types/topojson-client": "3.1.5",
        "@types/ws": "8.18.1",
        "@types/yargs": "17.0.35",
        "babel-plugin-react-compiler": "1.0.0",
        "drizzle-kit": "0.31.10",
-        "esbuild": "0.28.0",
-        "esbuild-node-externals": "1.22.0",
-        "eslint": "10.4.0",
-        "eslint-config-next": "16.2.6",
-        "postcss": "8.5.23",
-        "prettier": "3.8.3",
-        "react-email": "6.5.0",
-        "tailwindcss": "4.3.0",
-        "tsc-alias": "1.8.17",
-        "tsx": "4.22.3",
-        "typescript": "6.0.3",
-        "typescript-eslint": "8.60.0"
+        "esbuild": "0.28.2",
+        "esbuild-node-externals": "2.0.0",
+        "eslint": "10.9.1",
+        "eslint-config-next": "16.3.4",
+        "postcss": "8.5.26",
+        "prettier": "3.9.6",
+        "react-email": "6.9.3",
+        "tailwindcss": "4.3.3",
+        "tsc-alias": "1.9.3",
+        "tsx": "4.23.13",
+        "typescript": "7.0.2",
+        "typescript-eslint": "8.69.0"
    },
    "overrides": {
-        "esbuild": "0.28.0",
+        "esbuild": "0.28.2",
        "dompurify": "3.4.0",
-        "postcss": "8.5.23"
+        "postcss": "8.5.26"
    }
 }
@@ -0,0 +1,3 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M11.04 19.32Q12 21.51 12 24q0-2.49.93-4.68.96-2.19 2.58-3.81t3.81-2.55Q21.51 12 24 12q-2.49 0-4.68-.93a12.3 12.3 0 0 1-3.81-2.58 12.3 12.3 0 0 1-2.58-3.81Q12 2.49 12 0q0 2.49-.96 4.68-.93 2.19-2.55 3.81a12.3 12.3 0 0 1-3.81 2.58Q2.49 12 0 12q2.49 0 4.68.96 2.19.93 3.81 2.55t2.55 3.81" fill="black"/>
+</svg>
@@ -0,0 +1,3 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M11.04 19.32Q12 21.51 12 24q0-2.49.93-4.68.96-2.19 2.58-3.81t3.81-2.55Q21.51 12 24 12q-2.49 0-4.68-.93a12.3 12.3 0 0 1-3.81-2.58 12.3 12.3 0 0 1-2.58-3.81Q12 2.49 12 0q0 2.49-.96 4.68-.93 2.19-2.55 3.81a12.3 12.3 0 0 1-3.81 2.58Q2.49 12 0 12q2.49 0 4.68.96 2.19.93 3.81 2.55t2.55 3.81" fill="white"/>
+</svg>
@@ -26,7 +26,9 @@ import {
    sites,
    clients,
    sessions,
-    labels
+    labels,
+    aiProviders,
+    virtualApiKeys
 } from "./schema";

 export const dnsChallenge = pgTable("dnsChallenges", {
@@ -468,6 +470,9 @@ export const eventStreamingDestinations = pgTable(
        sendRequestLogs: boolean("sendRequestLogs").notNull().default(false),
        sendActionLogs: boolean("sendActionLogs").notNull().default(false),
        sendAccessLogs: boolean("sendAccessLogs").notNull().default(false),
+        sendAISessionLogs: boolean("sendAISessionLogs")
+            .notNull()
+            .default(false),
        type: varchar("type", { length: 50 }).notNull(), // e.g. "http", "kafka", etc.
        config: text("config").notNull(), // JSON string with the configuration for the destination
        enabled: boolean("enabled").notNull().default(true),
@@ -611,6 +616,87 @@ export const trialNotifications = pgTable("trialNotifications", {
    sentAt: bigint("sentAt", { mode: "number" }).notNull()
 });

+// Logs the aggregated prompt + response for a single AI gateway request, for
+// session replay. One row per request (not per streaming chunk). `sessionId`
+// is a fresh random id per row for now - no cross-request correlation yet,
+// but the column exists so a future pass can link multiple rows into a real
+// multi-turn session.
+export const aiSessionLog = pgTable(
+    "aiSessionLog",
+    {
+        id: serial("id").primaryKey(),
+        sessionId: varchar("sessionId").notNull(),
+        orgId: varchar("orgId").references(() => orgs.orgId, {
+            onDelete: "cascade"
+        }),
+        providerId: integer("providerId").references(
+            () => aiProviders.providerId,
+            { onDelete: "set null" }
+        ),
+        capability: varchar("capability").notNull(),
+        resourceId: integer("resourceId").references(
+            () => resources.resourceId,
+            { onDelete: "set null" }
+        ),
+        siteResourceId: integer("siteResourceId").references(
+            () => siteResources.siteResourceId,
+            { onDelete: "set null" }
+        ),
+        userId: varchar("userId").references(() => users.userId, {
+            onDelete: "set null"
+        }),
+        virtualApiKeyId: varchar("virtualApiKeyId").references(
+            () => virtualApiKeys.virtualApiKeyId,
+            { onDelete: "set null" }
+        ),
+        requestedModel: varchar("requestedModel"),
+        isStream: boolean("isStream").notNull().default(false),
+        requestBody: text("requestBody"),
+        responseBody: text("responseBody"),
+        // Capability-agnostic message transcript (JSON-encoded
+        // NormalizedAiMessage[] from server/lib/aiMessageNormalization.ts),
+        // computed at write time so search/display never need per-capability
+        // parsing logic. Null when normalization couldn't recognize the
+        // shape - callers fall back to requestBody/responseBody.
+        normalizedRequest: text("normalizedRequest"),
+        normalizedResponse: text("normalizedResponse"),
+        // True if any of the request/response (raw or normalized) fields
+        // were cut short at AI_SESSION_LOG_MAX_BODY_CHARS before storage.
+        truncated: boolean("truncated").notNull().default(false),
+        statusCode: integer("statusCode"),
+        createdAt: bigint("createdAt", { mode: "number" }).notNull() // epoch seconds
+    },
+    (t) => [
+        index("idx_ai_session_log_org_created").on(t.orgId, t.createdAt),
+        index("idx_ai_session_log_org_provider_created").on(
+            t.orgId,
+            t.providerId,
+            t.createdAt
+        ),
+        index("idx_ai_session_log_org_resource_created").on(
+            t.orgId,
+            t.resourceId,
+            t.createdAt
+        ),
+        index("idx_ai_session_log_org_site_resource_created").on(
+            t.orgId,
+            t.siteResourceId,
+            t.createdAt
+        ),
+        index("idx_ai_session_log_org_user_created").on(
+            t.orgId,
+            t.userId,
+            t.createdAt
+        ),
+        index("idx_ai_session_log_org_virtual_api_key_created").on(
+            t.orgId,
+            t.virtualApiKeyId,
+            t.createdAt
+        ),
+        index("idx_ai_session_log_session").on(t.sessionId)
+    ]
+);
+
 export type Approval = InferSelectModel<typeof approvals>;
 export type Limit = InferSelectModel<typeof limits>;
 export type Account = InferSelectModel<typeof account>;
@@ -657,3 +743,4 @@ export type AlertEmailRecipients = InferSelectModel<
 >;
 export type AlertWebhookActions = InferSelectModel<typeof alertWebhookActions>;
 export type TrialNotification = InferSelectModel<typeof trialNotifications>;
+export type AiSessionLog = InferSelectModel<typeof aiSessionLog>;
@@ -262,16 +262,20 @@ export const resourceAiModels = pgTable(
    (t) => [primaryKey({ columns: [t.resourceId, t.modelId] })]
 );

-export const labels = pgTable("labels", {
-    labelId: serial("labelId").primaryKey(),
-    name: varchar("name").notNull(),
-    color: varchar("color").notNull(),
-    orgId: varchar("orgId")
-        .references(() => orgs.orgId, {
-            onDelete: "cascade"
-        })
-        .notNull()
-});
+export const labels = pgTable(
+    "labels",
+    {
+        labelId: serial("labelId").primaryKey(),
+        name: varchar("name").notNull(),
+        color: varchar("color").notNull(),
+        orgId: varchar("orgId")
+            .references(() => orgs.orgId, {
+                onDelete: "cascade"
+            })
+            .notNull()
+    },
+    (t) => [index("idx_labels_orgid").on(t.orgId)]
+);

 export const launcherViews = pgTable("launcherViews", {
    viewId: serial("viewId").primaryKey(),
@@ -693,15 +697,19 @@ export const twoFactorBackupCodes = pgTable("twoFactorBackupCodes", {
    codeHash: varchar("codeHash").notNull()
 });

-export const sessions = pgTable("session", {
-    sessionId: varchar("id").primaryKey(),
-    userId: varchar("userId")
-        .notNull()
-        .references(() => users.userId, { onDelete: "cascade" }),
-    expiresAt: bigint("expiresAt", { mode: "number" }).notNull(),
-    issuedAt: bigint("issuedAt", { mode: "number" }),
-    deviceAuthUsed: boolean("deviceAuthUsed").notNull().default(false)
-});
+export const sessions = pgTable(
+    "session",
+    {
+        sessionId: varchar("id").primaryKey(),
+        userId: varchar("userId")
+            .notNull()
+            .references(() => users.userId, { onDelete: "cascade" }),
+        expiresAt: bigint("expiresAt", { mode: "number" }).notNull(),
+        issuedAt: bigint("issuedAt", { mode: "number" }),
+        deviceAuthUsed: boolean("deviceAuthUsed").notNull().default(false)
+    },
+    (t) => [index("idx_sessions_userid").on(t.userId)]
+);

 export const newtSessions = pgTable("newtSession", {
    sessionId: varchar("id").primaryKey(),
@@ -711,19 +719,26 @@ export const newtSessions = pgTable("newtSession", {
    expiresAt: bigint("expiresAt", { mode: "number" }).notNull()
 });

-export const userOrgs = pgTable("userOrgs", {
-    userId: varchar("userId")
-        .notNull()
-        .references(() => users.userId, { onDelete: "cascade" }),
-    orgId: varchar("orgId")
-        .references(() => orgs.orgId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
-    isOwner: boolean("isOwner").notNull().default(false),
-    autoProvisioned: boolean("autoProvisioned").default(false),
-    pamUsername: varchar("pamUsername") // cleaned username for ssh and such
-});
+export const userOrgs = pgTable(
+    "userOrgs",
+    {
+        userId: varchar("userId")
+            .notNull()
+            .references(() => users.userId, { onDelete: "cascade" }),
+        orgId: varchar("orgId")
+            .references(() => orgs.orgId, {
+                onDelete: "cascade"
+            })
+            .notNull(),
+        isOwner: boolean("isOwner").notNull().default(false),
+        autoProvisioned: boolean("autoProvisioned").default(false),
+        pamUsername: varchar("pamUsername") // cleaned username for ssh and such
+    },
+    (t) => [
+        index("idx_userOrgs_userid").on(t.userId),
+        index("idx_userOrgs_orgid").on(t.orgId)
+    ]
+);

 export const emailVerificationCodes = pgTable("emailVerificationCodes", {
    codeId: serial("id").primaryKey(),
@@ -751,22 +766,26 @@ export const actions = pgTable("actions", {
    description: varchar("description")
 });

-export const roles = pgTable("roles", {
-    roleId: serial("roleId").primaryKey(),
-    orgId: varchar("orgId")
-        .references(() => orgs.orgId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
-    isAdmin: boolean("isAdmin"),
-    name: varchar("name").notNull(),
-    description: varchar("description"),
-    requireDeviceApproval: boolean("requireDeviceApproval").default(false),
-    sshSudoMode: varchar("sshSudoMode", { length: 32 }).default("full"), // "none" | "full" | "commands"
-    sshSudoCommands: text("sshSudoCommands").default("[]"),
-    sshCreateHomeDir: boolean("sshCreateHomeDir").default(true),
-    sshUnixGroups: text("sshUnixGroups").default("[]")
-});
+export const roles = pgTable(
+    "roles",
+    {
+        roleId: serial("roleId").primaryKey(),
+        orgId: varchar("orgId")
+            .references(() => orgs.orgId, {
+                onDelete: "cascade"
+            })
+            .notNull(),
+        isAdmin: boolean("isAdmin"),
+        name: varchar("name").notNull(),
+        description: varchar("description"),
+        requireDeviceApproval: boolean("requireDeviceApproval").default(false),
+        sshSudoMode: varchar("sshSudoMode", { length: 32 }).default("full"), // "none" | "full" | "commands"
+        sshSudoCommands: text("sshSudoCommands").default("[]"),
+        sshCreateHomeDir: boolean("sshCreateHomeDir").default(true),
+        sshUnixGroups: text("sshUnixGroups").default("[]")
+    },
+    (t) => [index("idx_roles_orgid").on(t.orgId)]
+);

 export const userOrgRoles = pgTable(
    "userOrgRoles",
@@ -1409,7 +1428,10 @@ export const olms = pgTable(
        }),
        archived: boolean("archived").notNull().default(false)
    },
-    (t) => [index("idx_olms_clientid").on(t.clientId)]
+    (t) => [
+        index("idx_olms_clientid").on(t.clientId),
+        index("idx_olms_userid").on(t.userId)
+    ]
 );

 export const currentFingerprint = pgTable("currentFingerprint", {
@@ -1936,87 +1958,6 @@ export const aiBudgetBreachEvents = pgTable(
    ]
 );

-// Logs the aggregated prompt + response for a single AI gateway request, for
-// session replay. One row per request (not per streaming chunk). `sessionId`
-// is a fresh random id per row for now - no cross-request correlation yet,
-// but the column exists so a future pass can link multiple rows into a real
-// multi-turn session.
-export const aiSessionLog = pgTable(
-    "aiSessionLog",
-    {
-        id: serial("id").primaryKey(),
-        sessionId: varchar("sessionId").notNull(),
-        orgId: varchar("orgId").references(() => orgs.orgId, {
-            onDelete: "cascade"
-        }),
-        providerId: integer("providerId").references(
-            () => aiProviders.providerId,
-            { onDelete: "set null" }
-        ),
-        capability: varchar("capability").notNull(),
-        resourceId: integer("resourceId").references(
-            () => resources.resourceId,
-            { onDelete: "set null" }
-        ),
-        siteResourceId: integer("siteResourceId").references(
-            () => siteResources.siteResourceId,
-            { onDelete: "set null" }
-        ),
-        userId: varchar("userId").references(() => users.userId, {
-            onDelete: "set null"
-        }),
-        virtualApiKeyId: varchar("virtualApiKeyId").references(
-            () => virtualApiKeys.virtualApiKeyId,
-            { onDelete: "set null" }
-        ),
-        requestedModel: varchar("requestedModel"),
-        isStream: boolean("isStream").notNull().default(false),
-        requestBody: text("requestBody"),
-        responseBody: text("responseBody"),
-        // Capability-agnostic message transcript (JSON-encoded
-        // NormalizedAiMessage[] from server/lib/aiMessageNormalization.ts),
-        // computed at write time so search/display never need per-capability
-        // parsing logic. Null when normalization couldn't recognize the
-        // shape - callers fall back to requestBody/responseBody.
-        normalizedRequest: text("normalizedRequest"),
-        normalizedResponse: text("normalizedResponse"),
-        // True if any of the request/response (raw or normalized) fields
-        // were cut short at AI_SESSION_LOG_MAX_BODY_CHARS before storage.
-        truncated: boolean("truncated").notNull().default(false),
-        statusCode: integer("statusCode"),
-        createdAt: bigint("createdAt", { mode: "number" }).notNull() // epoch ms
-    },
-    (t) => [
-        index("idx_ai_session_log_org_created").on(t.orgId, t.createdAt),
-        index("idx_ai_session_log_org_provider_created").on(
-            t.orgId,
-            t.providerId,
-            t.createdAt
-        ),
-        index("idx_ai_session_log_org_resource_created").on(
-            t.orgId,
-            t.resourceId,
-            t.createdAt
-        ),
-        index("idx_ai_session_log_org_site_resource_created").on(
-            t.orgId,
-            t.siteResourceId,
-            t.createdAt
-        ),
-        index("idx_ai_session_log_org_user_created").on(
-            t.orgId,
-            t.userId,
-            t.createdAt
-        ),
-        index("idx_ai_session_log_org_virtual_api_key_created").on(
-            t.orgId,
-            t.virtualApiKeyId,
-            t.createdAt
-        ),
-        index("idx_ai_session_log_session").on(t.sessionId)
-    ]
-);
-
 export const certificates = pgTable("certificates", {
    certId: serial("certId").primaryKey(),
    domain: varchar("domain", { length: 255 }).notNull().unique(),
@@ -2129,7 +2070,6 @@ export type AiModel = InferSelectModel<typeof aiModels>;
 export type AiBudget = InferSelectModel<typeof aiBudgets>;
 export type AiUsageRecord = InferSelectModel<typeof aiUsageRecords>;
 export type AiBudgetBreachEvent = InferSelectModel<typeof aiBudgetBreachEvents>;
-export type AiSessionLog = InferSelectModel<typeof aiSessionLog>;
 export type ResourceAiProvider = InferSelectModel<typeof resourceAiProviders>;
 export type SiteResourceAiProvider = InferSelectModel<
    typeof siteResourceAiProviders
@@ -9,6 +9,7 @@ import {
    uniqueIndex
 } from "drizzle-orm/sqlite-core";
 import {
+    aiProviders,
    clients,
    domains,
    exitNodes,
@@ -20,7 +21,8 @@ import {
    siteResources,
    sites,
    targetHealthCheck,
-    users
+    users,
+    virtualApiKeys
 } from "./schema";

 export const dnsChallenge = sqliteTable("dnsChallenges", {
@@ -459,6 +461,9 @@ export const eventStreamingDestinations = sqliteTable(
        sendAccessLogs: integer("sendAccessLogs", { mode: "boolean" })
            .notNull()
            .default(false),
+        sendAISessionLogs: integer("sendAISessionLogs", { mode: "boolean" })
+            .notNull()
+            .default(false),
        type: text("type").notNull(), // e.g. "http", "kafka", etc.
        config: text("config").notNull(), // JSON string with the configuration for the destination
        enabled: integer("enabled", { mode: "boolean" })
@@ -606,6 +611,91 @@ export const trialNotifications = sqliteTable("trialNotifications", {
    sentAt: integer("sentAt").notNull()
 });

+// Logs the aggregated prompt + response for a single AI gateway request, for
+// session replay. One row per request (not per streaming chunk). `sessionId`
+// is a fresh random id per row for now - no cross-request correlation yet,
+// but the column exists so a future pass can link multiple rows into a real
+// multi-turn session.
+export const aiSessionLog = sqliteTable(
+    "aiSessionLog",
+    {
+        id: integer("id").primaryKey({ autoIncrement: true }),
+        sessionId: text("sessionId").notNull(),
+        orgId: text("orgId").references(() => orgs.orgId, {
+            onDelete: "cascade"
+        }),
+        providerId: integer("providerId").references(
+            () => aiProviders.providerId,
+            { onDelete: "set null" }
+        ),
+        capability: text("capability").notNull(),
+        resourceId: integer("resourceId").references(
+            () => resources.resourceId,
+            { onDelete: "set null" }
+        ),
+        siteResourceId: integer("siteResourceId").references(
+            () => siteResources.siteResourceId,
+            { onDelete: "set null" }
+        ),
+        userId: text("userId").references(() => users.userId, {
+            onDelete: "set null"
+        }),
+        virtualApiKeyId: text("virtualApiKeyId").references(
+            () => virtualApiKeys.virtualApiKeyId,
+            { onDelete: "set null" }
+        ),
+        requestedModel: text("requestedModel"),
+        isStream: integer("isStream", { mode: "boolean" })
+            .notNull()
+            .default(false),
+        requestBody: text("requestBody"),
+        responseBody: text("responseBody"),
+        // Capability-agnostic message transcript (JSON-encoded
+        // NormalizedAiMessage[] from server/lib/aiMessageNormalization.ts),
+        // computed at write time so search/display never need per-capability
+        // parsing logic. Null when normalization couldn't recognize the
+        // shape - callers fall back to requestBody/responseBody.
+        normalizedRequest: text("normalizedRequest"),
+        normalizedResponse: text("normalizedResponse"),
+        // True if any of the request/response (raw or normalized) fields
+        // were cut short at AI_SESSION_LOG_MAX_BODY_CHARS before storage.
+        truncated: integer("truncated", { mode: "boolean" })
+            .notNull()
+            .default(false),
+        statusCode: integer("statusCode"),
+        createdAt: integer("createdAt").notNull() // epoch seconds
+    },
+    (t) => [
+        index("idx_ai_session_log_org_created").on(t.orgId, t.createdAt),
+        index("idx_ai_session_log_org_provider_created").on(
+            t.orgId,
+            t.providerId,
+            t.createdAt
+        ),
+        index("idx_ai_session_log_org_resource_created").on(
+            t.orgId,
+            t.resourceId,
+            t.createdAt
+        ),
+        index("idx_ai_session_log_org_site_resource_created").on(
+            t.orgId,
+            t.siteResourceId,
+            t.createdAt
+        ),
+        index("idx_ai_session_log_org_user_created").on(
+            t.orgId,
+            t.userId,
+            t.createdAt
+        ),
+        index("idx_ai_session_log_org_virtual_api_key_created").on(
+            t.orgId,
+            t.virtualApiKeyId,
+            t.createdAt
+        ),
+        index("idx_ai_session_log_session").on(t.sessionId)
+    ]
+);
+
 export type Approval = InferSelectModel<typeof approvals>;
 export type Limit = InferSelectModel<typeof limits>;
 export type Account = InferSelectModel<typeof account>;
@@ -644,3 +734,4 @@ export type AlertEmailAction = InferSelectModel<typeof alertEmailActions>;
 export type AlertEmailRecipient = InferSelectModel<typeof alertEmailRecipients>;
 export type AlertWebhookAction = InferSelectModel<typeof alertWebhookActions>;
 export type TrialNotification = InferSelectModel<typeof trialNotifications>;
+export type AiSessionLog = InferSelectModel<typeof aiSessionLog>;
@@ -99,131 +99,149 @@ export const orgDomains = sqliteTable("orgDomains", {
        .references(() => domains.domainId, { onDelete: "cascade" })
 });

-export const sites = sqliteTable("sites", {
-    siteId: integer("siteId").primaryKey({ autoIncrement: true }),
-    orgId: text("orgId")
-        .references(() => orgs.orgId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
-    niceId: text("niceId").notNull(),
-    exitNodeId: integer("exitNode").references(() => exitNodes.exitNodeId, {
-        onDelete: "set null"
-    }),
-    networkId: integer("networkId").references(() => networks.networkId, {
-        onDelete: "set null"
-    }),
-    name: text("name").notNull(),
-    pubKey: text("pubKey"),
-    exitNodeSubnet: text("exitNodeSubnet"),
-    megabytesIn: integer("bytesIn").default(0),
-    megabytesOut: integer("bytesOut").default(0),
-    lastBandwidthUpdate: text("lastBandwidthUpdate"),
-    type: text("type").notNull(), // "newt" or "wireguard"
-    online: integer("online", { mode: "boolean" }).notNull().default(false),
-    lastPing: integer("lastPing"),
+export const sites = sqliteTable(
+    "sites",
+    {
+        siteId: integer("siteId").primaryKey({ autoIncrement: true }),
+        orgId: text("orgId")
+            .references(() => orgs.orgId, {
+                onDelete: "cascade"
+            })
+            .notNull(),
+        niceId: text("niceId").notNull(),
+        exitNodeId: integer("exitNode").references(() => exitNodes.exitNodeId, {
+            onDelete: "set null"
+        }),
+        networkId: integer("networkId").references(() => networks.networkId, {
+            onDelete: "set null"
+        }),
+        name: text("name").notNull(),
+        pubKey: text("pubKey"),
+        exitNodeSubnet: text("exitNodeSubnet"),
+        megabytesIn: integer("bytesIn").default(0),
+        megabytesOut: integer("bytesOut").default(0),
+        lastBandwidthUpdate: text("lastBandwidthUpdate"),
+        type: text("type").notNull(), // "newt" or "wireguard"
+        online: integer("online", { mode: "boolean" }).notNull().default(false),
+        lastPing: integer("lastPing"),

-    // exit node stuff that is how to connect to the site when it has a wg server
-    address: text("address"), // this is the address of the wireguard interface in newt
-    endpoint: text("endpoint"), // this is how to reach gerbil externally - gets put into the wireguard config
-    localEndpoints: text("localEndpoints"), // JSON encoded list of string ips on the local machine to try to connect to
-    publicKey: text("publicKey"), // TODO: Fix typo in publicKey
-    lastHolePunch: integer("lastHolePunch"),
-    listenPort: integer("listenPort"),
-    dockerSocketEnabled: integer("dockerSocketEnabled", { mode: "boolean" })
-        .notNull()
-        .default(true),
-    autoUpdateEnabled: integer("autoUpdateEnabled", { mode: "boolean" })
-        .notNull()
-        .default(false),
-    autoUpdateOverrideOrg: integer("autoUpdateOverrideOrg", {
-        mode: "boolean"
-    })
-        .notNull()
-        .default(false),
-    status: text("status").$type<"pending" | "approved">().default("approved")
-});
-
-export const resources = sqliteTable("resources", {
-    resourceId: integer("resourceId").primaryKey({ autoIncrement: true }),
-    resourcePolicyId: integer("resourcePolicyId").references(
-        () => resourcePolicies.resourcePolicyId,
-        { onDelete: "set null" }
-    ),
-    defaultResourcePolicyId: integer("defaultResourcePolicyId").references(
-        () => resourcePolicies.resourcePolicyId,
-        {
-            onDelete: "restrict"
-        }
-    ),
-    resourceGuid: text("resourceGuid", { length: 36 })
-        .unique()
-        .notNull()
-        .$defaultFn(() => randomUUID()),
-    orgId: text("orgId")
-        .references(() => orgs.orgId, {
-            onDelete: "cascade"
+        // exit node stuff that is how to connect to the site when it has a wg server
+        address: text("address"), // this is the address of the wireguard interface in newt
+        endpoint: text("endpoint"), // this is how to reach gerbil externally - gets put into the wireguard config
+        localEndpoints: text("localEndpoints"), // JSON encoded list of string ips on the local machine to try to connect to
+        publicKey: text("publicKey"), // TODO: Fix typo in publicKey
+        lastHolePunch: integer("lastHolePunch"),
+        listenPort: integer("listenPort"),
+        dockerSocketEnabled: integer("dockerSocketEnabled", { mode: "boolean" })
+            .notNull()
+            .default(true),
+        autoUpdateEnabled: integer("autoUpdateEnabled", { mode: "boolean" })
+            .notNull()
+            .default(false),
+        autoUpdateOverrideOrg: integer("autoUpdateOverrideOrg", {
+            mode: "boolean"
        })
-        .notNull(),
-    niceId: text("niceId").notNull(),
-    name: text("name").notNull(),
-    subdomain: text("subdomain"),
-    fullDomain: text("fullDomain"),
-    domainId: text("domainId").references(() => domains.domainId, {
-        onDelete: "set null"
-    }),
-    ssl: integer("ssl", { mode: "boolean" }).notNull().default(false),
-    blockAccess: integer("blockAccess", { mode: "boolean" })
-        .notNull()
-        .default(false),
-    proxyPort: integer("proxyPort"),
-    sso: integer("sso", { mode: "boolean" }),
-    emailWhitelistEnabled: integer("emailWhitelistEnabled", {
-        mode: "boolean"
-    }),
-    applyRules: integer("applyRules", { mode: "boolean" }),
-    enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
-    stickySession: integer("stickySession", { mode: "boolean" })
-        .notNull()
-        .default(false),
-    tlsServerName: text("tlsServerName"),
-    setHostHeader: text("setHostHeader"),
-    enableProxy: integer("enableProxy", { mode: "boolean" }).default(true),
-    skipToIdpId: integer("skipToIdpId").references(() => idp.idpId, {
-        onDelete: "set null"
-    }),
-    headers: text("headers"), // comma-separated list of headers to add to the request
-    proxyProtocol: integer("proxyProtocol", { mode: "boolean" })
-        .notNull()
-        .default(false),
-    proxyProtocolVersion: integer("proxyProtocolVersion").default(1),
-    maintenanceModeEnabled: integer("maintenanceModeEnabled", {
-        mode: "boolean"
-    })
-        .notNull()
-        .default(false),
-    maintenanceModeType: text("maintenanceModeType", {
-        enum: ["forced", "automatic"]
-    }).default("forced"), // "forced" = always show, "automatic" = only when down
-    maintenanceTitle: text("maintenanceTitle"),
-    maintenanceMessage: text("maintenanceMessage"),
-    maintenanceEstimatedTime: text("maintenanceEstimatedTime"),
-    postAuthPath: text("postAuthPath"),
-    health: text("health").default("unknown"), // "healthy", "unhealthy", "unknown"
-    wildcard: integer("wildcard", { mode: "boolean" }).notNull().default(false),
-    mode: text("mode")
-        .default("http")
-        .$type<"rdp" | "ssh" | "http" | "vnc" | "inference" | "tcp" | "udp">()
-        .notNull(), // rdp, ssh, http, vnc, inference
-    pamMode: text("pamMode")
-        .$type<"passthrough" | "push">()
-        .default("passthrough"),
-    authDaemonMode: text("authDaemonMode")
-        .$type<"site" | "remote" | "native">()
-        .default("site"),
-    authDaemonPort: integer("authDaemonPort").default(22123),
-    status: text("status").$type<"pending" | "approved">().default("approved")
-});
+            .notNull()
+            .default(false),
+        status: text("status")
+            .$type<"pending" | "approved">()
+            .default("approved")
+    },
+    (table) => [index("idx_sites_orgId").on(table.orgId)]
+);
+
+export const resources = sqliteTable(
+    "resources",
+    {
+        resourceId: integer("resourceId").primaryKey({ autoIncrement: true }),
+        resourcePolicyId: integer("resourcePolicyId").references(
+            () => resourcePolicies.resourcePolicyId,
+            { onDelete: "set null" }
+        ),
+        defaultResourcePolicyId: integer("defaultResourcePolicyId").references(
+            () => resourcePolicies.resourcePolicyId,
+            {
+                onDelete: "restrict"
+            }
+        ),
+        resourceGuid: text("resourceGuid", { length: 36 })
+            .unique()
+            .notNull()
+            .$defaultFn(() => randomUUID()),
+        orgId: text("orgId")
+            .references(() => orgs.orgId, {
+                onDelete: "cascade"
+            })
+            .notNull(),
+        niceId: text("niceId").notNull(),
+        name: text("name").notNull(),
+        subdomain: text("subdomain"),
+        fullDomain: text("fullDomain"),
+        domainId: text("domainId").references(() => domains.domainId, {
+            onDelete: "set null"
+        }),
+        ssl: integer("ssl", { mode: "boolean" }).notNull().default(false),
+        blockAccess: integer("blockAccess", { mode: "boolean" })
+            .notNull()
+            .default(false),
+        proxyPort: integer("proxyPort"),
+        sso: integer("sso", { mode: "boolean" }),
+        emailWhitelistEnabled: integer("emailWhitelistEnabled", {
+            mode: "boolean"
+        }),
+        applyRules: integer("applyRules", { mode: "boolean" }),
+        enabled: integer("enabled", { mode: "boolean" })
+            .notNull()
+            .default(true),
+        stickySession: integer("stickySession", { mode: "boolean" })
+            .notNull()
+            .default(false),
+        tlsServerName: text("tlsServerName"),
+        setHostHeader: text("setHostHeader"),
+        enableProxy: integer("enableProxy", { mode: "boolean" }).default(true),
+        skipToIdpId: integer("skipToIdpId").references(() => idp.idpId, {
+            onDelete: "set null"
+        }),
+        headers: text("headers"), // comma-separated list of headers to add to the request
+        proxyProtocol: integer("proxyProtocol", { mode: "boolean" })
+            .notNull()
+            .default(false),
+        proxyProtocolVersion: integer("proxyProtocolVersion").default(1),
+        maintenanceModeEnabled: integer("maintenanceModeEnabled", {
+            mode: "boolean"
+        })
+            .notNull()
+            .default(false),
+        maintenanceModeType: text("maintenanceModeType", {
+            enum: ["forced", "automatic"]
+        }).default("forced"), // "forced" = always show, "automatic" = only when down
+        maintenanceTitle: text("maintenanceTitle"),
+        maintenanceMessage: text("maintenanceMessage"),
+        maintenanceEstimatedTime: text("maintenanceEstimatedTime"),
+        postAuthPath: text("postAuthPath"),
+        health: text("health").default("unknown"), // "healthy", "unhealthy", "unknown"
+        wildcard: integer("wildcard", { mode: "boolean" })
+            .notNull()
+            .default(false),
+        mode: text("mode")
+            .default("http")
+            .$type<
+                "rdp" | "ssh" | "http" | "vnc" | "inference" | "tcp" | "udp"
+            >()
+            .notNull(), // rdp, ssh, http, vnc, inference
+        pamMode: text("pamMode")
+            .$type<"passthrough" | "push">()
+            .default("passthrough"),
+        authDaemonMode: text("authDaemonMode")
+            .$type<"site" | "remote" | "native">()
+            .default("site"),
+        authDaemonPort: integer("authDaemonPort").default(22123),
+        status: text("status")
+            .$type<"pending" | "approved">()
+            .default("approved")
+    },
+    (table) => [index("idx_resources_orgId").on(table.orgId)]
+);

 export const resourceAiProviders = sqliteTable(
    "resourceAiProviders",
@@ -260,16 +278,20 @@ export const resourceAiModels = sqliteTable(
    (t) => [primaryKey({ columns: [t.resourceId, t.modelId] })]
 );

-export const labels = sqliteTable("labels", {
-    labelId: integer("labelId").primaryKey({ autoIncrement: true }),
-    name: text("name").notNull(),
-    color: text("color").notNull(),
-    orgId: text("orgId")
-        .references(() => orgs.orgId, {
-            onDelete: "cascade"
-        })
-        .notNull()
-});
+export const labels = sqliteTable(
+    "labels",
+    {
+        labelId: integer("labelId").primaryKey({ autoIncrement: true }),
+        name: text("name").notNull(),
+        color: text("color").notNull(),
+        orgId: text("orgId")
+            .references(() => orgs.orgId, {
+                onDelete: "cascade"
+            })
+            .notNull()
+    },
+    (table) => [index("idx_labels_orgId").on(table.orgId)]
+);

 export const launcherViews = sqliteTable("launcherViews", {
    viewId: integer("viewId").primaryKey({ autoIncrement: true }),
@@ -366,35 +388,46 @@ export const clientLabels = sqliteTable(
    (t) => [unique("client_label_uniq").on(t.clientId, t.labelId)]
 );

-export const targets = sqliteTable("targets", {
-    targetId: integer("targetId").primaryKey({ autoIncrement: true }),
-    resourceId: integer("resourceId").references(() => resources.resourceId, {
-        onDelete: "cascade"
-    }),
-    providerId: integer("providerId").references(() => aiProviders.providerId, {
-        onDelete: "cascade"
-    }),
-    siteId: integer("siteId")
-        .references(() => sites.siteId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
-    ip: text("ip").notNull(),
-    method: text("method"),
-    port: integer("port").notNull(),
-    internalPort: integer("internalPort"),
-    enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
-    path: text("path"),
-    pathMatchType: text("pathMatchType"), // exact, prefix, regex
-    rewritePath: text("rewritePath"), // if set, rewrites the path to this value before sending to the target
-    rewritePathType: text("rewritePathType"), // exact, prefix, regex, stripPrefix
-    priority: integer("priority").notNull().default(100),
-    mode: text("mode")
-        .$type<"http" | "tcp" | "udp" | "ssh" | "rdp" | "vnc">()
-        .notNull()
-        .default("http"),
-    authToken: text("authToken")
-});
+export const targets = sqliteTable(
+    "targets",
+    {
+        targetId: integer("targetId").primaryKey({ autoIncrement: true }),
+        resourceId: integer("resourceId").references(
+            () => resources.resourceId,
+            { onDelete: "cascade" }
+        ),
+        providerId: integer("providerId").references(
+            () => aiProviders.providerId,
+            { onDelete: "cascade" }
+        ),
+        siteId: integer("siteId")
+            .references(() => sites.siteId, {
+                onDelete: "cascade"
+            })
+            .notNull(),
+        ip: text("ip").notNull(),
+        method: text("method"),
+        port: integer("port").notNull(),
+        internalPort: integer("internalPort"),
+        enabled: integer("enabled", { mode: "boolean" })
+            .notNull()
+            .default(true),
+        path: text("path"),
+        pathMatchType: text("pathMatchType"), // exact, prefix, regex
+        rewritePath: text("rewritePath"), // if set, rewrites the path to this value before sending to the target
+        rewritePathType: text("rewritePathType"), // exact, prefix, regex, stripPrefix
+        priority: integer("priority").notNull().default(100),
+        mode: text("mode")
+            .$type<"http" | "tcp" | "udp" | "ssh" | "rdp" | "vnc">()
+            .notNull()
+            .default("http"),
+        authToken: text("authToken")
+    },
+    (table) => [
+        index("idx_targets_resourceId").on(table.resourceId),
+        index("idx_targets_siteId").on(table.siteId)
+    ]
+);

 export const targetHealthCheck = sqliteTable("targetHealthCheck", {
    targetHealthCheckId: integer("targetHealthCheckId").primaryKey({
@@ -663,50 +696,65 @@ export const setupTokens = sqliteTable("setupTokens", {
    dateUsed: text("dateUsed")
 });

-export const newts = sqliteTable("newt", {
-    newtId: text("id").primaryKey(),
-    secretHash: text("secretHash").notNull(),
-    dateCreated: text("dateCreated").notNull(),
-    version: text("version"),
-    siteId: integer("siteId").references(() => sites.siteId, {
-        onDelete: "cascade"
-    })
-});
-
-export const clients = sqliteTable("clients", {
-    clientId: integer("clientId").primaryKey({ autoIncrement: true }),
-    orgId: text("orgId")
-        .references(() => orgs.orgId, {
+export const newts = sqliteTable(
+    "newt",
+    {
+        newtId: text("id").primaryKey(),
+        secretHash: text("secretHash").notNull(),
+        dateCreated: text("dateCreated").notNull(),
+        version: text("version"),
+        siteId: integer("siteId").references(() => sites.siteId, {
            onDelete: "cascade"
        })
-        .notNull(),
-    exitNodeId: integer("exitNode").references(() => exitNodes.exitNodeId, {
-        onDelete: "set null"
-    }),
-    userId: text("userId").references(() => users.userId, {
-        // optionally tied to a user and in this case delete when the user deletes
-        onDelete: "cascade"
-    }),
-    niceId: text("niceId").notNull(),
-    name: text("name").notNull(),
-    pubKey: text("pubKey"),
-    olmId: text("olmId"), // to lock it to a specific olm optionally
-    subnet: text("subnet").notNull(),
-    exitNodeSubnet: text("exitNodeSubnet"), // this is the subnet when connecting to an exit node
-    megabytesIn: integer("bytesIn"),
-    megabytesOut: integer("bytesOut"),
-    lastBandwidthUpdate: text("lastBandwidthUpdate"),
-    lastPing: integer("lastPing"),
-    type: text("type").notNull(), // "olm"
-    online: integer("online", { mode: "boolean" }).notNull().default(false),
-    // endpoint: text("endpoint"),
-    lastHolePunch: integer("lastHolePunch"),
-    archived: integer("archived", { mode: "boolean" }).notNull().default(false),
-    blocked: integer("blocked", { mode: "boolean" }).notNull().default(false),
-    approvalState: text("approvalState").$type<
-        "pending" | "approved" | "denied"
-    >()
-});
+    },
+    (table) => [index("idx_newts_siteId").on(table.siteId)]
+);
+
+export const clients = sqliteTable(
+    "clients",
+    {
+        clientId: integer("clientId").primaryKey({ autoIncrement: true }),
+        orgId: text("orgId")
+            .references(() => orgs.orgId, {
+                onDelete: "cascade"
+            })
+            .notNull(),
+        exitNodeId: integer("exitNode").references(() => exitNodes.exitNodeId, {
+            onDelete: "set null"
+        }),
+        userId: text("userId").references(() => users.userId, {
+            // optionally tied to a user and in this case delete when the user deletes
+            onDelete: "cascade"
+        }),
+        niceId: text("niceId").notNull(),
+        name: text("name").notNull(),
+        pubKey: text("pubKey"),
+        olmId: text("olmId"), // to lock it to a specific olm optionally
+        subnet: text("subnet").notNull(),
+        exitNodeSubnet: text("exitNodeSubnet"), // this is the subnet when connecting to an exit node
+        megabytesIn: integer("bytesIn"),
+        megabytesOut: integer("bytesOut"),
+        lastBandwidthUpdate: text("lastBandwidthUpdate"),
+        lastPing: integer("lastPing"),
+        type: text("type").notNull(), // "olm"
+        online: integer("online", { mode: "boolean" }).notNull().default(false),
+        // endpoint: text("endpoint"),
+        lastHolePunch: integer("lastHolePunch"),
+        archived: integer("archived", { mode: "boolean" })
+            .notNull()
+            .default(false),
+        blocked: integer("blocked", { mode: "boolean" })
+            .notNull()
+            .default(false),
+        approvalState: text("approvalState").$type<
+            "pending" | "approved" | "denied"
+        >()
+    },
+    (table) => [
+        index("idx_clients_orgId").on(table.orgId),
+        index("idx_clients_userId").on(table.userId)
+    ]
+);

 export const clientSitesAssociationsCache = sqliteTable(
    "clientSitesAssociationsCache",
@@ -734,23 +782,29 @@ export const clientSiteResourcesAssociationsCache = sqliteTable(
    }
 );

-export const olms = sqliteTable("olms", {
-    olmId: text("id").primaryKey(),
-    secretHash: text("secretHash").notNull(),
-    dateCreated: text("dateCreated").notNull(),
-    version: text("version"),
-    agent: text("agent"),
-    name: text("name"),
-    clientId: integer("clientId").references(() => clients.clientId, {
-        // we will switch this depending on the current org it wants to connect to
-        onDelete: "set null"
-    }),
-    userId: text("userId").references(() => users.userId, {
-        // optionally tied to a user and in this case delete when the user deletes
-        onDelete: "cascade"
-    }),
-    archived: integer("archived", { mode: "boolean" }).notNull().default(false)
-});
+export const olms = sqliteTable(
+    "olms",
+    {
+        olmId: text("id").primaryKey(),
+        secretHash: text("secretHash").notNull(),
+        dateCreated: text("dateCreated").notNull(),
+        version: text("version"),
+        agent: text("agent"),
+        name: text("name"),
+        clientId: integer("clientId").references(() => clients.clientId, {
+            // we will switch this depending on the current org it wants to connect to
+            onDelete: "set null"
+        }),
+        userId: text("userId").references(() => users.userId, {
+            // optionally tied to a user and in this case delete when the user deletes
+            onDelete: "cascade"
+        }),
+        archived: integer("archived", { mode: "boolean" })
+            .notNull()
+            .default(false)
+    },
+    (table) => [index("idx_olms_userId").on(table.userId)]
+);

 export const currentFingerprint = sqliteTable("currentFingerprint", {
    fingerprintId: integer("id").primaryKey({ autoIncrement: true }),
@@ -912,17 +966,21 @@ export const twoFactorBackupCodes = sqliteTable("twoFactorBackupCodes", {
    codeHash: text("codeHash").notNull()
 });

-export const sessions = sqliteTable("session", {
-    sessionId: text("id").primaryKey(),
-    userId: text("userId")
-        .notNull()
-        .references(() => users.userId, { onDelete: "cascade" }),
-    expiresAt: integer("expiresAt").notNull(),
-    issuedAt: integer("issuedAt"),
-    deviceAuthUsed: integer("deviceAuthUsed", { mode: "boolean" })
-        .notNull()
-        .default(false)
-});
+export const sessions = sqliteTable(
+    "session",
+    {
+        sessionId: text("id").primaryKey(),
+        userId: text("userId")
+            .notNull()
+            .references(() => users.userId, { onDelete: "cascade" }),
+        expiresAt: integer("expiresAt").notNull(),
+        issuedAt: integer("issuedAt"),
+        deviceAuthUsed: integer("deviceAuthUsed", { mode: "boolean" })
+            .notNull()
+            .default(false)
+    },
+    (table) => [index("idx_sessions_userId").on(table.userId)]
+);

 export const newtSessions = sqliteTable("newtSession", {
    sessionId: text("id").primaryKey(),
@@ -940,21 +998,30 @@ export const olmSessions = sqliteTable("clientSession", {
    expiresAt: integer("expiresAt").notNull()
 });

-export const userOrgs = sqliteTable("userOrgs", {
-    userId: text("userId")
-        .notNull()
-        .references(() => users.userId, { onDelete: "cascade" }),
-    orgId: text("orgId")
-        .references(() => orgs.orgId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
-    isOwner: integer("isOwner", { mode: "boolean" }).notNull().default(false),
-    autoProvisioned: integer("autoProvisioned", {
-        mode: "boolean"
-    }).default(false),
-    pamUsername: text("pamUsername") // cleaned username for ssh and such
-});
+export const userOrgs = sqliteTable(
+    "userOrgs",
+    {
+        userId: text("userId")
+            .notNull()
+            .references(() => users.userId, { onDelete: "cascade" }),
+        orgId: text("orgId")
+            .references(() => orgs.orgId, {
+                onDelete: "cascade"
+            })
+            .notNull(),
+        isOwner: integer("isOwner", { mode: "boolean" })
+            .notNull()
+            .default(false),
+        autoProvisioned: integer("autoProvisioned", {
+            mode: "boolean"
+        }).default(false),
+        pamUsername: text("pamUsername") // cleaned username for ssh and such
+    },
+    (table) => [
+        index("idx_userOrgs_userId").on(table.userId),
+        index("idx_userOrgs_orgId").on(table.orgId)
+    ]
+);

 export const emailVerificationCodes = sqliteTable("emailVerificationCodes", {
    codeId: integer("id").primaryKey({ autoIncrement: true }),
@@ -982,26 +1049,30 @@ export const actions = sqliteTable("actions", {
    description: text("description")
 });

-export const roles = sqliteTable("roles", {
-    roleId: integer("roleId").primaryKey({ autoIncrement: true }),
-    orgId: text("orgId")
-        .references(() => orgs.orgId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
-    isAdmin: integer("isAdmin", { mode: "boolean" }),
-    name: text("name").notNull(),
-    description: text("description"),
-    requireDeviceApproval: integer("requireDeviceApproval", {
-        mode: "boolean"
-    }).default(false),
-    sshSudoMode: text("sshSudoMode").default("full"), // "none" | "full" | "commands"
-    sshSudoCommands: text("sshSudoCommands").default("[]"),
-    sshCreateHomeDir: integer("sshCreateHomeDir", { mode: "boolean" }).default(
-        true
-    ),
-    sshUnixGroups: text("sshUnixGroups").default("[]")
-});
+export const roles = sqliteTable(
+    "roles",
+    {
+        roleId: integer("roleId").primaryKey({ autoIncrement: true }),
+        orgId: text("orgId")
+            .references(() => orgs.orgId, {
+                onDelete: "cascade"
+            })
+            .notNull(),
+        isAdmin: integer("isAdmin", { mode: "boolean" }),
+        name: text("name").notNull(),
+        description: text("description"),
+        requireDeviceApproval: integer("requireDeviceApproval", {
+            mode: "boolean"
+        }).default(false),
+        sshSudoMode: text("sshSudoMode").default("full"), // "none" | "full" | "commands"
+        sshSudoCommands: text("sshSudoCommands").default("[]"),
+        sshCreateHomeDir: integer("sshCreateHomeDir", {
+            mode: "boolean"
+        }).default(true),
+        sshUnixGroups: text("sshUnixGroups").default("[]")
+    },
+    (table) => [index("idx_roles_orgId").on(table.orgId)]
+);

 export const userOrgRoles = sqliteTable(
    "userOrgRoles",
@@ -1928,91 +1999,6 @@ export const aiBudgetBreachEvents = sqliteTable(
    ]
 );

-// Logs the aggregated prompt + response for a single AI gateway request, for
-// session replay. One row per request (not per streaming chunk). `sessionId`
-// is a fresh random id per row for now - no cross-request correlation yet,
-// but the column exists so a future pass can link multiple rows into a real
-// multi-turn session.
-export const aiSessionLog = sqliteTable(
-    "aiSessionLog",
-    {
-        id: integer("id").primaryKey({ autoIncrement: true }),
-        sessionId: text("sessionId").notNull(),
-        orgId: text("orgId").references(() => orgs.orgId, {
-            onDelete: "cascade"
-        }),
-        providerId: integer("providerId").references(
-            () => aiProviders.providerId,
-            { onDelete: "set null" }
-        ),
-        capability: text("capability").notNull(),
-        resourceId: integer("resourceId").references(
-            () => resources.resourceId,
-            { onDelete: "set null" }
-        ),
-        siteResourceId: integer("siteResourceId").references(
-            () => siteResources.siteResourceId,
-            { onDelete: "set null" }
-        ),
-        userId: text("userId").references(() => users.userId, {
-            onDelete: "set null"
-        }),
-        virtualApiKeyId: text("virtualApiKeyId").references(
-            () => virtualApiKeys.virtualApiKeyId,
-            { onDelete: "set null" }
-        ),
-        requestedModel: text("requestedModel"),
-        isStream: integer("isStream", { mode: "boolean" })
-            .notNull()
-            .default(false),
-        requestBody: text("requestBody"),
-        responseBody: text("responseBody"),
-        // Capability-agnostic message transcript (JSON-encoded
-        // NormalizedAiMessage[] from server/lib/aiMessageNormalization.ts),
-        // computed at write time so search/display never need per-capability
-        // parsing logic. Null when normalization couldn't recognize the
-        // shape - callers fall back to requestBody/responseBody.
-        normalizedRequest: text("normalizedRequest"),
-        normalizedResponse: text("normalizedResponse"),
-        // True if any of the request/response (raw or normalized) fields
-        // were cut short at AI_SESSION_LOG_MAX_BODY_CHARS before storage.
-        truncated: integer("truncated", { mode: "boolean" })
-            .notNull()
-            .default(false),
-        statusCode: integer("statusCode"),
-        createdAt: integer("createdAt").notNull() // epoch ms
-    },
-    (t) => [
-        index("idx_ai_session_log_org_created").on(t.orgId, t.createdAt),
-        index("idx_ai_session_log_org_provider_created").on(
-            t.orgId,
-            t.providerId,
-            t.createdAt
-        ),
-        index("idx_ai_session_log_org_resource_created").on(
-            t.orgId,
-            t.resourceId,
-            t.createdAt
-        ),
-        index("idx_ai_session_log_org_site_resource_created").on(
-            t.orgId,
-            t.siteResourceId,
-            t.createdAt
-        ),
-        index("idx_ai_session_log_org_user_created").on(
-            t.orgId,
-            t.userId,
-            t.createdAt
-        ),
-        index("idx_ai_session_log_org_virtual_api_key_created").on(
-            t.orgId,
-            t.virtualApiKeyId,
-            t.createdAt
-        ),
-        index("idx_ai_session_log_session").on(t.sessionId)
-    ]
-);
-
 export const certificates = sqliteTable("certificates", {
    certId: integer("certId").primaryKey({ autoIncrement: true }),
    domain: text("domain").notNull().unique(),
@@ -2123,7 +2109,6 @@ export type AiModel = InferSelectModel<typeof aiModels>;
 export type AiBudget = InferSelectModel<typeof aiBudgets>;
 export type AiUsageRecord = InferSelectModel<typeof aiUsageRecords>;
 export type AiBudgetBreachEvent = InferSelectModel<typeof aiBudgetBreachEvents>;
-export type AiSessionLog = InferSelectModel<typeof aiSessionLog>;
 export type ResourceAiProvider = InferSelectModel<typeof resourceAiProviders>;
 export type SiteResourceAiProvider = InferSelectModel<
    typeof siteResourceAiProviders
@@ -16,7 +16,7 @@ import { registry, openApiTags } from "./openApi";
 import fs from "fs";
 import path from "path";
 import { APP_PATH } from "./lib/consts";
-import yaml from "js-yaml";
+import * as yaml from "js-yaml";
 import { z } from "zod";

 const dev = process.env.ENVIRONMENT !== "prod";
@@ -580,6 +580,8 @@ export async function recordUsage(input: UsageRecordInput): Promise<void> {
            );
        }

+        const timestamp = Math.floor(Date.now() / 1000);
+
        usageRecordBuffer.push({
            orgId: input.orgId,
            providerId: input.providerId,
@@ -597,7 +599,7 @@ export async function recordUsage(input: UsageRecordInput): Promise<void> {
            totalTokens,
            costUsd: input.costUsd,
            estimated: usage.estimated,
-            createdAt: input.createdAt ?? Date.now()
+            createdAt: input.createdAt ?? timestamp
        });

        // Flush immediately if buffer is full, otherwise schedule a flush
@@ -4,7 +4,7 @@ import { AI_CAPABILITIES, type AiCapability } from "@app/lib/aiCapabilities";
 export { AI_CAPABILITIES, type AiCapability };

 export type AiCapabilityRoute = {
-    method: "POST";
+    method: "GET" | "POST";
    path: string;
 };

@@ -135,6 +135,21 @@ export const AI_CAPABILITY_DEFS: Record<AiCapability, AiCapabilityDefinition> =
                joinUpstreamUrl(base, pathFromRequest(req)),
            isStreaming: isBodyOrSseStreaming
        },
+        v1_models: {
+            id: "v1_models",
+            protocolFamily: "anthropic",
+            routes: [
+                { method: "GET", path: "/v1/models" },
+                { method: "GET", path: "/v1/models/:model" }
+            ],
+            extractModel: paramModel,
+            resolveUpstreamUrl: (base, req) =>
+                joinUpstreamUrl(base, pathFromRequest(req)),
+            // Model listings are answered from the gateway's own view of the
+            // provider allow/block lists rather than proxied upstream, so
+            // there is never a stream to detect.
+            isStreaming: () => false
+        },
        gemini_generate_content: {
            id: "gemini_generate_content",
            protocolFamily: "google",
@@ -471,6 +471,8 @@ const REQUEST_NORMALIZERS: Record<
    openai_chat: normalizeOpenAiChatRequest,
    openai_responses: normalizeOpenAiResponsesRequest,
    anthropic_messages: normalizeAnthropicRequest,
+    // Model discovery carries no transcript to normalize.
+    v1_models: () => null,
    gemini_generate_content: normalizeGeminiRequest,
    google_generate_content: normalizeGeminiRequest,
    google_raw_predict: normalizeBestEffortRequest,
@@ -485,6 +487,7 @@ const RESPONSE_NORMALIZERS: Record<
    openai_chat: normalizeOpenAiChatResponse,
    openai_responses: normalizeOpenAiResponsesResponse,
    anthropic_messages: normalizeAnthropicResponse,
+    v1_models: () => null,
    gemini_generate_content: normalizeGeminiResponse,
    google_generate_content: normalizeGeminiResponse,
    google_raw_predict: normalizeGoogleRawPredictResponse,
@@ -44,6 +44,20 @@ export function getCatalogProviderForType(
    return PROVIDER_CATALOG_MAP[type];
 }

+/**
+ * Per-model feature flags as reported upstream. `null` means the catalog has
+ * no data for that model - deliberately distinct from `false`, so consumers
+ * can tell "unsupported" apart from "unknown".
+ */
+export type AiModelCapabilityFlags = {
+    functionCalling: boolean | null;
+    vision: boolean | null;
+    promptCaching: boolean | null;
+    reasoning: boolean | null;
+    responseSchema: boolean | null;
+    webSearch: boolean | null;
+};
+
 export type AiModelCatalogEntry = {
    provider: CatalogProvider;
    model: string;
@@ -53,8 +67,20 @@ export type AiModelCatalogEntry = {
        cache: number | null;
        reasoning: number | null;
    };
+    limits: {
+        /** Context window. */
+        input: number | null;
+        /** Cap on the output/max_tokens request parameter. */
+        output: number | null;
+    };
+    capabilities: AiModelCapabilityFlags;
 };

+const flag = z.boolean().nullable().optional();
+
+// limits/capabilities are optional so a catalog published before they were
+// added (or an operator's own merge_file) still parses - those entries just
+// report unknown metadata rather than failing the whole payload.
 const catalogEntrySchema = z.object({
    model: z.string(),
    provider: z.string(),
@@ -65,6 +91,22 @@ const catalogEntrySchema = z.object({
            cache: z.number().nullable().optional(),
            reasoning: z.number().nullable().optional()
        })
+        .optional(),
+    limits: z
+        .object({
+            input: z.number().nullable().optional(),
+            output: z.number().nullable().optional()
+        })
+        .optional(),
+    capabilities: z
+        .object({
+            functionCalling: flag,
+            vision: flag,
+            promptCaching: flag,
+            reasoning: flag,
+            responseSchema: flag,
+            webSearch: flag
+        })
        .optional()
 });

@@ -108,6 +150,18 @@ function normalizeEntry(raw: RawCatalogEntry): AiModelCatalogEntry | null {
            out: raw.pricing?.out ?? null,
            cache: raw.pricing?.cache ?? null,
            reasoning: raw.pricing?.reasoning ?? null
+        },
+        limits: {
+            input: raw.limits?.input ?? null,
+            output: raw.limits?.output ?? null
+        },
+        capabilities: {
+            functionCalling: raw.capabilities?.functionCalling ?? null,
+            vision: raw.capabilities?.vision ?? null,
+            promptCaching: raw.capabilities?.promptCaching ?? null,
+            reasoning: raw.capabilities?.reasoning ?? null,
+            responseSchema: raw.capabilities?.responseSchema ?? null,
+            webSearch: raw.capabilities?.webSearch ?? null
        }
    };
 }
@@ -284,34 +338,44 @@ export class AiModelCatalog {

 export const aiModelCatalog = new AiModelCatalog();

+/**
+ * Full catalog entries for a provider type, deduplicated by model id and
+ * sorted by id. Model discovery uses these to report real token limits and
+ * capability flags; `listCatalogModelsForType` is the id-only view of the
+ * same list.
+ */
+export function listCatalogEntriesForType(
+    type: AiProviderType,
+    query?: string
+): AiModelCatalogEntry[] {
+    const catalogProvider = getCatalogProviderForType(type);
+
+    let entries = catalogProvider ? aiModelCatalog.list(catalogProvider) : [];
+
+    if (query) {
+        const q = query.toLowerCase();
+        entries = entries.filter((e) => e.model.toLowerCase().includes(q));
+    }
+
+    const seen = new Set<string>();
+    entries = entries.filter((e) => {
+        if (seen.has(e.model)) {
+            return false;
+        }
+        seen.add(e.model);
+        return true;
+    });
+
+    return [...entries].sort((a, b) => a.model.localeCompare(b.model));
+}
+
 export function listCatalogModelsForType(
    type: AiProviderType,
    query?: string
 ): { model: string }[] {
-    const catalogProvider = getCatalogProviderForType(type);
-
-    let models = catalogProvider
-        ? aiModelCatalog.list(catalogProvider).map((entry) => ({
-              model: entry.model
-          }))
-        : [];
-
-    if (query) {
-        const q = query.toLowerCase();
-        models = models.filter((m) => m.model.toLowerCase().includes(q));
-    }
-
-    const seen = new Set<string>();
-    models = models.filter((m) => {
-        if (seen.has(m.model)) {
-            return false;
-        }
-        seen.add(m.model);
-        return true;
-    });
-
-    models.sort((a, b) => a.model.localeCompare(b.model));
-    return models;
+    return listCatalogEntriesForType(type, query).map((entry) => ({
+        model: entry.model
+    }));
 }

 /**
@@ -0,0 +1,235 @@
+import {
+    isAllowedByLists,
+    isModelKeyPattern
+} from "@server/lib/aiModelKeyMatch";
+import type { AiModelCapabilityFlags } from "@server/lib/aiModelCatalog";
+
+// Anthropic's Models API pagination: 20 per page by default, 1..1000.
+export const MODEL_PAGE_DEFAULT_LIMIT = 20;
+export const MODEL_PAGE_MAX_LIMIT = 1000;
+
+// Release dates aren't something we can know for a wildcard allow pattern or a
+// catalog entry. The Models API explicitly permits an epoch value when the
+// release date is unknown.
+const UNKNOWN_CREATED_AT = new Date(0).toISOString();
+
+/**
+ * One entry of Anthropic's `GET /v1/models` response. Only the identity fields
+ * can be filled in from a provider's model lists - token limits and
+ * per-model capability flags aren't derivable from an allow/block list, and the
+ * API schema declares all three nullable.
+ */
+export type AnthropicModelInfo = {
+    type: "model";
+    id: string;
+    display_name: string;
+    created_at: string;
+    max_input_tokens: number | null;
+    max_tokens: number | null;
+    capabilities: Record<string, unknown> | null;
+};
+
+/** A model row an administrator configured explicitly on a provider. */
+export type ConfiguredModel = { name: string; createdAt: number };
+
+/** What the pricing catalog knows about a model beyond its id. */
+export type CatalogModelMetadata = {
+    maxInputTokens: number | null;
+    maxOutputTokens: number | null;
+    capabilities: AiModelCapabilityFlags;
+};
+
+/**
+ * Translates the catalog's flat feature flags into the nested shape
+ * Anthropic's Models API uses. Best-effort by nature: the catalog carries a
+ * coarser set of flags than the Models API describes, so anything it reports
+ * as unknown (`null`) is surfaced as unsupported rather than invented.
+ */
+export function capabilitiesFromCatalog(
+    flags: AiModelCapabilityFlags
+): Record<string, unknown> {
+    const supported = (value: boolean | null) => ({
+        supported: value === true
+    });
+    // The catalog has a single `reasoning` flag and no way to distinguish
+    // adaptive from budget_tokens-style thinking, so both variants follow it.
+    const reasoning = flags.reasoning === true;
+
+    return {
+        batch: supported(null),
+        citations: supported(null),
+        code_execution: supported(null),
+        context_management: {
+            supported: false,
+            clear_thinking_20251015: null,
+            clear_tool_uses_20250919: null,
+            compact_20260112: null
+        },
+        effort: {
+            supported: reasoning,
+            low: supported(flags.reasoning),
+            medium: supported(flags.reasoning),
+            high: supported(flags.reasoning),
+            max: supported(flags.reasoning),
+            xhigh: null
+        },
+        image_input: supported(flags.vision),
+        pdf_input: supported(null),
+        structured_outputs: supported(flags.responseSchema),
+        thinking: {
+            supported: reasoning,
+            types: {
+                adaptive: { supported: reasoning },
+                enabled: { supported: reasoning }
+            }
+        }
+    };
+}
+
+/**
+ * One attached provider's contribution to a resource's model listing, with the
+ * allow/block lists already resolved for the attachment's access mode.
+ */
+export type ModelDiscoveryProvider = {
+    providerId: number;
+    allows: string[];
+    blocks: string[];
+    /**
+     * Concrete model ids the provider's type is known to serve, with whatever
+     * the catalog knows about each. This is what lets a wildcard allow such as
+     * `claude-*` enumerate into real ids; provider types with no catalog
+     * (aggregators, custom) pass an empty map and surface only their exact
+     * allow entries.
+     */
+    catalog: Map<string, CatalogModelMetadata>;
+    /** Keyed by model key, for display names and creation times. */
+    configured: Map<string, ConfiguredModel>;
+};
+
+export type ModelPage = {
+    data: AnthropicModelInfo[];
+    has_more: boolean;
+};
+
+/**
+ * Expands one provider's effective allow/block lists into concrete model ids.
+ * Two sources feed the candidate set: exact (non-wildcard) allow entries, which
+ * are already concrete ids, and the catalog for the provider's type, which is
+ * what makes wildcard allows enumerable. Every candidate is then run back
+ * through the same allow/block check the inference pipeline applies, so a block
+ * pattern hides a model here exactly as it would reject it at request time.
+ */
+export function expandProviderModels(
+    provider: ModelDiscoveryProvider
+): AnthropicModelInfo[] {
+    const candidates = new Set<string>();
+
+    for (const allow of provider.allows) {
+        if (!isModelKeyPattern(allow)) {
+            candidates.add(allow);
+        }
+    }
+    for (const modelId of provider.catalog.keys()) {
+        candidates.add(modelId);
+    }
+
+    const models: AnthropicModelInfo[] = [];
+    for (const modelKey of candidates) {
+        if (!isAllowedByLists(modelKey, provider.allows, provider.blocks)) {
+            continue;
+        }
+        const configured = provider.configured.get(modelKey);
+        const catalog = provider.catalog.get(modelKey);
+
+        models.push({
+            type: "model",
+            id: modelKey,
+            display_name: configured?.name || modelKey,
+            created_at: configured
+                ? new Date(configured.createdAt).toISOString()
+                : UNKNOWN_CREATED_AT,
+            max_input_tokens: catalog?.maxInputTokens ?? null,
+            max_tokens: catalog?.maxOutputTokens ?? null,
+            capabilities: catalog
+                ? capabilitiesFromCatalog(catalog.capabilities)
+                : null
+        });
+    }
+
+    return models;
+}
+
+/**
+ * Aggregates the permitted models across every provider attached to a
+ * resource. Unlike an inference request there is no requested model to
+ * disambiguate on, so no provider selection happens - the listing is the union
+ * of what each provider would accept, deduplicated by model id.
+ */
+export function listPermittedModels(
+    providers: ModelDiscoveryProvider[]
+): AnthropicModelInfo[] {
+    const byModelId = new Map<string, AnthropicModelInfo>();
+
+    // Sorted so a model offered by two providers always resolves to the same
+    // entry, which keeps the cursor ordering stable across requests.
+    const ordered = [...providers].sort((a, b) => a.providerId - b.providerId);
+
+    for (const provider of ordered) {
+        for (const model of expandProviderModels(provider)) {
+            if (!byModelId.has(model.id)) {
+                byModelId.set(model.id, model);
+            }
+        }
+    }
+
+    // "More recently released models are listed first" per the Models API,
+    // with the id as a tie-break so the ordering is total - cursor pagination
+    // needs it to be stable between calls.
+    return [...byModelId.values()].sort((a, b) => {
+        const byCreated = b.created_at.localeCompare(a.created_at);
+        return byCreated !== 0 ? byCreated : a.id.localeCompare(b.id);
+    });
+}
+
+/**
+ * Applies Anthropic's cursor pagination to an ordered model list. `after_id`
+ * returns the page immediately after that model, `before_id` the page
+ * immediately before it. Returns an error message for a caller mistake
+ * (both cursors, or a cursor naming a model that isn't in the list).
+ */
+export function paginateModels(
+    models: AnthropicModelInfo[],
+    limit: number,
+    cursor: { afterId?: string; beforeId?: string }
+): ModelPage | { error: string } {
+    if (cursor.afterId && cursor.beforeId) {
+        return { error: "Only one of after_id and before_id may be provided" };
+    }
+
+    const cursorId = cursor.afterId ?? cursor.beforeId;
+    if (!cursorId) {
+        return {
+            data: models.slice(0, limit),
+            has_more: models.length > limit
+        };
+    }
+
+    const index = models.findIndex((model) => model.id === cursorId);
+    if (index === -1) {
+        return { error: `Unknown cursor id "${cursorId}"` };
+    }
+
+    if (cursor.afterId) {
+        const start = index + 1;
+        return {
+            data: models.slice(start, start + limit),
+            has_more: models.length > start + limit
+        };
+    }
+
+    const start = Math.max(0, index - limit);
+    return {
+        data: models.slice(start, index),
+        has_more: start > 0
+    };
+}
@@ -335,6 +335,8 @@ const EXTRACTORS: Record<
    openai_chat: extractOpenAiChat,
    openai_responses: extractOpenAiResponses,
    anthropic_messages: extractAnthropicMessages,
+    // Model discovery never runs a model, so there are no tokens to bill.
+    v1_models: () => null,
    gemini_generate_content: extractGoogleGenerateContent,
    google_generate_content: extractGoogleGenerateContent,
    // rawPredict is a passthrough to whatever the underlying publisher
@@ -9,6 +9,7 @@ export enum TierFeature {
    AccessLogs = "accessLogs", // set the retention period to none on downgrade
    ActionLogs = "actionLogs", // set the retention period to none on downgrade
    ConnectionLogs = "connectionLogs",
+    AISessionLogs = "aiSessionLogs",
    RotateCredentials = "rotateCredentials",
    MaintenancePage = "maintenancePage", // handle downgrade
    DevicePosture = "devicePosture",
@@ -37,6 +38,7 @@ export const tierMatrix: Record<TierFeature, Tier[]> = {
    [TierFeature.AccessLogs]: ["tier2", "tier3", "enterprise"],
    [TierFeature.ActionLogs]: ["tier2", "tier3", "enterprise"],
    [TierFeature.ConnectionLogs]: ["tier2", "tier3", "enterprise"],
+    [TierFeature.AISessionLogs]: ["tier2", "tier3", "enterprise"],
    [TierFeature.RotateCredentials]: ["tier1", "tier2", "tier3", "enterprise"],
    [TierFeature.MaintenancePage]: ["tier1", "tier2", "tier3", "enterprise"],
    [TierFeature.DevicePosture]: ["tier2", "tier3", "enterprise"],
@@ -1,5 +1,6 @@
 import {
    db,
+    primaryDb,
    newts,
    blueprints,
    Blueprint,
@@ -80,35 +81,53 @@ export async function applyBlueprint({
                trx,
                siteId
            );
+        });

-            // We need to update the targets on the newts from the successfully updated information
-            for (const result of publicResourcesResults) {
-                for (const target of result.targetsToUpdate) {
-                    const [site] = await trx
-                        .select()
-                        .from(sites)
-                        .innerJoin(newts, eq(sites.siteId, newts.siteId))
-                        .where(
-                            and(
-                                eq(sites.siteId, target.siteId),
-                                eq(sites.orgId, orgId),
-                                eq(sites.type, "newt"),
-                                isNotNull(sites.pubKey)
-                            )
+        // Push updates to newts/clients only after the transaction has
+        // committed. Doing this while the transaction is still open can
+        // race with the writes (e.g. newts requesting config before the
+        // new targets/resources are actually visible), leaving them out
+        // of sync until manually toggled.
+
+        // We need to update the targets on the newts from the successfully updated information
+        for (const result of publicResourcesResults) {
+            for (const target of result.targetsToUpdate) {
+                // read from the primary: this determines whether/how we push
+                // the just-created target to the newt, so a lagging replica
+                // returning stale or missing data here would silently skip
+                // the push
+                const [site] = await primaryDb
+                    .select()
+                    .from(sites)
+                    .innerJoin(newts, eq(sites.siteId, newts.siteId))
+                    .where(
+                        and(
+                            eq(sites.siteId, target.siteId),
+                            eq(sites.orgId, orgId),
+                            eq(sites.type, "newt"),
+                            isNotNull(sites.pubKey)
                        )
-                        .limit(1);
+                    )
+                    .limit(1);

-                    if (site) {
-                        logger.debug(
-                            `Updating target ${target.targetId} on site ${site.sites.siteId}`
+                if (site) {
+                    logger.debug(
+                        `Updating target ${target.targetId} on site ${site.sites.siteId}`
+                    );
+
+                    // see if you can find a matching target health check from the healthchecksToUpdate array
+                    const matchingHealthcheck =
+                        result.healthchecksToUpdate.find(
+                            (hc) => hc.targetId === target.targetId
                        );

-                        // see if you can find a matching target health check from the healthchecksToUpdate array
-                        const matchingHealthcheck =
-                            result.healthchecksToUpdate.find(
-                                (hc) => hc.targetId === target.targetId
-                            );
-
+                    // The DB writes for all resources have already committed
+                    // by this point, so a push failure for one target (e.g.
+                    // a newt rejecting a malformed health check) must not
+                    // abort pushing the rest, and must not mark the whole
+                    // blueprint as failed when the config was actually
+                    // persisted successfully.
+                    try {
                        if (["http", "tcp", "udp"].includes(target.mode)) {
                            await addProxyTargets(
                                site.newt.newtId,
@@ -130,43 +149,47 @@ export async function applyBlueprint({
                                site.newt.version
                            );
                        }
+                    } catch (e) {
+                        logger.error(
+                            `Failed to push target ${target.targetId} to newt on site ${site.sites.siteId}. Error: ${e}`
+                        );
                    }
                }
            }
+        }

-            logger.debug(
-                `Successfully updated public resources for org ${orgId}: ${JSON.stringify(publicResourcesResults)}`
-            );
+        logger.debug(
+            `Successfully updated public resources for org ${orgId}: ${JSON.stringify(publicResourcesResults)}`
+        );

-            // We need to update the targets on the newts from the successfully updated information
-            for (const result of privateResourcesResults) {
-                rebuildClientAssociationsFromSiteResource(
-                    result.newSiteResource
+        // We need to update the targets on the newts from the successfully updated information
+        for (const result of privateResourcesResults) {
+            rebuildClientAssociationsFromSiteResource(
+                result.newSiteResource
+            )
+                .then(() =>
+                    waitForSiteResourceRebuildIdle(
+                        result.newSiteResource.siteResourceId
+                    )
                )
-                    .then(() =>
-                        waitForSiteResourceRebuildIdle(
-                            result.newSiteResource.siteResourceId
-                        )
+                .then(() =>
+                    handleMessagingForUpdatedSiteResource(
+                        result.oldSiteResource,
+                        result.newSiteResource,
+                        result.oldSites.map((s) => s.siteId),
+                        result.newSites.map((s) => s.siteId)
                    )
-                    .then(() =>
-                        handleMessagingForUpdatedSiteResource(
-                            result.oldSiteResource,
-                            result.newSiteResource,
-                            result.oldSites.map((s) => s.siteId),
-                            result.newSites.map((s) => s.siteId)
-                        )
-                    )
-                    .catch((e) => {
-                        logger.error(
-                            `Failed to rebuild and handle messaging for site resource ${result.newSiteResource.siteResourceId}. Error: ${e}`
-                        );
-                    });
-            }
+                )
+                .catch((e) => {
+                    logger.error(
+                        `Failed to rebuild and handle messaging for site resource ${result.newSiteResource.siteResourceId}. Error: ${e}`
+                    );
+                });
+        }

-            logger.debug(
-                `Successfully updated private resources for org ${orgId}: ${JSON.stringify(privateResourcesResults)}`
-            );
-        });
+        logger.debug(
+            `Successfully updated private resources for org ${orgId}: ${JSON.stringify(privateResourcesResults)}`
+        );

        blueprintSucceeded = true;
        blueprintMessage = "Blueprint applied successfully";
@@ -0,0 +1,41 @@
+import { and, asc, eq, or } from "drizzle-orm";
+import { Transaction, User, userOrgs, users } from "@server/db";
+
+export async function findOrgUsersByIdentifier(
+    trx: Transaction,
+    orgId: string,
+    identifier: string
+): Promise<User[]> {
+    const matches = await trx
+        .select()
+        .from(users)
+        .innerJoin(userOrgs, eq(users.userId, userOrgs.userId))
+        .where(
+            and(
+                or(eq(users.username, identifier), eq(users.email, identifier)),
+                eq(userOrgs.orgId, orgId)
+            )
+        )
+        .orderBy(asc(users.dateCreated), asc(users.userId));
+
+    return matches.map((match) => match.user);
+}
+
+export async function resolveOrgUserIds(
+    trx: Transaction,
+    orgId: string,
+    identifiers: string[]
+): Promise<string[]> {
+    const userIds = new Set<string>();
+    for (const identifier of identifiers) {
+        const matchedUsers = await findOrgUsersByIdentifier(
+            trx,
+            orgId,
+            identifier
+        );
+        for (const user of matchedUsers) {
+            userIds.add(user.userId);
+        }
+    }
+    return [...userIds];
+}
@@ -11,15 +11,14 @@ import {
    siteNetworks,
    siteResources,
    Transaction,
-    userOrgs,
-    users,
    userSiteResources,
    networks
 } from "@server/db";
 import { sites } from "@server/db";
-import { eq, and, ne, inArray, or, isNotNull } from "drizzle-orm";
+import { eq, and, ne, inArray, isNotNull } from "drizzle-orm";
 import { Config } from "./types";
 import { getOrCreateLabelIds, syncSiteResourceLabels } from "./labels";
+import { resolveOrgUserIds } from "./findOrgUser";
 import logger from "@server/logger";
 import { defaultRoleAllowedActions } from "@server/routers/role/createRole";
 import { getNextAvailableAliasAddress } from "../ip";
@@ -389,28 +388,22 @@ export async function updatePrivateResources(
                .where(eq(userSiteResources.siteResourceId, siteResourceId));

            if (resourceData.users.length > 0) {
-                // get userIds from username
-                const usersToUpdate = await trx
-                    .select()
-                    .from(users)
-                    .innerJoin(userOrgs, eq(users.userId, userOrgs.userId))
-                    .where(
-                        and(
-                            or(
-                                inArray(users.username, resourceData.users),
-                                inArray(users.email, resourceData.users)
-                            ),
-                            eq(userOrgs.orgId, orgId)
-                        )
-                    );
+                const userIds = await resolveOrgUserIds(
+                    trx,
+                    orgId,
+                    resourceData.users
+                );

-                const userIds = usersToUpdate.map((user) => user.user.userId);
-
-                await trx
-                    .insert(userSiteResources)
-                    .values(
-                        userIds.map((userId) => ({ userId, siteResourceId }))
-                    );
+                if (userIds.length > 0) {
+                    await trx
+                        .insert(userSiteResources)
+                        .values(
+                            userIds.map((userId) => ({
+                                userId,
+                                siteResourceId
+                            }))
+                        );
+                }
            }

            // Get all admin role IDs for this org to exclude from deletion
@@ -721,28 +714,22 @@ export async function updatePrivateResources(
            }

            if (resourceData.users.length > 0) {
-                // get userIds from username
-                const usersToUpdate = await trx
-                    .select()
-                    .from(users)
-                    .innerJoin(userOrgs, eq(users.userId, userOrgs.userId))
-                    .where(
-                        and(
-                            or(
-                                inArray(users.username, resourceData.users),
-                                inArray(users.email, resourceData.users)
-                            ),
-                            eq(userOrgs.orgId, orgId)
-                        )
-                    );
+                const userIds = await resolveOrgUserIds(
+                    trx,
+                    orgId,
+                    resourceData.users
+                );

-                const userIds = usersToUpdate.map((user) => user.user.userId);
-
-                await trx
-                    .insert(userSiteResources)
-                    .values(
-                        userIds.map((userId) => ({ userId, siteResourceId }))
-                    );
+                if (userIds.length > 0) {
+                    await trx
+                        .insert(userSiteResources)
+                        .values(
+                            userIds.map((userId) => ({
+                                userId,
+                                siteResourceId
+                            }))
+                        );
+                }
            }

            if (resourceData.machines.length > 0) {
@@ -46,11 +46,12 @@ import { encrypt } from "@server/lib/crypto";
 import logger from "@server/logger";
 import { defaultRoleAllowedActions } from "@server/routers/role/createRole";
 import { pickPort } from "@server/routers/target/helpers";
-import { and, asc, eq, isNotNull, ne, or } from "drizzle-orm";
+import { and, asc, eq, isNotNull, ne } from "drizzle-orm";
 import { tierMatrix } from "../billing/tierMatrix";
 import { isValidCIDR, isValidIP, isValidUrlGlobPattern } from "../validators";
 import { Config, isTargetsOnlyResource, TargetData } from "./types";
 import { getOrCreateLabelIds, syncResourceLabels } from "./labels";
+import { findOrgUsersByIdentifier } from "./findOrgUser";
 import { LimitId } from "../billing";
 import { usageService } from "../billing/usageService";
 import { syncInferenceAiConfig } from "./aiProviders";
@@ -1563,31 +1564,27 @@ async function syncUserResources(
        .where(eq(userResources.resourceId, resourceId));

    for (const username of ssoUsers) {
-        const [user] = await trx
-            .select()
-            .from(users)
-            .innerJoin(userOrgs, eq(users.userId, userOrgs.userId))
-            .where(
-                and(
-                    or(eq(users.username, username), eq(users.email, username)),
-                    eq(userOrgs.orgId, orgId)
-                )
-            )
-            .limit(1);
+        const matchedUsers = await findOrgUsersByIdentifier(
+            trx,
+            orgId,
+            username
+        );

-        if (!user) {
+        if (matchedUsers.length === 0) {
            throw new Error(`User not found: ${username} in org ${orgId}`);
        }

-        const existingUserResource = existingUserResources.find(
-            (rr) => rr.userId === user.user.userId
-        );
+        for (const user of matchedUsers) {
+            const existingUserResource = existingUserResources.find(
+                (rr) => rr.userId === user.userId
+            );

-        if (!existingUserResource) {
-            await trx.insert(userResources).values({
-                userId: user.user.userId,
-                resourceId: resourceId
-            });
+            if (!existingUserResource) {
+                await trx.insert(userResources).values({
+                    userId: user.userId,
+                    resourceId: resourceId
+                });
+            }
        }
    }

@@ -1955,31 +1952,27 @@ async function syncUserPolicies(
        .where(eq(userPolicies.resourcePolicyId, policyId));

    for (const username of ssoUsers) {
-        const [user] = await trx
-            .select()
-            .from(users)
-            .innerJoin(userOrgs, eq(users.userId, userOrgs.userId))
-            .where(
-                and(
-                    or(eq(users.username, username), eq(users.email, username)),
-                    eq(userOrgs.orgId, orgId)
-                )
-            )
-            .limit(1);
+        const matchedUsers = await findOrgUsersByIdentifier(
+            trx,
+            orgId,
+            username
+        );

-        if (!user) {
+        if (matchedUsers.length === 0) {
            throw new Error(`User not found: ${username} in org ${orgId}`);
        }

-        const existingUserPolicy = existingUserPoliciesList.find(
-            (up) => up.userId === user.user.userId
-        );
+        for (const user of matchedUsers) {
+            const existingUserPolicy = existingUserPoliciesList.find(
+                (up) => up.userId === user.userId
+            );

-        if (!existingUserPolicy) {
-            await trx.insert(userPolicies).values({
-                userId: user.user.userId,
-                resourcePolicyId: policyId
-            });
+            if (!existingUserPolicy) {
+                await trx.insert(userPolicies).values({
+                    userId: user.userId,
+                    resourcePolicyId: policyId
+                });
+            }
        }
    }

@@ -13,7 +13,7 @@ import {
    userPolicies,
    users
 } from "@server/db";
-import { eq, and, or } from "drizzle-orm";
+import { eq, and } from "drizzle-orm";
 import { Config, ResourcePolicyData } from "./types";
 import logger from "@server/logger";
 import { getUniqueResourcePolicyName } from "@server/db/names";
@@ -22,6 +22,7 @@ import { idpExistsForOrg } from "@server/lib/idp/idpExistsForOrg";
 import { isValidCIDR, isValidIP, isValidUrlGlobPattern } from "../validators";
 import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
 import { tierMatrix } from "../billing/tierMatrix";
+import { findOrgUsersByIdentifier } from "./findOrgUser";

 export type ResourcePoliciesResults = {
    resourcePolicyId: number;
@@ -466,34 +467,30 @@ async function syncUserPolicies(
        .where(eq(userPolicies.resourcePolicyId, policyId));

    for (const username of ssoUsers) {
-        const [user] = await trx
-            .select()
-            .from(users)
-            .innerJoin(userOrgs, eq(users.userId, userOrgs.userId))
-            .where(
-                and(
-                    or(eq(users.username, username), eq(users.email, username)),
-                    eq(userOrgs.orgId, orgId)
-                )
-            )
-            .limit(1);
+        const matchedUsers = await findOrgUsersByIdentifier(
+            trx,
+            orgId,
+            username
+        );

-        if (!user) {
+        if (matchedUsers.length === 0) {
            logger.warn(
                `User '${username}' not found in org '${orgId}', skipping`
            );
            continue;
        }

-        const alreadyExists = existingUserPolicies.some(
-            (up) => up.userId === user.user.userId
-        );
+        for (const user of matchedUsers) {
+            const alreadyExists = existingUserPolicies.some(
+                (up) => up.userId === user.userId
+            );

-        if (!alreadyExists) {
-            await trx.insert(userPolicies).values({
-                userId: user.user.userId,
-                resourcePolicyId: policyId
-            });
+            if (!alreadyExists) {
+                await trx.insert(userPolicies).values({
+                    userId: user.userId,
+                    resourcePolicyId: policyId
+                });
+            }
        }
    }

@@ -536,29 +533,25 @@ async function addUserPolicies(
    trx: Transaction
 ) {
    for (const username of ssoUsers) {
-        const [user] = await trx
-            .select()
-            .from(users)
-            .innerJoin(userOrgs, eq(users.userId, userOrgs.userId))
-            .where(
-                and(
-                    or(eq(users.username, username), eq(users.email, username)),
-                    eq(userOrgs.orgId, orgId)
-                )
-            )
-            .limit(1);
+        const matchedUsers = await findOrgUsersByIdentifier(
+            trx,
+            orgId,
+            username
+        );

-        if (!user) {
+        if (matchedUsers.length === 0) {
            logger.warn(
                `User '${username}' not found in org '${orgId}', skipping`
            );
            continue;
        }

-        await trx.insert(userPolicies).values({
-            userId: user.user.userId,
-            resourcePolicyId: policyId
-        });
+        for (const user of matchedUsers) {
+            await trx.insert(userPolicies).values({
+                userId: user.userId,
+                resourcePolicyId: policyId
+            });
+        }
    }
 }

@@ -29,8 +29,34 @@ export const SiteSchema = z.object({
    "docker-socket-enabled": z.boolean().optional().default(true)
 });

+// A malformed hostname (e.g. stray whitespace) is silently accepted here but
+// fails to parse as a URL when newt builds the health check request, which
+// takes the target out of the routing pool and breaks the resource entirely
+// (see #3677). Validate eagerly so blueprints reject it up front instead.
+const healthCheckHostnameSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .refine((val) => !/\s/.test(val), {
+        message: "Hostname must not contain whitespace"
+    })
+    .refine(
+        (val) => {
+            if (z.union([z.ipv4(), z.ipv6()]).safeParse(val).success) {
+                return true;
+            }
+            const hostnameRegex =
+                /^(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)*[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$/;
+            return hostnameRegex.test(val);
+        },
+        {
+            message:
+                "Hostname must be a valid IP address or hostname (no spaces or invalid characters)"
+        }
+    );
+
 export const TargetHealthCheckSchema = z.object({
-    hostname: z.string(),
+    hostname: healthCheckHostnameSchema,
    port: z.int().min(1).max(65535),
    enabled: z.boolean().optional().default(true),
    path: z.string().optional().default("/"),
@@ -101,7 +127,7 @@ export const AuthSchema = z.object({
 export const RuleSchema = z
    .object({
        action: z.enum(["allow", "deny", "pass"]),
-        match: z.enum(["cidr", "path", "ip", "country", "asn", "region"]),
+        match: z.enum(["cidr", "path", "ip", "country", "country_is_not", "asn", "region"]),
        value: z.coerce.string(),
        priority: z.int().optional(),
        enabled: z.boolean().optional().default(true)
@@ -136,7 +162,7 @@ export const RuleSchema = z
    )
    .refine(
        (rule) => {
-            if (rule.match === "country") {
+            if (rule.match === "country" || rule.match === "country_is_not") {
                if (!hasMaxmindCountryDb) {
                    return false;
                }
@@ -31,7 +31,6 @@ export async function validateAndConstructDomain(
    subdomain?: string | null
 ): Promise<DomainValidationResult> {
    try {
-        // Query domain with organization access check
        const [domainRes] = await db
            .select()
            .from(domains)
@@ -42,6 +41,10 @@ export async function validateAndConstructDomain(
                    eq(orgDomains.orgId, orgId),
                    eq(orgDomains.domainId, domainId)
                )
+            )
+            .leftJoin(
+                domainNamespaces,
+                eq(domainNamespaces.domainId, domainId)
            );

        // Check if domain exists
@@ -52,8 +55,7 @@ export async function validateAndConstructDomain(
            };
        }

-        // Check if organization has access to domain
-        if (domainRes.orgDomains && domainRes.orgDomains.orgId !== orgId) {
+        if (!domainRes.orgDomains && !domainRes.domainNamespaces) {
            return {
                success: false,
                error: `Organization does not have access to domain with ID ${domainId}`
@@ -84,19 +86,11 @@ export async function validateAndConstructDomain(
        }

        // Wildcard subdomains are not allowed on namespace (provided/free) domains
-        if (isWildcard) {
-            const [namespaceDomain] = await db
-                .select()
-                .from(domainNamespaces)
-                .where(eq(domainNamespaces.domainId, domainId))
-                .limit(1);
-
-            if (namespaceDomain) {
-                return {
-                    success: false,
-                    error: "Wildcard subdomains are not supported for provided or free domains. Use a specific subdomain instead."
-                };
-            }
+        if (isWildcard && domainRes.domainNamespaces) {
+            return {
+                success: false,
+                error: "Wildcard subdomains are not supported for provided or free domains. Use a specific subdomain instead."
+            };
        }

        if (
@@ -22,7 +22,10 @@ export async function listExitNodes(
    // Accepted for parity with the enterprise implementation (used there for
    // site-label filtering of remote exit nodes). The OSS build has no remote
    // exit nodes, so it is unused here.
-    siteId?: number
+    siteId?: number,
+    // Same as above: accepted for parity, unused since the OSS build has no
+    // remote exit nodes to exclude.
+    noRemote = false
 ) {
    // TODO: pick which nodes to send and ping better than just all of them that are not remote
    const allExitNodes = await db
@@ -1,20 +1,26 @@
-import { db, exitNodes, Transaction } from "@server/db";
+import { db, exitNodes, exitNodeOrgs, Transaction } from "@server/db";
 import config from "@server/lib/config";
 import { findNextAvailableCidr } from "@server/lib/ip";
 import { lockManager } from "#dynamic/lib/lock";
+import { eq } from "drizzle-orm";

 /**
 * Reserves the next available exit node subnet.
 *
- * Exit node subnets must never overlap with one another - regardless of
- * which org(s) they belong to - since HA exit nodes can end up routing for
- * the same org. This acquires a lock that the caller MUST release (via the
- * returned `release`) only after the chosen address has been durably
- * persisted (e.g. after the enclosing transaction commits), otherwise
- * concurrent callers can race and pick the same subnet.
+ * There isn't enough address space to give every exit node in every org a
+ * globally unique subnet, so we only guarantee uniqueness among exit nodes
+ * that already belong to the same org - that's all that actually matters,
+ * since HA only routes multiple exit nodes for a single org. Pass `orgId` to
+ * scope the search to that org's existing exit nodes; without it, the search
+ * considers every exit node (used by flows with no org context, e.g. the
+ * initial gerbil exit node bootstrap). This acquires a lock that the caller
+ * MUST release (via the returned `release`) only after the chosen address
+ * has been durably persisted (e.g. after the enclosing transaction commits),
+ * otherwise concurrent callers can race and pick the same subnet.
 */
 export async function getNextAvailableSubnet(
-    trx: Transaction | typeof db = db
+    trx: Transaction | typeof db = db,
+    orgId?: string
 ): Promise<{ value: string; release: () => Promise<void> }> {
    const lockKey = "exit-node-subnet-allocation";
    const acquired = await lockManager.acquireLockWithRetry(lockKey, 6000);
@@ -24,12 +30,19 @@ export async function getNextAvailableSubnet(
    const release = () => lockManager.releaseLock(lockKey, acquired);

    try {
-        // Get all existing subnets from routes table
-        const existingAddresses = await trx
-            .select({
-                address: exitNodes.address
-            })
-            .from(exitNodes);
+        // Get existing subnets, scoped to this org's exit nodes when known
+        const existingAddresses = orgId
+            ? await trx
+                  .select({ address: exitNodes.address })
+                  .from(exitNodes)
+                  .innerJoin(
+                      exitNodeOrgs,
+                      eq(exitNodeOrgs.exitNodeId, exitNodes.exitNodeId)
+                  )
+                  .where(eq(exitNodeOrgs.orgId, orgId))
+            : await trx
+                  .select({ address: exitNodes.address })
+                  .from(exitNodes);

        const addresses = existingAddresses.map((a) => a.address);
        let subnet = findNextAvailableCidr(
@@ -1,5 +1,5 @@
 import fs from "fs";
-import yaml from "js-yaml";
+import * as yaml from "js-yaml";
 import { configFilePath1, configFilePath2 } from "./consts";
 import { z } from "zod";
 import stoi from "./stoi";
@@ -348,7 +348,6 @@ export const configSchema = z
                    .optional()
                    .pipe(z.string())
                    .transform((url) => url.toLowerCase()),
-                use_subdomain: z.boolean().optional().default(false),
                subnet_group: z.string().optional().default("100.89.137.0/20"),
                block_size: z.number().positive().gt(0).optional().default(24),
                site_block_size: z
@@ -3,6 +3,8 @@ import config from "./config";
 import { getHostMeta } from "./hostMeta";
 import logger from "@server/logger";
 import {
+    aiProviders,
+    aiUsageRecords,
    alertRules,
    apiKeys,
    blueprints,
@@ -11,7 +13,16 @@ import {
    siteResources
 } from "@server/db";
 import { sites, users, orgs, resources, clients, idp } from "@server/db";
-import { eq, count, notInArray, and, isNotNull, isNull } from "drizzle-orm";
+import {
+    eq,
+    count,
+    countDistinct,
+    notInArray,
+    and,
+    isNotNull,
+    isNull,
+    gte
+} from "drizzle-orm";
 import { APP_VERSION } from "./consts";
 import crypto from "crypto";
 import { UserType } from "@server/types/UserTypes";
@@ -172,6 +183,25 @@ class TelemetryClient {
                .select({ count: count() })
                .from(blueprints);

+            const [aiProvidersCount] = await db
+                .select({ count: count() })
+                .from(aiProviders);
+            const [orgsWithAiProviders] = await db
+                .select({ count: countDistinct(aiProviders.orgId) })
+                .from(aiProviders);
+
+            const usageWindowStart =
+                Math.floor(Date.now() / 1000) -
+                this.collectionIntervalDays * 24 * 60 * 60;
+            const [aiUsageRecordsRecent] = await db
+                .select({ count: count() })
+                .from(aiUsageRecords)
+                .where(gte(aiUsageRecords.createdAt, usageWindowStart));
+            const [orgsWithRecentAiUsage] = await db
+                .select({ count: countDistinct(aiUsageRecords.orgId) })
+                .from(aiUsageRecords)
+                .where(gte(aiUsageRecords.createdAt, usageWindowStart));
+
            const supporterKey = config.getSupporterData();

            const allPrivateResources = await db.select().from(siteResources);
@@ -182,6 +212,7 @@ class TelemetryClient {
            let numPrivResourceCidr = 0;
            let numPrivResourceHttp = 0;
            let numPrivResourceSsh = 0;
+            let numPrivResourceInference = 0;
            for (const res of allPrivateResources) {
                if (res.mode === "host") {
                    numPrivResourceHosts += 1;
@@ -191,6 +222,8 @@ class TelemetryClient {
                    numPrivResourceHttp += 1;
                } else if (res.mode === "ssh") {
                    numPrivResourceSsh += 1;
+                } else if (res.mode === "inference") {
+                    numPrivResourceInference += 1;
                }

                if (res.alias) {
@@ -211,6 +244,11 @@ class TelemetryClient {
                numPrivateResourceCidr: numPrivResourceCidr,
                numPrivateResourceHttp: numPrivResourceHttp,
                numPrivateResourceSsh: numPrivResourceSsh,
+                numPrivateResourceInference: numPrivResourceInference,
+                numAiProviders: aiProvidersCount.count,
+                numOrgsWithAiProviders: orgsWithAiProviders.count,
+                numAiUsageRecordsRecent: aiUsageRecordsRecent.count,
+                numOrgsWithRecentAiUsage: orgsWithRecentAiUsage.count,
                numAlertRules: numAlertRules.count,
                numUserDevices: userDevicesCount.count,
                numMachineClients: machineClients.count,
@@ -323,6 +361,17 @@ class TelemetryClient {
                    num_resources_non_http: stats.resources.filter(
                        (r) => r.mode !== "http"
                    ).length,
+                    num_resources_ai_gateway: stats.resources.filter(
+                        (r) => r.mode === "inference"
+                    ).length,
+                    num_private_resources_ai_gateway:
+                        stats.numPrivateResourceInference,
+                    num_ai_providers: stats.numAiProviders,
+                    num_orgs_with_ai_providers: stats.numOrgsWithAiProviders,
+                    num_ai_usage_records_recent:
+                        stats.numAiUsageRecordsRecent,
+                    num_orgs_with_recent_ai_usage:
+                        stats.numOrgsWithRecentAiUsage,
                    num_newt_sites: stats.sites.filter((s) => s.type === "newt")
                        .length,
                    num_local_sites: stats.sites.filter(
@@ -0,0 +1,15 @@
+import { gzipSync, gunzipSync } from "zlib";
+
+/**
+ * Gzip a string and return it as base64 so it can be stored in a TEXT column.
+ */
+export function compressText(value: string): string {
+    return gzipSync(Buffer.from(value, "utf8")).toString("base64");
+}
+
+/**
+ * Reverse of compressText - base64-decode and gunzip back to the original string.
+ */
+export function decompressText(value: string): string {
+    return gunzipSync(Buffer.from(value, "base64")).toString("utf8");
+}
@@ -68,6 +68,11 @@ export async function verifyApiKeyAccessTokenAccess(
            );
        }

+        if (apiKey.isRoot) {
+            // Root keys can access any access token in any org
+            return next();
+        }
+
        if (!resource.orgId) {
            return next(
                createHttpError(
@@ -1,3 +1,16 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
 import { db, userOrgRoles, users } from "@server/db";
 import logger from "@server/logger";
 import type {
@@ -153,7 +153,8 @@ export async function listExitNodes(
    orgId: string,
    filterOnline = false,
    noCloud = false,
-    siteId?: number
+    siteId?: number,
+    noRemote = false
 ) {
    const allExitNodes = await db
        .select({
@@ -242,7 +243,9 @@ export async function listExitNodes(

    let remoteExitNodesList = allExitNodes.filter(
        (node) =>
-            node.type === "remoteExitNode" && (!filterOnline || node.online)
+            node.type === "remoteExitNode" &&
+            !noRemote &&
+            (!filterOnline || node.online)
    );
    const gerbilExitNodes = allExitNodes.filter(
        (node) =>
@@ -19,11 +19,13 @@ import {
    requestAuditLog,
    actionAuditLog,
    accessAuditLog,
-    connectionAuditLog
+    connectionAuditLog,
+    aiSessionLog
 } from "@server/db";
 import logger from "@server/logger";
 import { and, eq, gt, desc, max, sql } from "drizzle-orm";
 import { decrypt } from "@server/lib/crypto";
+import { decompressText } from "@server/lib/textCompression";
 import config from "@server/lib/config";
 import {
    LogType,
@@ -309,6 +311,7 @@ export class LogStreamingManager {
        if (dest.sendActionLogs) enabledTypes.push("action");
        if (dest.sendAccessLogs) enabledTypes.push("access");
        if (dest.sendConnectionLogs) enabledTypes.push("connection");
+        if (dest.sendAISessionLogs) enabledTypes.push("aiSession");

        if (enabledTypes.length === 0) return;

@@ -585,6 +588,13 @@ export class LogStreamingManager {
                        .where(eq(connectionAuditLog.orgId, orgId));
                    return row?.maxId ?? 0;
                }
+                case "aiSession": {
+                    const [row] = await logsDb
+                        .select({ maxId: max(aiSessionLog.id) })
+                        .from(aiSessionLog)
+                        .where(eq(aiSessionLog.orgId, orgId));
+                    return row?.maxId ?? 0;
+                }
            }
        } catch (err) {
            logger.warn(
@@ -670,6 +680,48 @@ export class LogStreamingManager {
                    .limit(limit)) as Array<
                    Record<string, unknown> & { id: number }
                >;
+
+            case "aiSession": {
+                const rows = (await logsDb
+                    .select()
+                    .from(aiSessionLog)
+                    .where(
+                        and(
+                            eq(aiSessionLog.orgId, orgId),
+                            gt(aiSessionLog.id, afterId)
+                        )
+                    )
+                    .orderBy(aiSessionLog.id)
+                    .limit(limit)) as Array<
+                    Record<string, unknown> & { id: number }
+                >;
+
+                const compressedFields = [
+                    "requestBody",
+                    "responseBody",
+                    "normalizedRequest",
+                    "normalizedResponse"
+                ] as const;
+
+                for (const row of rows) {
+                    for (const field of compressedFields) {
+                        const value = row[field];
+                        if (typeof value !== "string") {
+                            continue;
+                        }
+                        try {
+                            row[field] = decompressText(value);
+                        } catch (error) {
+                            logger.error(
+                                `Failed to decompress AI session log field ${field}`,
+                                { error }
+                            );
+                        }
+                    }
+                }
+
+                return rows;
+            }
        }
    }

@@ -694,6 +746,14 @@ export class LogStreamingManager {
                timestamp =
                    typeof row.startedAt === "number" ? row.startedAt : 0;
                break;
+            case "aiSession":
+                // createdAt is stored as epoch milliseconds; normalise to
+                // epoch seconds to match the other log types.
+                timestamp =
+                    typeof row.createdAt === "number"
+                        ? Math.floor(row.createdAt / 1000)
+                        : 0;
+                break;
        }

        const orgId = typeof row.orgId === "string" ? row.orgId : "";
@@ -15,13 +15,14 @@
 // Log type identifiers
 // ---------------------------------------------------------------------------

-export type LogType = "request" | "action" | "access" | "connection";
+export type LogType = "request" | "action" | "access" | "connection" | "aiSession";

 export const LOG_TYPES: LogType[] = [
    "request",
    "action",
    "access",
-    "connection"
+    "connection",
+    "aiSession"
 ];

 // ---------------------------------------------------------------------------
@@ -12,7 +12,7 @@
 */

 import fs from "fs";
-import yaml from "js-yaml";
+import * as yaml from "js-yaml";
 import { privateConfigFilePath1 } from "@server/lib/consts";
 import { z } from "zod";
 import { colorsSchema } from "@server/lib/colorsSchema";
@@ -158,7 +158,7 @@ class RedisManager {
            this.writeClient = new Redis({
                ...masterConfig,
                enableReadyCheck: false,
-                maxRetriesPerRequest: 3,
+                maxRetriesPerRequest: 50,
                keepAlive: 30000,
                connectTimeout: this.connectionTimeout,
                commandTimeout: this.commandTimeout
@@ -169,7 +169,7 @@ class RedisManager {
                this.readClient = new Redis({
                    ...replicaConfig!,
                    enableReadyCheck: false,
-                    maxRetriesPerRequest: 3,
+                    maxRetriesPerRequest: 50,
                    keepAlive: 30000,
                    connectTimeout: this.connectionTimeout,
                    commandTimeout: this.commandTimeout
@@ -186,7 +186,7 @@ class RedisManager {
            this.publisher = new Redis({
                ...masterConfig,
                enableReadyCheck: false,
-                maxRetriesPerRequest: 3,
+                maxRetriesPerRequest: 50,
                keepAlive: 30000,
                connectTimeout: this.connectionTimeout,
                commandTimeout: this.commandTimeout
@@ -196,7 +196,7 @@ class RedisManager {
            this.subscriber = new Redis({
                ...(this.hasReplicas ? replicaConfig! : masterConfig),
                enableReadyCheck: false,
-                maxRetriesPerRequest: 3,
+                maxRetriesPerRequest: 50,
                keepAlive: 30000,
                connectTimeout: this.connectionTimeout,
                commandTimeout: this.commandTimeout
@@ -901,7 +901,9 @@ class RegionalRedisManager {
    // if the configured host doesn't match that pattern (e.g. local dev),
    // in which case callers should fall back to the primary for reads.
    private getReplicaHost(primaryHost: string): string | null {
-        const match = primaryHost.match(/^redis\.([^.]+)\.svc\.cluster\.local$/);
+        const match = primaryHost.match(
+            /^redis\.([^.]+)\.svc\.cluster\.local$/
+        );
        if (!match) return null;
        const namespace = match[1];
        return `redis-1.redis-headless.${namespace}.svc.cluster.local`;
@@ -912,7 +914,7 @@ class RegionalRedisManager {
        const baseOpts = {
            ...cfg,
            enableReadyCheck: false,
-            maxRetriesPerRequest: 3,
+            maxRetriesPerRequest: 50,
            keepAlive: 10000,
            connectTimeout: this.connectionTimeout,
            commandTimeout: this.commandTimeout
@@ -149,12 +149,8 @@ LQIDAQAB
        }

        // Count used sites and users for license comparison
-        const [siteCountRes] = await db
-            .select({ value: count() })
-            .from(sites);
-        const [userCountRes] = await db
-            .select({ value: count() })
-            .from(users);
+        const [siteCountRes] = await db.select({ value: count() }).from(sites);
+        const [userCountRes] = await db.select({ value: count() }).from(users);

        const status: LicenseStatus = {
            hostId: this.hostMeta.hostMetaId,
@@ -276,10 +272,13 @@ LQIDAQAB
                        logger.error(
                            `Allowing failure. Will retry one more time at next run interval.`
                        );
-                        // return last known good status
-                        return this.statusCache.get(
+                        // Fall back to last known good status if we have
+                        // one cached; otherwise return the freshly built
+                        // status (with defaults) rather than undefined.
+                        const lastKnownStatus = this.statusCache.get(
                            this.statusKey
-                        ) as LicenseStatus;
+                        ) as LicenseStatus | undefined;
+                        return lastKnownStatus ?? status;
                    } else {
                        // Subsequent failures: fail abruptly
                        throw e;
@@ -368,10 +367,7 @@ LQIDAQAB
                }

                // Only consider quantity if defined and >= 0 (quantity = users, quantity_2 = sites)
-                if (
-                    cached.quantity_2 !== undefined &&
-                    cached.quantity_2 >= 0
-                ) {
+                if (cached.quantity_2 !== undefined && cached.quantity_2 >= 0) {
                    status.maxSites =
                        (status.maxSites ?? 0) + cached.quantity_2;
                }
@@ -561,7 +557,7 @@ LQIDAQAB
                    // Calculate exponential backoff delay
                    const retryDelay = Math.floor(
                        initialRetryDelay *
-                        Math.pow(exponentialFactor, attempt - 1)
+                            Math.pow(exponentialFactor, attempt - 1)
                    );

                    logger.debug(
@@ -0,0 +1,294 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { logsDb, db, orgs, aiSessionLog, type AiProvider } from "@server/db";
+import type { InferInsertModel } from "drizzle-orm";
+import logger from "@server/logger";
+import { and, eq, lt } from "drizzle-orm";
+import cache from "#private/lib/cache";
+import { calculateCutoffTimestamp } from "@server/lib/cleanupLogs";
+import { sanitizeString } from "@server/lib/sanitize";
+import { compressText } from "@server/lib/textCompression";
+import type { AiCapability } from "@server/lib/aiCapabilities";
+import {
+    normalizeAiRequest,
+    normalizeAiResponse
+} from "@server/lib/aiMessageNormalization";
+
+// Caps how much of the request/response body we keep per row, so a single
+// huge multimodal payload can't blow up buffer memory or storage.
+const AI_SESSION_LOG_MAX_BODY_CHARS = 200_000;
+
+type AiSessionLogInsert = InferInsertModel<typeof aiSessionLog>;
+
+// In-memory buffer for batching AI session log inserts, mirroring the
+// approach in server/routers/badger/logRequestAudit.ts.
+const sessionLogBuffer: AiSessionLogInsert[] = [];
+
+const BATCH_SIZE = 100; // Write to DB every 100 logs
+const BATCH_INTERVAL_MS = 5000; // Or every 5 seconds, whichever comes first
+const MAX_BUFFER_SIZE = 10000; // Prevent unbounded memory growth
+let flushTimer: NodeJS.Timeout | null = null;
+let isFlushInProgress = false;
+
+/**
+ * Flush buffered logs to database
+ */
+async function flushSessionLogs() {
+    if (sessionLogBuffer.length === 0 || isFlushInProgress) {
+        return;
+    }
+
+    isFlushInProgress = true;
+
+    // Take all current logs and clear buffer
+    const logsToWrite = sessionLogBuffer.splice(0, sessionLogBuffer.length);
+
+    try {
+        // Use a transaction to ensure all inserts succeed or fail together
+        await logsDb.transaction(async (tx) => {
+            // Batch insert logs in groups of 25 to avoid overwhelming the database
+            const BATCH_DB_SIZE = 25;
+            for (let i = 0; i < logsToWrite.length; i += BATCH_DB_SIZE) {
+                const batch = logsToWrite.slice(i, i + BATCH_DB_SIZE);
+                await tx.insert(aiSessionLog).values(batch);
+            }
+        });
+        logger.debug(
+            `Flushed ${logsToWrite.length} AI session logs to database`
+        );
+    } catch (error) {
+        logger.error("Error flushing AI session logs:", error);
+        // On transaction error, put logs back at the front of the buffer to retry
+        // but only if buffer isn't too large
+        if (sessionLogBuffer.length < MAX_BUFFER_SIZE - logsToWrite.length) {
+            sessionLogBuffer.unshift(...logsToWrite);
+            logger.info(
+                `Re-queued ${logsToWrite.length} AI session logs for retry`
+            );
+        } else {
+            logger.error(
+                `Buffer full, dropped ${logsToWrite.length} AI session logs`
+            );
+        }
+    } finally {
+        isFlushInProgress = false;
+        // If buffer filled up while we were flushing, flush again
+        if (sessionLogBuffer.length >= BATCH_SIZE) {
+            flushSessionLogs().catch((err) =>
+                logger.error("Error in follow-up AI session log flush:", err)
+            );
+        }
+    }
+}
+
+/**
+ * Schedule a flush if not already scheduled
+ */
+function scheduleFlush() {
+    if (flushTimer === null) {
+        flushTimer = setTimeout(() => {
+            flushTimer = null;
+            flushSessionLogs().catch((err) =>
+                logger.error("Error in scheduled AI session log flush:", err)
+            );
+        }, BATCH_INTERVAL_MS);
+    }
+}
+
+/**
+ * Gracefully flush all pending logs (call this on shutdown)
+ */
+export async function shutdownAiSessionLogger() {
+    if (flushTimer) {
+        clearTimeout(flushTimer);
+        flushTimer = null;
+    }
+    // Force flush even if one is in progress by waiting and retrying
+    while (isFlushInProgress) {
+        await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+    await flushSessionLogs();
+}
+
+async function getRetentionDays(orgId: string): Promise<number> {
+    // check cache first
+    const cached = await cache.get<number>(`org_${orgId}_aiSessionsDays`);
+    if (cached !== undefined) {
+        return cached;
+    }
+
+    const [org] = await db
+        .select({
+            settingsLogRetentionDaysAISessions:
+                orgs.settingsLogRetentionDaysAISessions
+        })
+        .from(orgs)
+        .where(eq(orgs.orgId, orgId))
+        .limit(1);
+
+    if (!org) {
+        return 0;
+    }
+
+    // store the result in cache
+    await cache.set(
+        `org_${orgId}_aiSessionsDays`,
+        org.settingsLogRetentionDaysAISessions,
+        300
+    );
+
+    return org.settingsLogRetentionDaysAISessions;
+}
+
+export async function cleanUpOldLogs(orgId: string, retentionDays: number) {
+    const cutoffTimestamp = calculateCutoffTimestamp(retentionDays);
+
+    try {
+        await logsDb
+            .delete(aiSessionLog)
+            .where(
+                and(
+                    lt(aiSessionLog.createdAt, cutoffTimestamp),
+                    eq(aiSessionLog.orgId, orgId)
+                )
+            );
+    } catch (error) {
+        logger.error("Error cleaning up old AI session logs:", error);
+    }
+}
+
+function truncateBody(value: string): { value: string; truncated: boolean } {
+    if (value.length <= AI_SESSION_LOG_MAX_BODY_CHARS) {
+        return { value, truncated: false };
+    }
+    return {
+        value: value.slice(0, AI_SESSION_LOG_MAX_BODY_CHARS),
+        truncated: true
+    };
+}
+
+export function logAiSession(data: {
+    sessionId: string;
+    capability: AiCapability;
+    provider: AiProvider;
+    requestedModel: string | undefined;
+    requestBody: unknown;
+    responseText: string;
+    isStream: boolean;
+    statusCode: number;
+    orgId: string | null;
+    resourceId: number | null;
+    siteResourceId: number | null;
+    requestUserId: string | null;
+    virtualApiKeyId: string | null;
+}): void {
+    (async () => {
+        try {
+            // Check retention before buffering any logs
+            if (data.orgId) {
+                const retentionDays = await getRetentionDays(data.orgId);
+                if (retentionDays === 0) {
+                    // do not log
+                    return;
+                }
+            } else {
+                // No org resolved for this request - nothing to govern
+                // retention with, so don't log it.
+                return;
+            }
+
+            const requestBodyText = truncateBody(
+                JSON.stringify(data.requestBody ?? "")
+            );
+            const responseBodyText = truncateBody(data.responseText ?? "");
+
+            // Uniform, capability-agnostic transcript for search/display -
+            // computed from the untruncated originals so normalization sees
+            // the full content; the normalized result gets its own
+            // (typically much smaller) truncation pass below.
+            const normalizedRequestMessages = normalizeAiRequest(
+                data.capability,
+                data.requestBody
+            );
+            const normalizedResponseMessages = normalizeAiResponse(
+                data.capability,
+                data.responseText ?? "",
+                data.isStream
+            );
+            const normalizedRequestText = normalizedRequestMessages
+                ? truncateBody(JSON.stringify(normalizedRequestMessages))
+                : null;
+            const normalizedResponseText = normalizedResponseMessages
+                ? truncateBody(JSON.stringify(normalizedResponseMessages))
+                : null;
+
+            // Prevent unbounded buffer growth - drop oldest entries if buffer is too large
+            if (sessionLogBuffer.length >= MAX_BUFFER_SIZE) {
+                const dropped = sessionLogBuffer.splice(0, BATCH_SIZE);
+                logger.warn(
+                    `AI session log buffer exceeded max size (${MAX_BUFFER_SIZE}), dropped ${dropped.length} oldest entries`
+                );
+            }
+
+            const timestamp = Math.floor(Date.now() / 1000);
+
+            sessionLogBuffer.push({
+                sessionId: data.sessionId,
+                orgId: sanitizeString(data.orgId),
+                providerId: data.provider.providerId,
+                capability: data.capability,
+                resourceId: data.resourceId ?? undefined,
+                siteResourceId: data.siteResourceId ?? undefined,
+                userId: sanitizeString(data.requestUserId ?? undefined),
+                virtualApiKeyId: sanitizeString(
+                    data.virtualApiKeyId ?? undefined
+                ),
+                requestedModel: sanitizeString(data.requestedModel),
+                isStream: data.isStream,
+                requestBody: compressText(
+                    sanitizeString(requestBodyText.value)
+                ),
+                responseBody: compressText(
+                    sanitizeString(responseBodyText.value)
+                ),
+                normalizedRequest: normalizedRequestText
+                    ? compressText(sanitizeString(normalizedRequestText.value))
+                    : undefined,
+                normalizedResponse: normalizedResponseText
+                    ? compressText(
+                          sanitizeString(normalizedResponseText.value)
+                      )
+                    : undefined,
+                truncated:
+                    requestBodyText.truncated ||
+                    responseBodyText.truncated ||
+                    (normalizedRequestText?.truncated ?? false) ||
+                    (normalizedResponseText?.truncated ?? false),
+                statusCode: data.statusCode,
+                createdAt: timestamp
+            });
+
+            // Flush immediately if buffer is full, otherwise schedule a flush
+            if (sessionLogBuffer.length >= BATCH_SIZE) {
+                flushSessionLogs().catch((err) =>
+                    logger.error("Error flushing AI session logs:", err)
+                );
+            } else {
+                scheduleFlush();
+            }
+        } catch (error) {
+            logger.error("Failed to log AI session", { error });
+        }
+    })();
+}
@@ -88,7 +88,27 @@ export const queryAccessAuditLogsQuery = z.object({
        .optional()
        .default("0")
        .transform(Number)
-        .pipe(z.int().nonnegative())
+        .pipe(z.int().nonnegative()),
+    ip: z
+        .preprocess((val) => {
+            if (val === undefined || val === null || val === "") {
+                return undefined;
+            }
+            if (Array.isArray(val)) {
+                return val;
+            }
+            // the array is returned as this
+            if (typeof val === "string") {
+                return val.split(",");
+            }
+            return undefined;
+        }, z.array(z.string()))
+        .optional()
+        .catch([])
+        .openapi({
+            type: "array",
+            description: "Filter by IP adresses"
+        })
 });

 export const queryAccessAuditLogsParams = z.object({
@@ -134,6 +154,9 @@ function getWhere(data: Q) {
        data.type ? eq(accessAuditLog.type, data.type) : undefined,
        data.action !== undefined
            ? eq(accessAuditLog.action, data.action)
+            : undefined,
+        data.ip && data.ip.length > 0
+            ? inArray(accessAuditLog.ip, data.ip)
            : undefined
    );
 }
@@ -291,6 +291,10 @@ async function disableFeature(
                await disableConnectionLogs(orgId);
                break;

+            case TierFeature.AISessionLogs:
+                await disableAISessionLogs(orgId);
+                break;
+
            case TierFeature.RotateCredentials:
                await disableRotateCredentials(orgId);
                break;
@@ -493,6 +497,15 @@ async function disableConnectionLogs(orgId: string): Promise<void> {
    logger.info(`Disabled connection logs for org ${orgId}`);
 }

+async function disableAISessionLogs(orgId: string): Promise<void> {
+    await db
+        .update(orgs)
+        .set({ settingsLogRetentionDaysAISessions: 0 })
+        .where(eq(orgs.orgId, orgId));
+
+    logger.info(`Disabled AI session logs for org ${orgId}`);
+}
+
 async function disableRotateCredentials(orgId: string): Promise<void> {}

 async function disablemaintenancePage(orgId: string): Promise<void> {
@@ -37,7 +37,8 @@ const bodySchema = z.strictObject({
    sendConnectionLogs: z.boolean().optional().default(false),
    sendRequestLogs: z.boolean().optional().default(false),
    sendActionLogs: z.boolean().optional().default(false),
-    sendAccessLogs: z.boolean().optional().default(false)
+    sendAccessLogs: z.boolean().optional().default(false),
+    sendAISessionLogs: z.boolean().optional().default(false)
 });

 export type CreateEventStreamingDestinationResponse = {
@@ -122,7 +123,8 @@ export async function createEventStreamingDestination(
                sendAccessLogs: parsedBody.data.sendAccessLogs,
                sendActionLogs: parsedBody.data.sendActionLogs,
                sendConnectionLogs: parsedBody.data.sendConnectionLogs,
-                sendRequestLogs: parsedBody.data.sendRequestLogs
+                sendRequestLogs: parsedBody.data.sendRequestLogs,
+                sendAISessionLogs: parsedBody.data.sendAISessionLogs
            })
            .returning();

@@ -60,6 +60,7 @@ export type ListEventStreamingDestinationsResponse = {
        sendRequestLogs: boolean;
        sendActionLogs: boolean;
        sendAccessLogs: boolean;
+        sendAISessionLogs: boolean;
    }[];
    pagination: {
        total: number;
@@ -83,7 +84,8 @@ const ListEventStreamingDestinationsResponseDataSchema = z.object({
            sendConnectionLogs: z.boolean(),
            sendRequestLogs: z.boolean(),
            sendActionLogs: z.boolean(),
-            sendAccessLogs: z.boolean()
+            sendAccessLogs: z.boolean(),
+            sendAISessionLogs: z.boolean()
        })
    ),
    pagination: z.object({
@@ -40,7 +40,8 @@ const bodySchema = z.strictObject({
    sendConnectionLogs: z.boolean().optional(),
    sendRequestLogs: z.boolean().optional(),
    sendActionLogs: z.boolean().optional(),
-    sendAccessLogs: z.boolean().optional()
+    sendAccessLogs: z.boolean().optional(),
+    sendAISessionLogs: z.boolean().optional()
 });

 export type UpdateEventStreamingDestinationResponse = {
@@ -125,7 +126,7 @@ export async function updateEventStreamingDestination(
            );
        }

-        const { type, config: configToUpdate, enabled, sendAccessLogs, sendActionLogs, sendConnectionLogs, sendRequestLogs } = parsedBody.data;
+        const { type, config: configToUpdate, enabled, sendAccessLogs, sendActionLogs, sendConnectionLogs, sendRequestLogs, sendAISessionLogs } = parsedBody.data;

        const updateData: Record<string, unknown> = {
            updatedAt: Date.now()
@@ -141,6 +142,7 @@ export async function updateEventStreamingDestination(
        if (sendActionLogs !== undefined) updateData.sendActionLogs = sendActionLogs;
        if (sendConnectionLogs !== undefined) updateData.sendConnectionLogs = sendConnectionLogs;
        if (sendRequestLogs !== undefined) updateData.sendRequestLogs = sendRequestLogs;
+        if (sendAISessionLogs !== undefined) updateData.sendAISessionLogs = sendAISessionLogs;

        await db
            .update(eventStreamingDestinations)
@@ -21,6 +21,10 @@ import * as auth from "#private/routers/auth";
 import * as license from "#private/routers/license";
 import * as generateLicense from "#private/routers/generatedLicense";
 import * as logs from "#private/routers/auditLogs";
+import {
+    queryAiSessionLogs,
+    exportAiSessionLogs
+} from "@server/routers/auditLogs";
 import * as misc from "#private/routers/misc";
 import * as reKey from "#private/routers/re-key";
 import * as approval from "#private/routers/approvals";
@@ -591,6 +595,25 @@ authenticated.get(
    logs.exportConnectionAuditLogs
 );

+authenticated.get(
+    "/org/:orgId/logs/ai",
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.aiSessionLogs),
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.viewLogs),
+    queryAiSessionLogs
+);
+
+authenticated.get(
+    "/org/:orgId/logs/ai/export",
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.aiSessionLogs),
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.exportLogs),
+    logActionAudit(ActionsEnum.exportLogs),
+    exportAiSessionLogs
+);
+
 authenticated.post(
    "/re-key/:clientId/regenerate-client-secret",
    verifyClientAccess, // this is first to set the org id
@@ -34,10 +34,6 @@ export async function createExitNode(
            // TODO: eventually we will want to get the next available port so that we can multiple exit nodes
            // const listenPort = await getNextAvailablePort();
            const listenPort = config.getRawConfig().gerbil.start_port;
-            let subEndpoint = "";
-            if (config.getRawConfig().gerbil.use_subdomain) {
-                subEndpoint = await getUniqueExitNodeEndpointName();
-            }

            const exitNodeName =
                config.getRawConfig().gerbil.exit_node_name ||
@@ -48,7 +44,7 @@ export async function createExitNode(
                .insert(exitNodes)
                .values({
                    publicKey,
-                    endpoint: `${subEndpoint}${subEndpoint != "" ? "." : ""}${config.getRawConfig().gerbil.base_endpoint}`,
+                    endpoint: config.getRawConfig().gerbil.base_endpoint,
                    address,
                    listenPort,
                    online: true,
@@ -43,6 +43,10 @@ import {
    unauthenticated as ua,
    authenticated as a
 } from "@server/routers/integration";
+import {
+    queryAiSessionLogs,
+    exportAiSessionLogs
+} from "@server/routers/auditLogs";
 import { logActionAudit } from "#private/middlewares";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import { build } from "@server/build";
@@ -153,6 +157,25 @@ authenticated.get(
    logs.exportConnectionAuditLogs
 );

+authenticated.get(
+    "/org/:orgId/logs/ai",
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.aiSessionLogs),
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.viewLogs),
+    queryAiSessionLogs
+);
+
+authenticated.get(
+    "/org/:orgId/logs/ai/export",
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.aiSessionLogs),
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.exportLogs),
+    logActionAudit(ActionsEnum.exportLogs),
+    exportAiSessionLogs
+);
+
 authenticated.put(
    "/org/:orgId/idp/oidc",
    verifyValidLicense,
@@ -1,238 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { db } from "@server/db";
-import { MessageHandler } from "@server/routers/ws";
-import { sites, Newt, orgs, clients, clientSitesAssociationsCache } from "@server/db";
-import { and, eq, inArray } from "drizzle-orm";
-import logger from "@server/logger";
-import { inflate } from "zlib";
-import { promisify } from "util";
-import { logRequestAudit } from "@server/routers/badger/logRequestAudit";
-import { getCountryCodeForIp } from "@server/lib/geoip";
-
-export async function flushRequestLogToDb(): Promise<void> {
-    return;
-}
-
-const zlibInflate = promisify(inflate);
-
-interface HTTPRequestLogData {
-    requestId: string;
-    resourceId: number; // siteResourceId
-    timestamp: string; // ISO 8601
-    method: string;
-    scheme: string; // "http" or "https"
-    host: string;
-    path: string;
-    rawQuery?: string;
-    userAgent?: string;
-    sourceAddr: string; // ip:port
-    tls: boolean;
-}
-
-/**
- * Decompress a base64-encoded zlib-compressed string into parsed JSON.
- */
-async function decompressRequestLog(
-    compressed: string
-): Promise<HTTPRequestLogData[]> {
-    const compressedBuffer = Buffer.from(compressed, "base64");
-    const decompressed = await zlibInflate(compressedBuffer);
-    const jsonString = decompressed.toString("utf-8");
-    const parsed = JSON.parse(jsonString);
-
-    if (!Array.isArray(parsed)) {
-        throw new Error("Decompressed request log data is not an array");
-    }
-
-    return parsed;
-}
-
-export const handleRequestLogMessage: MessageHandler = async (context) => {
-    const { message, client } = context;
-    const newt = client as Newt;
-
-    if (!newt) {
-        logger.warn("Request log received but no newt client in context");
-        return;
-    }
-
-    if (!newt.siteId) {
-        logger.warn("Request log received but newt has no siteId");
-        return;
-    }
-
-    if (!message.data?.compressed) {
-        logger.warn("Request log message missing compressed data");
-        return;
-    }
-
-    // Look up the org for this site and check retention settings
-    const [site] = await db
-        .select({
-            orgId: sites.orgId,
-            orgSubnet: orgs.subnet,
-            settingsLogRetentionDaysRequest:
-                orgs.settingsLogRetentionDaysRequest
-        })
-        .from(sites)
-        .innerJoin(orgs, eq(sites.orgId, orgs.orgId))
-        .where(eq(sites.siteId, newt.siteId));
-
-    if (!site) {
-        logger.warn(
-            `Request log received but site ${newt.siteId} not found in database`
-        );
-        return;
-    }
-
-    const orgId = site.orgId;
-
-    if (site.settingsLogRetentionDaysRequest === 0) {
-        logger.debug(
-            `Request log retention is disabled for org ${orgId}, skipping`
-        );
-        return;
-    }
-
-    let entries: HTTPRequestLogData[];
-    try {
-        entries = await decompressRequestLog(message.data.compressed);
-    } catch (error) {
-        logger.error("Failed to decompress request log data:", error);
-        return;
-    }
-
-    if (entries.length === 0) {
-        return;
-    }
-
-    logger.debug(`Request log entries: ${JSON.stringify(entries)}`);
-
-    // Build a map from sourceIp → external endpoint string by joining clients
-    // with clientSitesAssociationsCache. The endpoint is the real-world IP:port
-    // of the client device and is used for GeoIP lookup.
-    const ipToEndpoint = new Map<string, string>();
-
-    const cidrSuffix = site.orgSubnet?.includes("/")
-        ? site.orgSubnet.substring(site.orgSubnet.indexOf("/"))
-        : null;
-
-    if (cidrSuffix) {
-        const uniqueSourceAddrs = new Set<string>();
-        for (const entry of entries) {
-            if (entry.sourceAddr) {
-                uniqueSourceAddrs.add(entry.sourceAddr);
-            }
-        }
-
-        if (uniqueSourceAddrs.size > 0) {
-            const subnetQueries = Array.from(uniqueSourceAddrs).map((addr) => {
-                const ip = addr.includes(":") ? addr.split(":")[0] : addr;
-                return `${ip}${cidrSuffix}`;
-            });
-
-            const matchedClients = await db
-                .select({
-                    subnet: clients.subnet,
-                    endpoint: clientSitesAssociationsCache.endpoint
-                })
-                .from(clients)
-                .innerJoin(
-                    clientSitesAssociationsCache,
-                    and(
-                        eq(
-                            clientSitesAssociationsCache.clientId,
-                            clients.clientId
-                        ),
-                        eq(clientSitesAssociationsCache.siteId, newt.siteId)
-                    )
-                )
-                .where(
-                    and(
-                        eq(clients.orgId, orgId),
-                        inArray(clients.subnet, subnetQueries)
-                    )
-                );
-
-            for (const c of matchedClients) {
-                if (c.endpoint) {
-                    const ip = c.subnet.split("/")[0];
-                    ipToEndpoint.set(ip, c.endpoint);
-                }
-            }
-        }
-    }
-
-    for (const entry of entries) {
-        if (
-            !entry.requestId ||
-            !entry.resourceId ||
-            !entry.method ||
-            !entry.scheme ||
-            !entry.host ||
-            !entry.path ||
-            !entry.sourceAddr
-        ) {
-            logger.debug(
-                `Skipping request log entry with missing required fields: ${JSON.stringify(entry)}`
-            );
-            continue;
-        }
-
-        const originalRequestURL =
-            entry.scheme +
-            "://" +
-            entry.host +
-            entry.path +
-            (entry.rawQuery ? "?" + entry.rawQuery : "");
-
-        // Resolve the client's external endpoint for GeoIP lookup.
-        // sourceAddr is the WireGuard IP (possibly ip:port), so strip the port.
-        const sourceIp = entry.sourceAddr.includes(":")
-            ? entry.sourceAddr.split(":")[0]
-            : entry.sourceAddr;
-        const endpoint = ipToEndpoint.get(sourceIp);
-        let location: string | undefined;
-        if (endpoint) {
-            const endpointIp = endpoint.includes(":")
-                ? endpoint.split(":")[0]
-                : endpoint;
-            location = await getCountryCodeForIp(endpointIp);
-        }
-
-        await logRequestAudit(
-            {
-                action: true,
-                reason: 108,
-                siteResourceId: entry.resourceId,
-                orgId,
-                location
-            },
-            {
-                path: entry.path,
-                originalRequestURL,
-                scheme: entry.scheme,
-                host: entry.host,
-                method: entry.method,
-                tls: entry.tls,
-                requestIp: entry.sourceAddr
-            }
-        );
-    }
-
-    logger.debug(
-        `Buffered ${entries.length} request log entry/entries from newt ${newt.newtId} (site ${newt.siteId})`
-    );
-};
@@ -12,4 +12,3 @@
 */

 export * from "./handleConnectionLogMessage";
-export * from "./handleRequestLogMessage";
@@ -191,13 +191,20 @@ export async function createRemoteExitNode(

        // If this remote exit node isn't already backing an exit node in
        // another org, we're about to create a brand new one. Reserve a
-        // subnet for it up front so the allocation lock is held across the
-        // whole insert - this guarantees exit node subnets never overlap,
-        // even under concurrent creation, which matters for HA setups.
+        // subnet for it up front, scoped to this org's existing exit nodes,
+        // so the allocation lock is held across the whole insert - this
+        // guarantees exit node subnets never overlap within the org, even
+        // under concurrent creation, which matters for HA setups. Subnets
+        // may still be reused across different orgs; there isn't enough
+        // address space to avoid that, and it isn't necessary since HA only
+        // routes multiple exit nodes for the same org.
        let releaseSubnetLock: (() => Promise<void>) | null = null;
        let newExitNodeAddress: string | null = null;
        if (!existingExitNode) {
-            const { value, release } = await getNextAvailableSubnet();
+            const { value, release } = await getNextAvailableSubnet(
+                db,
+                orgId
+            );
            newExitNodeAddress = value;
            releaseSubnetLock = release;
        }
@@ -16,14 +16,10 @@ import {
    handleRemoteExitNodePingMessage
 } from "#private/routers/remoteExitNode";
 import { MessageHandler } from "@server/routers/ws";
-import {
-    handleConnectionLogMessage,
-    handleRequestLogMessage
-} from "#private/routers/newt";
+import { handleConnectionLogMessage } from "#private/routers/newt";

 export const messageHandlers: Record<string, MessageHandler> = {
    "remoteExitNode/register": handleRemoteExitNodeRegisterMessage,
    "remoteExitNode/ping": handleRemoteExitNodePingMessage,
-    "newt/access-log": handleConnectionLogMessage,
-    "newt/request-log": handleRequestLogMessage
+    "newt/access-log": handleConnectionLogMessage
 };
@@ -139,7 +139,7 @@ const processMessage = async (
            }
        }
    } catch (error) {
-        logger.error("Message handling error:", error);
+        logger.warn("Message handling error:", error);
        // ws.send(JSON.stringify({
        //     type: "error",
        //     data: {
@@ -1,19 +1,37 @@
-import { Router } from "express";
+import { Router, type Request, type Response } from "express";
 import {
    AI_CAPABILITY_DEFS,
    type AiCapability
 } from "@server/lib/aiCapabilities";
 import { handleAiGatewayProxy } from "@server/routers/aiGateway/pipeline";
+import { handleV1Models } from "@server/routers/aiGateway";
+
+type CapabilityHandler = (
+    req: Request,
+    res: Response,
+    capability: AiCapability
+) => Promise<any>;
+
+// Capabilities the gateway answers itself instead of proxying upstream.
+// Everything else goes through the inference pipeline.
+const LOCAL_HANDLERS: Partial<Record<AiCapability, CapabilityHandler>> = {
+    v1_models: handleV1Models
+};

 export function createAiGatewayRouter() {
    const router = Router();

    for (const def of Object.values(AI_CAPABILITY_DEFS)) {
        const capability = def.id as AiCapability;
+        const handler = LOCAL_HANDLERS[capability] ?? handleAiGatewayProxy;
        for (const route of def.routes) {
-            router.post(route.path, (req, res) =>
-                handleAiGatewayProxy(req, res, capability)
-            );
+            const bind = (req: Request, res: Response) =>
+                handler(req, res, capability);
+            if (route.method === "GET") {
+                router.get(route.path, bind);
+            } else {
+                router.post(route.path, bind);
+            }
        }
    }

@@ -1,2 +1,3 @@
 export { handleAiGatewayProxy } from "./pipeline";
+export { handleV1Models } from "./v1Models";
 export { createAiGatewayRouter } from "./createAiGatewayRouter";
@@ -1,171 +1,12 @@
-import { logsDb, db, orgs, aiSessionLog, type AiProvider } from "@server/db";
-import type { InferInsertModel } from "drizzle-orm";
-import logger from "@server/logger";
-import { and, eq, lt } from "drizzle-orm";
-import cache from "#dynamic/lib/cache";
-import { calculateCutoffTimestamp } from "@server/lib/cleanupLogs";
-import { sanitizeString } from "@server/lib/sanitize";
-import type { AiCapability } from "@server/lib/aiCapabilities";
-import {
-    normalizeAiRequest,
-    normalizeAiResponse
-} from "@server/lib/aiMessageNormalization";
-
-// Caps how much of the request/response body we keep per row, so a single
-// huge multimodal payload can't blow up buffer memory or storage.
-const AI_SESSION_LOG_MAX_BODY_CHARS = 200_000;
-
-type AiSessionLogInsert = InferInsertModel<typeof aiSessionLog>;
-
-// In-memory buffer for batching AI session log inserts, mirroring the
-// approach in server/routers/badger/logRequestAudit.ts.
-const sessionLogBuffer: AiSessionLogInsert[] = [];
-
-const BATCH_SIZE = 100; // Write to DB every 100 logs
-const BATCH_INTERVAL_MS = 5000; // Or every 5 seconds, whichever comes first
-const MAX_BUFFER_SIZE = 10000; // Prevent unbounded memory growth
-let flushTimer: NodeJS.Timeout | null = null;
-let isFlushInProgress = false;
-
-/**
- * Flush buffered logs to database
- */
-async function flushSessionLogs() {
-    if (sessionLogBuffer.length === 0 || isFlushInProgress) {
-        return;
-    }
-
-    isFlushInProgress = true;
-
-    // Take all current logs and clear buffer
-    const logsToWrite = sessionLogBuffer.splice(0, sessionLogBuffer.length);
-
-    try {
-        // Use a transaction to ensure all inserts succeed or fail together
-        await logsDb.transaction(async (tx) => {
-            // Batch insert logs in groups of 25 to avoid overwhelming the database
-            const BATCH_DB_SIZE = 25;
-            for (let i = 0; i < logsToWrite.length; i += BATCH_DB_SIZE) {
-                const batch = logsToWrite.slice(i, i + BATCH_DB_SIZE);
-                await tx.insert(aiSessionLog).values(batch);
-            }
-        });
-        logger.debug(
-            `Flushed ${logsToWrite.length} AI session logs to database`
-        );
-    } catch (error) {
-        logger.error("Error flushing AI session logs:", error);
-        // On transaction error, put logs back at the front of the buffer to retry
-        // but only if buffer isn't too large
-        if (sessionLogBuffer.length < MAX_BUFFER_SIZE - logsToWrite.length) {
-            sessionLogBuffer.unshift(...logsToWrite);
-            logger.info(
-                `Re-queued ${logsToWrite.length} AI session logs for retry`
-            );
-        } else {
-            logger.error(
-                `Buffer full, dropped ${logsToWrite.length} AI session logs`
-            );
-        }
-    } finally {
-        isFlushInProgress = false;
-        // If buffer filled up while we were flushing, flush again
-        if (sessionLogBuffer.length >= BATCH_SIZE) {
-            flushSessionLogs().catch((err) =>
-                logger.error("Error in follow-up AI session log flush:", err)
-            );
-        }
-    }
-}
-
-/**
- * Schedule a flush if not already scheduled
- */
-function scheduleFlush() {
-    if (flushTimer === null) {
-        flushTimer = setTimeout(() => {
-            flushTimer = null;
-            flushSessionLogs().catch((err) =>
-                logger.error("Error in scheduled AI session log flush:", err)
-            );
-        }, BATCH_INTERVAL_MS);
-    }
-}
+import { AiCapability } from "@app/lib/aiCapabilities";
+import { AiProvider } from "@server/db";

 /**
 * Gracefully flush all pending logs (call this on shutdown)
 */
-export async function shutdownAiSessionLogger() {
-    if (flushTimer) {
-        clearTimeout(flushTimer);
-        flushTimer = null;
-    }
-    // Force flush even if one is in progress by waiting and retrying
-    while (isFlushInProgress) {
-        await new Promise((resolve) => setTimeout(resolve, 100));
-    }
-    await flushSessionLogs();
-}
+export async function shutdownAiSessionLogger() {}

-async function getRetentionDays(orgId: string): Promise<number> {
-    // check cache first
-    const cached = await cache.get<number>(`org_${orgId}_aiSessionsDays`);
-    if (cached !== undefined) {
-        return cached;
-    }
-
-    const [org] = await db
-        .select({
-            settingsLogRetentionDaysAISessions:
-                orgs.settingsLogRetentionDaysAISessions
-        })
-        .from(orgs)
-        .where(eq(orgs.orgId, orgId))
-        .limit(1);
-
-    if (!org) {
-        return 0;
-    }
-
-    // store the result in cache
-    await cache.set(
-        `org_${orgId}_aiSessionsDays`,
-        org.settingsLogRetentionDaysAISessions,
-        300
-    );
-
-    return org.settingsLogRetentionDaysAISessions;
-}
-
-export async function cleanUpOldLogs(orgId: string, retentionDays: number) {
-    // calculateCutoffTimestamp returns a seconds-epoch cutoff (built for
-    // requestAuditLog.timestamp), but aiSessionLog.createdAt is ms-epoch to
-    // match aiUsageRecords - convert before comparing.
-    const cutoffTimestampMs = calculateCutoffTimestamp(retentionDays) * 1000;
-
-    try {
-        await logsDb
-            .delete(aiSessionLog)
-            .where(
-                and(
-                    lt(aiSessionLog.createdAt, cutoffTimestampMs),
-                    eq(aiSessionLog.orgId, orgId)
-                )
-            );
-    } catch (error) {
-        logger.error("Error cleaning up old AI session logs:", error);
-    }
-}
-
-function truncateBody(value: string): { value: string; truncated: boolean } {
-    if (value.length <= AI_SESSION_LOG_MAX_BODY_CHARS) {
-        return { value, truncated: false };
-    }
-    return {
-        value: value.slice(0, AI_SESSION_LOG_MAX_BODY_CHARS),
-        truncated: true
-    };
-}
+export async function cleanUpOldLogs(orgId: string, retentionDays: number) {}

 export function logAiSession(data: {
    sessionId: string;
@@ -181,95 +22,4 @@ export function logAiSession(data: {
    siteResourceId: number | null;
    requestUserId: string | null;
    virtualApiKeyId: string | null;
-}): void {
-    (async () => {
-        try {
-            // Check retention before buffering any logs
-            if (data.orgId) {
-                const retentionDays = await getRetentionDays(data.orgId);
-                if (retentionDays === 0) {
-                    // do not log
-                    return;
-                }
-            } else {
-                // No org resolved for this request - nothing to govern
-                // retention with, so don't log it.
-                return;
-            }
-
-            const requestBodyText = truncateBody(
-                JSON.stringify(data.requestBody ?? "")
-            );
-            const responseBodyText = truncateBody(data.responseText ?? "");
-
-            // Uniform, capability-agnostic transcript for search/display -
-            // computed from the untruncated originals so normalization sees
-            // the full content; the normalized result gets its own
-            // (typically much smaller) truncation pass below.
-            const normalizedRequestMessages = normalizeAiRequest(
-                data.capability,
-                data.requestBody
-            );
-            const normalizedResponseMessages = normalizeAiResponse(
-                data.capability,
-                data.responseText ?? "",
-                data.isStream
-            );
-            const normalizedRequestText = normalizedRequestMessages
-                ? truncateBody(JSON.stringify(normalizedRequestMessages))
-                : null;
-            const normalizedResponseText = normalizedResponseMessages
-                ? truncateBody(JSON.stringify(normalizedResponseMessages))
-                : null;
-
-            // Prevent unbounded buffer growth - drop oldest entries if buffer is too large
-            if (sessionLogBuffer.length >= MAX_BUFFER_SIZE) {
-                const dropped = sessionLogBuffer.splice(0, BATCH_SIZE);
-                logger.warn(
-                    `AI session log buffer exceeded max size (${MAX_BUFFER_SIZE}), dropped ${dropped.length} oldest entries`
-                );
-            }
-
-            sessionLogBuffer.push({
-                sessionId: data.sessionId,
-                orgId: sanitizeString(data.orgId),
-                providerId: data.provider.providerId,
-                capability: data.capability,
-                resourceId: data.resourceId ?? undefined,
-                siteResourceId: data.siteResourceId ?? undefined,
-                userId: sanitizeString(data.requestUserId ?? undefined),
-                virtualApiKeyId: sanitizeString(
-                    data.virtualApiKeyId ?? undefined
-                ),
-                requestedModel: sanitizeString(data.requestedModel),
-                isStream: data.isStream,
-                requestBody: sanitizeString(requestBodyText.value),
-                responseBody: sanitizeString(responseBodyText.value),
-                normalizedRequest: normalizedRequestText
-                    ? sanitizeString(normalizedRequestText.value)
-                    : undefined,
-                normalizedResponse: normalizedResponseText
-                    ? sanitizeString(normalizedResponseText.value)
-                    : undefined,
-                truncated:
-                    requestBodyText.truncated ||
-                    responseBodyText.truncated ||
-                    (normalizedRequestText?.truncated ?? false) ||
-                    (normalizedResponseText?.truncated ?? false),
-                statusCode: data.statusCode,
-                createdAt: Date.now()
-            });
-
-            // Flush immediately if buffer is full, otherwise schedule a flush
-            if (sessionLogBuffer.length >= BATCH_SIZE) {
-                flushSessionLogs().catch((err) =>
-                    logger.error("Error flushing AI session logs:", err)
-                );
-            } else {
-                scheduleFlush();
-            }
-        } catch (error) {
-            logger.error("Failed to log AI session", { error });
-        }
-    })();
-}
+}): void {}
@@ -86,7 +86,7 @@ import {
    type AiUsage
 } from "@server/lib/aiUsageExtraction";
 import { streamAiGatewayResponse } from "@server/routers/aiGateway/streamAiGatewayResponse";
-import { logAiSession } from "@server/routers/aiGateway/logAiSession";
+import { logAiSession } from "#dynamic/routers/aiGateway/logAiSession";

 const EXIT_NODE_RANGES_CACHE_KEY = "aiGateway:exitNodeRanges";
 const EXIT_NODE_RANGES_TTL_SEC = 6000;
@@ -137,7 +137,7 @@ async function findClientByIp(ip: string): Promise<CachedClient> {
    return result;
 }

-type ProviderAttachment = {
+export type ProviderAttachment = {
    provider: AiProvider;
    accessMode: AccessMode;
 };
@@ -149,12 +149,12 @@ type ResourceModelPattern = {
    enabled: boolean;
 };

-type ProviderPatternLists = {
+export type ProviderPatternLists = {
    allows: string[];
    blocks: string[];
 };

-type ResolvedTarget = {
+export type ResolvedTarget = {
    resourceId: number | null;
    siteResourceId: number | null;
    orgId: string | null;
@@ -362,7 +362,7 @@ function getRequestHeader(req: Request, name: string): string | undefined {
 // request came through, per the trust middleware's resource-type header -
 // falls back to checking both (public preferred on overlap) only when that
 // header is absent, e.g. a request that reached the gateway outside Traefik.
-async function resolveTarget(
+export async function resolveTarget(
    host: string,
    resourceType: AiGatewayResourceType | null
 ): Promise<ResolvedTarget | null> {
@@ -728,7 +728,9 @@ export function recordAiGatewayCompletion(args: {
    let cost: ReturnType<typeof calculateAiCost> = null;

    if (upstreamSucceeded) {
-        usage = extractUsage(capability, responseText, isStream, headers) ?? emptyUsage();
+        usage =
+            extractUsage(capability, responseText, isStream, headers) ??
+            emptyUsage();
        if (isUsageEmpty(usage)) {
            usage = estimateUsage(
                JSON.stringify(requestBody ?? ""),
@@ -810,6 +812,17 @@ export function recordAiGatewayCompletion(args: {
    });
 }

+// p-host is only used sometimes when overriding the host header for some
+// middleware proxy. Shared with the model-discovery endpoint so both resolve
+// the inference resource off the same hostname.
+export function resolveGatewayHost(req: Request): string {
+    return (
+        (req.headers["p-host"] as string | undefined) ||
+        req.headers.host ||
+        ""
+    ).split(":")[0];
+}
+
 export async function handleAiGatewayProxy(
    req: Request,
    res: Response,
@@ -818,11 +831,7 @@ export async function handleAiGatewayProxy(
    try {
        const def = AI_CAPABILITY_DEFS[capability];

-        const host = (
-            (req.headers["p-host"] as string | undefined) || // p-host is only used sometimes when overriding the host header for some middleware proxy
-            req.headers.host ||
-            ""
-        ).split(":")[0];
+        const host = resolveGatewayHost(req);
        if (!host) {
            return res
                .status(HttpCode.BAD_REQUEST)
@@ -99,6 +99,7 @@ async function fetchProviderTargets(
            method: targets.method,
            exitNodeSubnet: sites.exitNodeSubnet,
            reachableAt: exitNodes.reachableAt,
+            exitNodeType: exitNodes.type,
            hcHealth: targetHealthCheck.hcHealth
        })
        .from(targets)
@@ -119,6 +120,12 @@ async function fetchProviderTargets(
        if (!row.exitNodeSubnet || !row.reachableAt) {
            continue;
        }
+        // Sites connected to a remote exit node aren't reachable via a
+        // gerbil sidecar's /router/* proxy - only "gerbil" type exit nodes
+        // run that endpoint.
+        if (row.exitNodeType !== "gerbil") {
+            continue;
+        }
        // A target with an active health check that's currently failing is
        // taken out of rotation. No health check (null) or "unknown" (check
        // hasn't run yet / hcEnabled is off) still routes normally, matching
@@ -0,0 +1,308 @@
+import { Request, Response } from "express";
+import { inArray } from "drizzle-orm";
+import { z } from "zod";
+import { aiModels, db } from "@server/db";
+import {
+    providerHasCapability,
+    type AiCapability
+} from "@server/lib/aiCapabilities";
+import {
+    buildAiCapabilityErrorBody,
+    type AiCapabilityErrorKind
+} from "@server/lib/aiGatewayAuthError";
+import {
+    getAiGatewayResourceType,
+    isAiGatewayTrustHeaderValid
+} from "@server/lib/aiGatewayTrust";
+import { resolveEffectiveLists } from "@server/lib/aiInferenceResource";
+import { listCatalogEntriesForType } from "@server/lib/aiModelCatalog";
+import {
+    listPermittedModels,
+    paginateModels,
+    MODEL_PAGE_DEFAULT_LIMIT,
+    MODEL_PAGE_MAX_LIMIT,
+    type CatalogModelMetadata,
+    type ConfiguredModel,
+    type ModelDiscoveryProvider
+} from "@server/lib/aiModelDiscovery";
+import type { AiProviderType } from "@server/lib/aiProviderDefaults";
+import {
+    resolveGatewayHost,
+    resolveTarget,
+    type ProviderAttachment,
+    type ProviderPatternLists
+} from "@server/routers/aiGateway/pipeline";
+import logger from "@server/logger";
+import HttpCode from "@server/types/HttpCode";
+
+const CAPABILITY: AiCapability = "v1_models";
+
+const querySchema = z.object({
+    limit: z.coerce.number().int().min(1).max(MODEL_PAGE_MAX_LIMIT).optional(),
+    after_id: z.string().min(1).optional(),
+    before_id: z.string().min(1).optional()
+});
+
+type ProviderModelLists = {
+    allowsByProvider: Map<number, string[]>;
+    blocksByProvider: Map<number, string[]>;
+    configuredByProvider: Map<number, Map<string, ConfiguredModel>>;
+};
+
+function errorResponse(
+    res: Response,
+    status: number,
+    kind: AiCapabilityErrorKind,
+    message: string
+) {
+    return res
+        .status(status)
+        .json(buildAiCapabilityErrorBody(CAPABILITY, kind, message, status));
+}
+
+// Provider-level allow/block lists, plus the display name and creation time of
+// every catalog row, so explicitly configured models are reported with the name
+// the administrator gave them rather than a bare model id.
+async function loadProviderModelLists(
+    providerIds: number[]
+): Promise<ProviderModelLists> {
+    const lists: ProviderModelLists = {
+        allowsByProvider: new Map(),
+        blocksByProvider: new Map(),
+        configuredByProvider: new Map()
+    };
+
+    if (providerIds.length === 0) {
+        return lists;
+    }
+
+    const rows = await db
+        .select({
+            providerId: aiModels.providerId,
+            modelKey: aiModels.modelKey,
+            name: aiModels.name,
+            listType: aiModels.listType,
+            enabled: aiModels.enabled,
+            createdAt: aiModels.createdAt
+        })
+        .from(aiModels)
+        .where(inArray(aiModels.providerId, providerIds));
+
+    for (const row of rows) {
+        if (!row.enabled) {
+            continue;
+        }
+        const targetMap =
+            row.listType === "allow"
+                ? lists.allowsByProvider
+                : lists.blocksByProvider;
+        const existing = targetMap.get(row.providerId) ?? [];
+        existing.push(row.modelKey);
+        targetMap.set(row.providerId, existing);
+
+        let configured = lists.configuredByProvider.get(row.providerId);
+        if (!configured) {
+            configured = new Map();
+            lists.configuredByProvider.set(row.providerId, configured);
+        }
+        configured.set(row.modelKey, {
+            name: row.name,
+            createdAt: row.createdAt
+        });
+    }
+
+    return lists;
+}
+
+function catalogMetadataForType(
+    type: AiProviderType
+): Map<string, CatalogModelMetadata> {
+    const metadata = new Map<string, CatalogModelMetadata>();
+    for (const entry of listCatalogEntriesForType(type)) {
+        metadata.set(entry.model, {
+            maxInputTokens: entry.limits.input,
+            maxOutputTokens: entry.limits.output,
+            capabilities: entry.capabilities
+        });
+    }
+    return metadata;
+}
+
+function buildDiscoveryProviders(
+    attachments: ProviderAttachment[],
+    resourceListsByProvider: Map<number, ProviderPatternLists>,
+    lists: ProviderModelLists
+): ModelDiscoveryProvider[] {
+    return attachments.map((attachment) => {
+        const providerId = attachment.provider.providerId;
+        const resourceLists = resourceListsByProvider.get(providerId);
+        const { allows, blocks } = resolveEffectiveLists({
+            accessMode: attachment.accessMode,
+            providerAllows: lists.allowsByProvider.get(providerId) ?? [],
+            providerBlocks: lists.blocksByProvider.get(providerId) ?? [],
+            resourceAllows: resourceLists?.allows ?? [],
+            resourceBlocks: resourceLists?.blocks ?? []
+        });
+
+        return {
+            providerId,
+            allows,
+            blocks,
+            catalog: catalogMetadataForType(
+                attachment.provider.type as AiProviderType
+            ),
+            configured: lists.configuredByProvider.get(providerId) ?? new Map()
+        };
+    });
+}
+
+/**
+ * Serves Anthropic's model-discovery endpoints (`GET /v1/models` and
+ * `GET /v1/models/{id}`) for an inference resource. The gateway answers these
+ * itself rather than proxying: upstream providers either don't expose a model
+ * list at all or would expose models the resource's allow/block lists forbid,
+ * so the response is built from the same effective lists that gate inference.
+ */
+export async function handleV1Models(
+    req: Request,
+    res: Response
+): Promise<any> {
+    try {
+        const host = resolveGatewayHost(req);
+        if (!host) {
+            return errorResponse(
+                res,
+                HttpCode.BAD_REQUEST,
+                "invalid_request",
+                "Missing Host header"
+            );
+        }
+
+        const resourceType = getAiGatewayResourceType(
+            req.headers as Record<string, string>
+        );
+        const target = await resolveTarget(host, resourceType);
+        if (!target) {
+            return errorResponse(
+                res,
+                HttpCode.NOT_FOUND,
+                "not_found",
+                "No inference resource found for this host"
+            );
+        }
+
+        // Same gate as the inference pipeline: public inference must pass
+        // Badger verify-session first, which is what stamps the trust header.
+        if (
+            target.resourceId != null &&
+            !isAiGatewayTrustHeaderValid(req.headers as Record<string, string>)
+        ) {
+            return errorResponse(
+                res,
+                HttpCode.UNAUTHORIZED,
+                "authentication",
+                "Request must be authenticated via the inference resource"
+            );
+        }
+
+        if (target.attachments.length === 0) {
+            return errorResponse(
+                res,
+                HttpCode.FORBIDDEN,
+                "permission",
+                "No AI providers configured for this resource"
+            );
+        }
+
+        const capableAttachments = target.attachments.filter((a) =>
+            providerHasCapability(a.provider.capabilities, CAPABILITY)
+        );
+        if (capableAttachments.length === 0) {
+            return errorResponse(
+                res,
+                HttpCode.FORBIDDEN,
+                "permission",
+                `No AI provider on this resource supports ${CAPABILITY}`
+            );
+        }
+
+        const lists = await loadProviderModelLists(
+            capableAttachments.map((a) => a.provider.providerId)
+        );
+        const models = listPermittedModels(
+            buildDiscoveryProviders(
+                capableAttachments,
+                target.resourceListsByProvider,
+                lists
+            )
+        );
+
+        // `GET /v1/models/{id}` - a single model, 404 when this resource
+        // doesn't permit it.
+        const requestedModel = req.params?.model;
+        if (typeof requestedModel === "string" && requestedModel.length > 0) {
+            const model = models.find((m) => m.id === requestedModel);
+            if (!model) {
+                return errorResponse(
+                    res,
+                    HttpCode.NOT_FOUND,
+                    "not_found",
+                    `Model "${requestedModel}" is not available on this resource`
+                );
+            }
+            return res.status(HttpCode.OK).json(model);
+        }
+
+        const parsedQuery = querySchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return errorResponse(
+                res,
+                HttpCode.BAD_REQUEST,
+                "invalid_request",
+                parsedQuery.error.issues[0]?.message ??
+                    "Invalid pagination parameters"
+            );
+        }
+
+        const page = paginateModels(
+            models,
+            parsedQuery.data.limit ?? MODEL_PAGE_DEFAULT_LIMIT,
+            {
+                afterId: parsedQuery.data.after_id,
+                beforeId: parsedQuery.data.before_id
+            }
+        );
+        if ("error" in page) {
+            return errorResponse(
+                res,
+                HttpCode.BAD_REQUEST,
+                "invalid_request",
+                page.error
+            );
+        }
+
+        logger.debug("AI gateway model discovery", {
+            host,
+            resourceId: target.resourceId,
+            siteResourceId: target.siteResourceId,
+            providers: capableAttachments.length,
+            total: models.length,
+            returned: page.data.length
+        });
+
+        return res.status(HttpCode.OK).json({
+            data: page.data,
+            has_more: page.has_more,
+            first_id: page.data[0]?.id ?? null,
+            last_id: page.data[page.data.length - 1]?.id ?? null
+        });
+    } catch (error) {
+        logger.error(error);
+        return errorResponse(
+            res,
+            HttpCode.INTERNAL_SERVER_ERROR,
+            "internal",
+            "Failed to list models"
+        );
+    }
+}
@@ -18,7 +18,7 @@ export const aiUsageAnalyticsFiltersQuery = z.object({
        .refine((val) => !isNaN(Date.parse(val)), {
            error: "timeStart must be a valid ISO date string"
        })
-        .transform((val) => new Date(val).getTime())
+        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
        .prefault(() => getSevenDaysAgo().toISOString())
        .openapi({
            type: "string",
@@ -31,7 +31,7 @@ export const aiUsageAnalyticsFiltersQuery = z.object({
        .refine((val) => !isNaN(Date.parse(val)), {
            error: "timeEnd must be a valid ISO date string"
        })
-        .transform((val) => new Date(val).getTime())
+        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
        .prefault(() => new Date().toISOString())
        .openapi({
            type: "string",
@@ -122,12 +122,12 @@ export function buildAiUsageWhere(
    );
 }

-// Buckets createdAt (epoch ms) down to a per-day string, dialect-aware, same
-// approach as the DATE_TRUNC/DATE branch in queryRequestAnalytics.ts.
+// Buckets createdAt (epoch seconds) down to a per-day string, dialect-aware,
+// same approach as the DATE_TRUNC/DATE branch in queryRequestAnalytics.ts.
 export function dayBucketExpr() {
    return driver === "pg"
-        ? sql<string>`DATE_TRUNC('day', TO_TIMESTAMP(${aiUsageRecords.createdAt} / 1000.0))`
-        : sql<string>`DATE(${aiUsageRecords.createdAt} / 1000, 'unixepoch')`;
+        ? sql<string>`DATE_TRUNC('day', TO_TIMESTAMP(${aiUsageRecords.createdAt}))`
+        : sql<string>`DATE(${aiUsageRecords.createdAt}, 'unixepoch')`;
 }

 export type DailyMetricRow<K extends string> = {
@@ -11,7 +11,8 @@ import {
    queryAiSessionLogsQuery,
    queryAiSessionLogsParams,
    queryAiSession,
-    countAiSessionQuery
+    countAiSessionQuery,
+    decompressAiSessionLogRow
 } from "./queryAiSessionLog";
 import { generateCSV } from "./generateCSV";

@@ -87,7 +88,9 @@ export async function exportAiSessionLogs(

        const baseQuery = queryAiSession(data);

-        const log = await baseQuery.limit(MAX_EXPORT_LIMIT);
+        const log = (await baseQuery.limit(MAX_EXPORT_LIMIT)).map(
+            decompressAiSessionLogRow
+        );

        const csvData = generateCSV(log);

@@ -24,6 +24,7 @@ import { AI_CAPABILITIES } from "@server/lib/aiCapabilities";
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import { getSevenDaysAgo } from "@app/lib/getSevenDaysAgo";
+import { decompressText } from "@server/lib/textCompression";

 export const queryAiSessionLogsQuery = z.strictObject({
    // iso string just validate its a parseable date
@@ -32,7 +33,7 @@ export const queryAiSessionLogsQuery = z.strictObject({
        .refine((val) => !isNaN(Date.parse(val)), {
            error: "timeStart must be a valid ISO date string"
        })
-        .transform((val) => new Date(val).getTime())
+        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
        .prefault(() => getSevenDaysAgo().toISOString())
        .openapi({
            type: "string",
@@ -45,7 +46,7 @@ export const queryAiSessionLogsQuery = z.strictObject({
        .refine((val) => !isNaN(Date.parse(val)), {
            error: "timeEnd must be a valid ISO date string"
        })
-        .transform((val) => new Date(val).getTime())
+        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
        .optional()
        .prefault(() => new Date().toISOString())
        .openapi({
@@ -166,6 +167,35 @@ export function queryAiSession(data: Q) {
        .orderBy(desc(aiSessionLog.createdAt));
 }

+function decompressField(value: string | null): string | null {
+    if (value == null) {
+        return value;
+    }
+    try {
+        return decompressText(value);
+    } catch (error) {
+        logger.error("Failed to decompress AI session log field", { error });
+        return value;
+    }
+}
+
+export function decompressAiSessionLogRow<
+    T extends {
+        requestBody: string | null;
+        responseBody: string | null;
+        normalizedRequest: string | null;
+        normalizedResponse: string | null;
+    }
+>(row: T): T {
+    return {
+        ...row,
+        requestBody: decompressField(row.requestBody),
+        responseBody: decompressField(row.responseBody),
+        normalizedRequest: decompressField(row.normalizedRequest),
+        normalizedResponse: decompressField(row.normalizedResponse)
+    };
+}
+
 async function enrichWithDetails(
    logs: Awaited<ReturnType<typeof queryAiSession>>
 ) {
@@ -620,7 +650,9 @@ export async function queryAiSessionLogs(

        const baseQuery = queryAiSession(data);

-        const logsRaw = await baseQuery.limit(data.limit).offset(data.offset);
+        const logsRaw = (
+            await baseQuery.limit(data.limit).offset(data.offset)
+        ).map(decompressAiSessionLogRow);

        const log = await enrichWithDetails(logsRaw);

@@ -30,14 +30,14 @@ const queryAiUsageFilterOptionsQuery = z.object({
        .refine((val) => !isNaN(Date.parse(val)), {
            error: "timeStart must be a valid ISO date string"
        })
-        .transform((val) => new Date(val).getTime())
+        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
        .prefault(() => getSevenDaysAgo().toISOString()),
    timeEnd: z
        .string()
        .refine((val) => !isNaN(Date.parse(val)), {
            error: "timeEnd must be a valid ISO date string"
        })
-        .transform((val) => new Date(val).getTime())
+        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
        .prefault(() => new Date().toISOString())
 });

@@ -81,7 +81,27 @@ export const queryAccessAuditLogsQuery = z.strictObject({
        .optional()
        .default("0")
        .transform(Number)
-        .pipe(z.int().nonnegative())
+        .pipe(z.int().nonnegative()),
+    ip: z
+        .preprocess((val) => {
+            if (val === undefined || val === null || val === "") {
+                return undefined;
+            }
+            if (Array.isArray(val)) {
+                return val;
+            }
+            // the array is returned as this
+            if (typeof val === "string") {
+                return val.split(",");
+            }
+            return undefined;
+        }, z.array(z.string()))
+        .optional()
+        .catch([])
+        .openapi({
+            type: "array",
+            description: "Filter by IP adresses"
+        })
 });

 export const queryRequestAuditLogsParams = z.object({
@@ -126,6 +146,9 @@ function getWhere(data: Q) {
        data.path ? eq(requestAuditLog.path, data.path) : undefined,
        data.action !== undefined
            ? eq(requestAuditLog.action, data.action)
+            : undefined,
+        data.ip && data.ip.length > 0
+            ? inArray(requestAuditLog.ip, data.ip)
            : undefined
    );
 }
@@ -533,18 +533,23 @@ export async function startAuthentication(

        // If email is provided, get security keys for that specific user
        if (email) {
-            const [user] = await db
+            const matchingUsers = await db
                .select()
                .from(users)
-                .where(eq(users.email, email))
-                .limit(1);
+                .where(
+                    and(
+                        eq(users.email, email.toLowerCase()),
+                        eq(users.type, UserType.Internal)
+                    )
+                );

-            if (!user || user.type !== UserType.Internal) {
+            if (matchingUsers.length !== 1) {
                return next(
                    createHttpError(HttpCode.BAD_REQUEST, "Invalid credentials")
                );
            }

+            const user = matchingUsers[0];
            userId = user.userId;

            const userSecurityKeys = await db
@@ -42,54 +42,62 @@ export async function setServerAdmin(

        const { email, password, setupToken } = parsedBody.data;

-        // Validate setup token
-        const [validToken] = await db
-            .select()
-            .from(setupTokens)
-            .where(
-                and(
-                    eq(setupTokens.token, setupToken),
-                    eq(setupTokens.used, false)
-                )
-            );
-
-        if (!validToken) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Invalid or expired setup token"
-                )
-            );
-        }
-
-        const [existing] = await db
-            .select()
-            .from(users)
-            .where(eq(users.serverAdmin, true));
-
-        if (existing) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Server admin already exists"
-                )
-            );
-        }
-
        const passwordHash = await hashPassword(password);
        const userId = generateId(15);

        await db.transaction(async (trx) => {
-            // Mark the token as used
-            await trx
+            const consumed = await trx
                .update(setupTokens)
                .set({
                    used: true,
                    dateUsed: moment().toISOString()
                })
-                .where(eq(setupTokens.tokenId, validToken.tokenId));
+                .where(
+                    and(
+                        eq(setupTokens.token, setupToken),
+                        eq(setupTokens.used, false)
+                    )
+                )
+                .returning({ tokenId: setupTokens.tokenId });
+
+            if (!consumed.length) {
+                throw createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Invalid setup token"
+                );
+            }
+
+            const [existingAdmin] = await trx
+                .select({ userId: users.userId })
+                .from(users)
+                .where(eq(users.serverAdmin, true))
+                .limit(1);
+
+            if (existingAdmin) {
+                throw createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Server admin already exists"
+                );
+            }
+
+            const [existingUser] = await trx
+                .select({ userId: users.userId })
+                .from(users)
+                .where(
+                    and(
+                        eq(users.email, email),
+                        eq(users.type, UserType.Internal)
+                    )
+                )
+                .limit(1);
+
+            if (existingUser) {
+                throw createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "A user with that email address already exists"
+                );
+            }

-            // Create the server admin user
            await trx.insert(users).values({
                userId: userId,
                email: email,
@@ -111,6 +119,9 @@ export async function setServerAdmin(
            status: HttpCode.OK
        });
    } catch (e) {
+        if (createHttpError.isHttpError(e)) {
+            return next(e);
+        }
        logger.error(e);
        return next(
            createHttpError(
@@ -48,7 +48,7 @@ export async function validateSetupToken(
            return response<ValidateSetupTokenResponse>(res, {
                data: {
                    valid: false,
-                    message: "Invalid or expired setup token"
+                    message: "Invalid setup token"
                },
                success: true,
                error: false,
@@ -23,6 +23,12 @@ export async function createCertificate(
        throw new Error(`Domain with ID ${domainId} not found`);
    }

+    // Note: certificates.domain has a global UNIQUE constraint (it is not
+    // scoped per-domainId), so existence must be checked by domain value
+    // alone. Filtering on domainId here as well can cause this check to
+    // miss an existing cert (e.g. if it was stored under a different but
+    // still-valid domainId), leading to an INSERT that then fails on the
+    // unique constraint.
    let existing: Certificate[] = [];
    if (domainRecord.type == "ns" || domainRecord.type == "wildcard") {
        const domainLevelDown = domain.split(".").slice(1).join(".");
@@ -32,16 +38,13 @@ export async function createCertificate(
            .select()
            .from(certificates)
            .where(
-                and(
-                    eq(certificates.domainId, domainId),
-                    or(
-                        eq(certificates.domain, domain),
-                        and(
-                            eq(certificates.wildcard, true),
-                            or(
-                                eq(certificates.domain, domainLevelDown),
-                                eq(certificates.domain, wildcardPrefixed)
-                            )
+                or(
+                    eq(certificates.domain, domain),
+                    and(
+                        eq(certificates.wildcard, true),
+                        or(
+                            eq(certificates.domain, domainLevelDown),
+                            eq(certificates.domain, wildcardPrefixed)
                        )
                    )
                )
@@ -51,12 +54,7 @@ export async function createCertificate(
        existing = await trx
            .select()
            .from(certificates)
-            .where(
-                and(
-                    eq(certificates.domainId, domainId),
-                    eq(certificates.domain, domain) // exact match for non-NS domains
-                )
-            );
+            .where(eq(certificates.domain, domain)); // exact match for non-NS domains
    }

    if (existing.length > 0) {
@@ -87,16 +85,22 @@ export async function createCertificate(
        }
    }

-    // No cert found, create a new one in pending state
-    await trx.insert(certificates).values({
-        domain: domainToWrite,
-        domainId,
-        wildcard:
-            domainRecord.type == "ns" ||
-            (domainRecord.type == "wildcard" &&
-                domainRecord.preferWildcardCert), // we can only create wildcard certs for NS domains
-        status: "pending",
-        updatedAt: Math.floor(Date.now() / 1000),
-        createdAt: Math.floor(Date.now() / 1000)
-    });
+    // No cert found, create a new one in pending state. onConflictDoNothing
+    // guards against the domain having been inserted concurrently (or under
+    // a different domainId) between the existence check above and this
+    // insert, since certificates.domain is globally unique.
+    await trx
+        .insert(certificates)
+        .values({
+            domain: domainToWrite,
+            domainId,
+            wildcard:
+                domainRecord.type == "ns" ||
+                (domainRecord.type == "wildcard" &&
+                    domainRecord.preferWildcardCert), // we can only create wildcard certs for NS domains
+            status: "pending",
+            updatedAt: Math.floor(Date.now() / 1000),
+            createdAt: Math.floor(Date.now() / 1000)
+        })
+        .onConflictDoNothing();
 }
@@ -66,6 +66,10 @@ import * as aiBudget from "@server/routers/aiBudget";
 import * as virtualApiKey from "@server/routers/virtualApiKey";
 import * as certificates from "@server/routers/certificates";

+function rateLimitIdentityKey(value: unknown): string {
+    return typeof value === "string" ? value.trim().toLowerCase() : "";
+}
+
 // Root routes
 export const unauthenticated = Router();

@@ -1490,21 +1494,6 @@ authenticated.get(
    logs.exportRequestAuditLogs
 );

-authenticated.get(
-    "/org/:orgId/logs/ai",
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.viewLogs),
-    logs.queryAiSessionLogs
-);
-
-authenticated.get(
-    "/org/:orgId/logs/ai/export",
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.exportLogs),
-    logActionAudit(ActionsEnum.exportLogs),
-    logs.exportAiSessionLogs
-);
-
 authenticated.get(
    "/org/:orgId/logs/ai/usage/filters",
    verifyOrgAccess,
@@ -1942,7 +1931,7 @@ authRouter.put(
        windowMs: 15 * 60 * 1000,
        max: 15,
        keyGenerator: (req) =>
-            `signup:${ipKeyGenerator(req.ip || "")}:${req.body.email}`,
+            `signup:${ipKeyGenerator(req.ip || "")}:${rateLimitIdentityKey(req.body.email)}`,
        handler: (req, res, next) => {
            const message = `You can only sign up ${15} times every ${15} minutes. Please try again later.`;
            return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -1957,7 +1946,7 @@ authRouter.post(
        windowMs: 15 * 60 * 1000,
        max: 15,
        keyGenerator: (req) =>
-            `login:${req.body.email || ipKeyGenerator(req.ip || "")}`,
+            `login:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`,
        handler: (req, res, next) => {
            const message = `You can only log in ${15} times every ${15} minutes. Please try again later.`;
            return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -1974,7 +1963,7 @@ authRouter.post(
        windowMs: 15 * 60 * 1000,
        max: 15,
        keyGenerator: (req) =>
-            `lookupUser:${req.body.identifier || ipKeyGenerator(req.ip || "")}`,
+            `lookupUser:${rateLimitIdentityKey(req.body.identifier) || ipKeyGenerator(req.ip || "")}`,
        handler: (req, res, next) => {
            const message = `You can only lookup users ${15} times every ${15} minutes. Please try again later.`;
            return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2052,7 +2041,7 @@ authRouter.post(
        windowMs: 15 * 60 * 1000,
        max: 15,
        keyGenerator: (req) => {
-            return `signup:${req.body.email || req.user?.userId || ipKeyGenerator(req.ip || "")}`;
+            return `signup:${rateLimitIdentityKey(req.body.email) || req.user?.userId || ipKeyGenerator(req.ip || "")}`;
        },
        handler: (req, res, next) => {
            const message = `You can only enable 2FA ${15} times every ${15} minutes. Please try again later.`;
@@ -2068,7 +2057,7 @@ authRouter.post(
        windowMs: 15 * 60 * 1000,
        max: 15,
        keyGenerator: (req) => {
-            return `signup:${req.body.email || req.user?.userId || ipKeyGenerator(req.ip || "")}`;
+            return `signup:${rateLimitIdentityKey(req.body.email) || req.user?.userId || ipKeyGenerator(req.ip || "")}`;
        },
        handler: (req, res, next) => {
            const message = `You can only request a 2FA code ${15} times every ${15} minutes. Please try again later.`;
@@ -2100,7 +2089,7 @@ authRouter.post(
        windowMs: 15 * 60 * 1000,
        max: 15,
        keyGenerator: (req) =>
-            `signup:${req.body.email || ipKeyGenerator(req.ip || "")}`,
+            `signup:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`,
        handler: (req, res, next) => {
            const message = `You can only sign up ${15} times every ${15} minutes. Please try again later.`;
            return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2118,7 +2107,7 @@ authRouter.post(
        windowMs: 15 * 60 * 1000,
        max: 15,
        keyGenerator: (req) =>
-            `requestEmailVerificationCode:${req.user?.email || ipKeyGenerator(req.ip || "")}`,
+            `requestEmailVerificationCode:${rateLimitIdentityKey(req.user?.email) || ipKeyGenerator(req.ip || "")}`,
        handler: (req, res, next) => {
            const message = `You can only request an email verification code ${15} times every ${15} minutes. Please try again later.`;
            return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2140,7 +2129,7 @@ authRouter.post(
        windowMs: 15 * 60 * 1000,
        max: 15,
        keyGenerator: (req) =>
-            `requestPasswordReset:${req.body.email || ipKeyGenerator(req.ip || "")}`,
+            `requestPasswordReset:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`,
        handler: (req, res, next) => {
            const message = `You can only request a password reset ${15} times every ${15} minutes. Please try again later.`;
            return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2156,7 +2145,7 @@ authRouter.post(
        windowMs: 15 * 60 * 1000,
        max: 15,
        keyGenerator: (req) =>
-            `resetPassword:${req.body.email || ipKeyGenerator(req.ip || "")}`,
+            `resetPassword:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`,
        handler: (req, res, next) => {
            const message = `You can only request a password reset ${15} times every ${15} minutes. Please try again later.`;
            return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2203,7 +2192,7 @@ authRouter.post(
        windowMs: 15 * 60 * 1000,
        max: 15,
        keyGenerator: (req) =>
-            `authWithWhitelist:${ipKeyGenerator(req.ip || "")}:${req.body.email}:${req.params.resourceId}`,
+            `authWithWhitelist:${ipKeyGenerator(req.ip || "")}:${rateLimitIdentityKey(req.body.email)}:${req.params.resourceId}`,
        handler: (req, res, next) => {
            const message = `You can only request an email OTP ${15} times every ${15} minutes. Please try again later.`;
            return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2255,7 +2244,7 @@ authRouter.post(
        windowMs: 15 * 60 * 1000, // 15 minutes
        max: 10, // Allow 10 authentication attempts per 15 minutes per IP
        keyGenerator: (req) => {
-            return `securityKeyAuth:${req.body.email || ipKeyGenerator(req.ip || "")}`;
+            return `securityKeyAuth:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`;
        },
        handler: (req, res, next) => {
            const message = `You can only attempt security key authentication ${10} times every ${15} minutes. Please try again later.`;
@@ -15,13 +15,7 @@ export async function createExitNode(
    if (!exitNodeQuery) {
        const { value: address, release } = await getNextAvailableSubnet();
        try {
-            // TODO: eventually we will want to get the next available port so that we can multiple exit nodes
-            // const listenPort = await getNextAvailablePort();
            const listenPort = config.getRawConfig().gerbil.start_port;
-            let subEndpoint = "";
-            if (config.getRawConfig().gerbil.use_subdomain) {
-                subEndpoint = await getUniqueExitNodeEndpointName();
-            }

            const exitNodeName =
                config.getRawConfig().gerbil.exit_node_name ||
@@ -32,7 +26,7 @@ export async function createExitNode(
                .insert(exitNodes)
                .values({
                    publicKey,
-                    endpoint: `${subEndpoint}${subEndpoint != "" ? "." : ""}${config.getRawConfig().gerbil.base_endpoint}`,
+                    endpoint: config.getRawConfig().gerbil.base_endpoint,
                    address,
                    online: true,
                    listenPort,
@@ -1532,21 +1532,6 @@ authenticated.get(
    logs.exportRequestAuditLogs
 );

-authenticated.get(
-    "/org/:orgId/logs/ai",
-    verifyApiKeyOrgAccess,
-    verifyApiKeyHasAction(ActionsEnum.viewLogs),
-    logs.queryAiSessionLogs
-);
-
-authenticated.get(
-    "/org/:orgId/logs/ai/export",
-    verifyApiKeyOrgAccess,
-    verifyApiKeyHasAction(ActionsEnum.exportLogs),
-    logActionAudit(ActionsEnum.exportLogs),
-    logs.exportAiSessionLogs
-);
-
 authenticated.get(
    "/org/:orgId/logs/ai/usage/filters",
    verifyApiKeyOrgAccess,
@@ -984,7 +984,7 @@ async function listLabelGroups(
        ).length;
    }

-    let groups: LauncherGroup[] = Array.from(labelCountMap.values()).map(
+    const groups: LauncherGroup[] = Array.from(labelCountMap.values()).map(
        (row) => ({
            groupKey: String(row.labelId),
            name: row.name,
@@ -1,9 +1,248 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { db } from "@server/db";
 import { MessageHandler } from "@server/routers/ws";
+import { sites, Newt, orgs, clients, clientSitesAssociationsCache, users } from "@server/db";
+import { and, eq, inArray } from "drizzle-orm";
+import logger from "@server/logger";
+import { inflate } from "zlib";
+import { promisify } from "util";
+import { logRequestAudit } from "@server/routers/badger/logRequestAudit";
+import { getCountryCodeForIp } from "@server/lib/geoip";

 export async function flushRequestLogToDb(): Promise<void> {
    return;
 }

+const zlibInflate = promisify(inflate);
+
+interface HTTPRequestLogData {
+    requestId: string;
+    resourceId: number; // siteResourceId
+    timestamp: string; // ISO 8601
+    method: string;
+    scheme: string; // "http" or "https"
+    host: string;
+    path: string;
+    rawQuery?: string;
+    userAgent?: string;
+    sourceAddr: string; // ip:port
+    tls: boolean;
+}
+
+/**
+ * Decompress a base64-encoded zlib-compressed string into parsed JSON.
+ */
+async function decompressRequestLog(
+    compressed: string
+): Promise<HTTPRequestLogData[]> {
+    const compressedBuffer = Buffer.from(compressed, "base64");
+    const decompressed = await zlibInflate(compressedBuffer);
+    const jsonString = decompressed.toString("utf-8");
+    const parsed = JSON.parse(jsonString);
+
+    if (!Array.isArray(parsed)) {
+        throw new Error("Decompressed request log data is not an array");
+    }
+
+    return parsed;
+}
+
 export const handleRequestLogMessage: MessageHandler = async (context) => {
-    return;
-};
+    const { message, client } = context;
+    const newt = client as Newt;
+
+    if (!newt) {
+        logger.warn("Request log received but no newt client in context");
+        return;
+    }
+
+    if (!newt.siteId) {
+        logger.warn("Request log received but newt has no siteId");
+        return;
+    }
+
+    if (!message.data?.compressed) {
+        logger.warn("Request log message missing compressed data");
+        return;
+    }
+
+    // Look up the org for this site and check retention settings
+    const [site] = await db
+        .select({
+            orgId: sites.orgId,
+            orgSubnet: orgs.subnet,
+            settingsLogRetentionDaysRequest:
+                orgs.settingsLogRetentionDaysRequest
+        })
+        .from(sites)
+        .innerJoin(orgs, eq(sites.orgId, orgs.orgId))
+        .where(eq(sites.siteId, newt.siteId));
+
+    if (!site) {
+        logger.warn(
+            `Request log received but site ${newt.siteId} not found in database`
+        );
+        return;
+    }
+
+    const orgId = site.orgId;
+
+    if (site.settingsLogRetentionDaysRequest === 0) {
+        logger.debug(
+            `Request log retention is disabled for org ${orgId}, skipping`
+        );
+        return;
+    }
+
+    let entries: HTTPRequestLogData[];
+    try {
+        entries = await decompressRequestLog(message.data.compressed);
+    } catch (error) {
+        logger.error("Failed to decompress request log data:", error);
+        return;
+    }
+
+    if (entries.length === 0) {
+        return;
+    }
+
+    logger.debug(`Request log entries: ${JSON.stringify(entries)}`);
+
+    // Build a map from sourceIp → external endpoint string by joining clients
+    // with clientSitesAssociationsCache. The endpoint is the real-world IP:port
+    // of the client device and is used for GeoIP lookup.
+    const ipToEndpoint = new Map<string, string>();
+    // Build a map from sourceIp → the user associated with the client (if any)
+    const ipToUser = new Map<string, { username: string; userId: string }>();
+
+    const cidrSuffix = site.orgSubnet?.includes("/")
+        ? site.orgSubnet.substring(site.orgSubnet.indexOf("/"))
+        : null;
+
+    if (cidrSuffix) {
+        const uniqueSourceAddrs = new Set<string>();
+        for (const entry of entries) {
+            if (entry.sourceAddr) {
+                uniqueSourceAddrs.add(entry.sourceAddr);
+            }
+        }
+
+        if (uniqueSourceAddrs.size > 0) {
+            const subnetQueries = Array.from(uniqueSourceAddrs).map((addr) => {
+                const ip = addr.includes(":") ? addr.split(":")[0] : addr;
+                return `${ip}${cidrSuffix}`;
+            });
+
+            const matchedClients = await db
+                .select({
+                    subnet: clients.subnet,
+                    endpoint: clientSitesAssociationsCache.endpoint,
+                    username: users.username,
+                    userId: users.userId
+                })
+                .from(clients)
+                .innerJoin(
+                    clientSitesAssociationsCache,
+                    and(
+                        eq(
+                            clientSitesAssociationsCache.clientId,
+                            clients.clientId
+                        ),
+                        eq(clientSitesAssociationsCache.siteId, newt.siteId)
+                    )
+                )
+                .leftJoin(users, eq(clients.userId, users.userId))
+                .where(
+                    and(
+                        eq(clients.orgId, orgId),
+                        inArray(clients.subnet, subnetQueries)
+                    )
+                );
+
+            for (const c of matchedClients) {
+                const ip = c.subnet.split("/")[0];
+                if (c.endpoint) {
+                    ipToEndpoint.set(ip, c.endpoint);
+                }
+                if (c.userId && c.username) {
+                    ipToUser.set(ip, { userId: c.userId, username: c.username });
+                }
+            }
+        }
+    }
+
+    for (const entry of entries) {
+        if (
+            !entry.requestId ||
+            !entry.resourceId ||
+            !entry.method ||
+            !entry.scheme ||
+            !entry.host ||
+            !entry.path ||
+            !entry.sourceAddr
+        ) {
+            logger.debug(
+                `Skipping request log entry with missing required fields: ${JSON.stringify(entry)}`
+            );
+            continue;
+        }
+
+        const originalRequestURL =
+            entry.scheme +
+            "://" +
+            entry.host +
+            entry.path +
+            (entry.rawQuery ? "?" + entry.rawQuery : "");
+
+        // Resolve the client's external endpoint for GeoIP lookup.
+        // sourceAddr is the WireGuard IP (possibly ip:port), so strip the port.
+        const sourceIp = entry.sourceAddr.includes(":")
+            ? entry.sourceAddr.split(":")[0]
+            : entry.sourceAddr;
+        const endpoint = ipToEndpoint.get(sourceIp);
+        let location: string | undefined;
+        if (endpoint) {
+            const endpointIp = endpoint.includes(":")
+                ? endpoint.split(":")[0]
+                : endpoint;
+            location = await getCountryCodeForIp(endpointIp);
+        }
+        const user = ipToUser.get(sourceIp);
+
+        await logRequestAudit(
+            {
+                action: true,
+                reason: 108,
+                siteResourceId: entry.resourceId,
+                orgId,
+                location,
+                user
+            },
+            {
+                path: entry.path,
+                originalRequestURL,
+                scheme: entry.scheme,
+                host: entry.host,
+                method: entry.method,
+                tls: entry.tls,
+                requestIp: entry.sourceAddr
+            }
+        );
+    }
+
+    logger.debug(
+        `Buffered ${entries.length} request log entry/entries from newt ${newt.newtId} (site ${newt.siteId})`
+    );
+};
@@ -80,7 +80,7 @@ export async function buildSiteConfigurationForOlmClient(
        );

    const siteResourcesBySiteId = new Map<number, SiteResource[]>();
-    let siteResourcesForExitNode = [];
+    const siteResourcesForExitNode = [];
    for (const row of allClientSiteResources) {
        if (row.siteResource.requiresExitNodeConnection) {
            siteResourcesForExitNode.push(row.siteResource);
--- a/Show More
+++ b/Show More