Merge pull request #3457 from fosrl/dev

1.21.0

.cursor/rules/Button-loading-state.mdc

@@ -0,0 +1,5 @@
+---
+alwaysApply: true
+---
+
+When adding submit buttons, don't change the text of the button during the loading state. Text should stay static and you should use the loading prop on the button.

.cursor/rules/Components.mdc

@@ -0,0 +1,5 @@
+---
+alwaysApply: true
+---
+
+When creating UI for popup dialogs or modals, use the Credenza componennt. This component is mobile responsive and works on desktop and wraps the dialog component and sheet into one.

.cursor/rules/Migrations.mdc

@@ -0,0 +1,5 @@
+---
+alwaysApply: true
+---
+
+Don't write or edit migrations in `server/setup` unless specificall instructed to do so.

.cursor/rules/TypeScript-rules.mdc

@@ -0,0 +1,7 @@
+---
+alwaysApply: true
+---
+
+When writing TypeScript:
+
+Prefer to use types instead of interfaces.

.cursor/rules/Use-React-form-and-Zod-schemas.mdc

@@ -0,0 +1,5 @@
+---
+alwaysApply: true
+---
+
+When creating forms, use React form for validation and use Zod schemas.

.dockerignore

@@ -34,4 +34,5 @@ build.ts
 tsconfig.json
 Dockerfile*
 drizzle.config.ts
-allowedDevOrigins.json
+allowedDevOrigins.json
+scratch/

.github/dependabot.yml

@@ -1,52 +1,42 @@
 version: 2
+
 updates:
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "daily"
+    open-pull-requests-limit: 1
     groups:
-      dev-patch-updates:
-        dependency-type: "development"
-        update-types:
-          - "patch"
-      dev-minor-updates:
-        dependency-type: "development"
-        update-types:
-          - "minor"
-      prod-patch-updates:
-        dependency-type: "production"
-        update-types:
-          - "patch"
-      prod-minor-updates:
-        dependency-type: "production"
-        update-types:
-          - "minor"
-          
+      npm-dependencies:
+        patterns:
+          - "*"
+
   - package-ecosystem: "docker"
     directory: "/"
     schedule:
       interval: "daily"
+    open-pull-requests-limit: 1
     groups:
-      patch-updates:
-        update-types:
-          - "patch"
-      minor-updates:
-        update-types:
-          - "minor"
+      docker-dependencies:
+        patterns:
+          - "*"
 
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 1
+    groups:
+      github-actions-dependencies:
+        patterns:
+          - "*"
 
   - package-ecosystem: "gomod"
     directory: "/install"
     schedule:
       interval: "daily"
+    open-pull-requests-limit: 1
     groups:
-      patch-updates:
-        update-types:
-          - "patch"
-      minor-updates:
-        update-types:
-          - "minor"
+      go-install-dependencies:
+        patterns:
+          - "*"

.github/workflows/cicd.yml

@@ -62,7 +62,7 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
             - name: Monitor storage space
               run: |
@@ -134,7 +134,7 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
             - name: Monitor storage space
               run: |
@@ -201,7 +201,7 @@ jobs:
         timeout-minutes: 30
         steps:
             - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
             - name: Log in to Docker Hub
               uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
@@ -256,7 +256,7 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
             - name: Extract tag name
               id: get-tag

.github/workflows/linting.yml

@@ -21,7 +21,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
             - name: Set up Node.js
               uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/test.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -62,7 +62,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Build Docker image sqlite
         run: make dev-build-sqlite
@@ -71,7 +71,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Build Docker image pg
         run: make dev-build-pg

.vscode/settings.json

@@ -18,5 +18,8 @@
     "[json]": {
         "editor.defaultFormatter": "esbenp.prettier-vscode"
     },
-    "editor.formatOnSave": true
+    "editor.formatOnSave": true,
+    "cSpell.words": [
+        "nessicary"
+    ]
 }

README.md

@@ -41,7 +41,7 @@
     </strong>
 </p>
 
-Pangolin is an open-source, identity-based remote access platform built on WireGuard® that enables secure, seamless connectivity to private and public resources. Pangolin combines reverse proxy and VPN capabilities into one platform, providing browser-based access to web applications and client-based access to any private resources with NAT traversal, all with granular access controls.
+Pangolin is an open-source, identity-based remote access platform built on WireGuard® that enables secure connectivity to infrastructure anywhere. It combines reverse-proxy and VPN capabilities into one platform, providing browser-based access to web applications and client-based access to private resources with NAT traversal, all with granular access control.
 
 ## Installation
 
@@ -63,11 +63,26 @@ Pangolin is an open-source, identity-based remote access platform built on WireG
 
 Pangolin's site connectors provide gateways into networks so you can access any networked resources. Sites use outbound tunnels and intelligent NAT traversal to make networks behind restrictive firewalls available for authorized access without public IPs or open ports. Easily deploy a site as a binary or container on any platform.
 
+* Lightweight user-space connector runs anywhere
+* Punches through any firewall
+* Doesn't require open ports or a public IP
+* Strict network segmentation
+* WireGuard-based
+* Get alerts when a device or network resource goes down
+
 <img src="public/screenshots/sites.png" alt="Sites" width="100%" />
 
 ### Browser-based reverse proxy access
 
-Expose web applications through identity and context-aware tunneled reverse proxies. Users access applications through any web browser with authentication and granular access control without installing a client. Pangolin handles routing, load balancing, health checking, and automatic SSL certificates without exposing your network directly to the internet.
+Expose HTTPS web applications and connect to VNC, RDP, and SSH entirely in the browser through identity and context-aware tunneled reverse proxies. Users access resources with authentication and granular access control without installing a client. Pangolin handles routing, load balancing, health checking, and automatic SSL certificates without exposing your network directly to the internet.
+
+* Expose a web panel anywhere
+* Access via any web browser
+* Single sign-on across all resources
+* HTTPS resources
+* Remote desktop in the browser with VNC and RDP
+* In-browser SSH terminal with privileged access management (PAM)
+* PIN codes, passcodes, email OTP, geoblocking, allow-lists, and more
 
 <img src="public/clip.gif" alt="Reverse proxy access" width="100%" />
 
@@ -75,14 +90,35 @@ Expose web applications through identity and context-aware tunneled reverse prox
 
 Access private resources like SSH servers, databases, RDP, and entire network ranges through Pangolin clients. Intelligent NAT traversal enables connections even through restrictive firewalls, while DNS aliases provide friendly names and fast connections to resources across all your sites. Add redundancy by routing traffic through multiple connectors in your network.
 
+* Peer-to-peer with intelligent NAT traversal
+* Hosts/IPs and port ranges
+* Network ranges/CIDRs
+* Friendly DNS aliases for network addresses
+* Privileged access management (PAM) with SSH resources
+* Private HTTPS resources only accessible on the private network
+
 <img src="public/screenshots/private-resources.png" alt="Private resources" width="100%" />
 
 ### Give users and roles access to resources
 
-Use Pangolin's built in users or bring your own identity provider and set up role based access control (RBAC). Grant users access to specific resources, not entire networks. Unlike traditional VPNs that expose full network access, Pangolin's zero-trust model ensures users can only reach the applications, services, and routes you explicitly define.
+Use Pangolin's built-in users or bring your own identity provider and set up role-based access control (RBAC). Grant users access to specific resources, not entire networks. Unlike traditional VPNs that expose full network access, Pangolin's zero-trust model ensures users can only reach the applications, services, and routes you explicitly define.
+
+* Bring your existing identity provider (IdP) or use Pangolin identities
+* Sync users and roles from your IdP
+* User- and role-based access control
+* Full network audit and access logs
 
 <img src="public/screenshots/users.png" alt="Users from identity provider with roles" width="100%" />
 
+### Find and launch resources from a personalized home page
+
+Give users a landing page to quickly find and open the resources they can access. Resources are grouped by site or label, searchable, and filterable, with grid or list views. Saved views capture filters, grouping, and layout as personal or organization-wide defaults.
+
+* Single place for admins and non-admins to see accessible resources
+* Create reusable views for common access patterns
+
+<img src="public/screenshots/resource-launcher.png" alt="Resource Launcher" width="100%" />
+
 ## Download Clients
 
 Download the Pangolin client for your platform:

cli/commands/setServerAdmin.ts

@@ -4,19 +4,26 @@ import { eq } from "drizzle-orm";
 
 type SetServerAdminArgs = {
     email: string;
+    remove: boolean;
 };
 
 export const setServerAdmin: CommandModule<{}, SetServerAdminArgs> = {
     command: "set-server-admin",
-    describe: "Mark any user as a server admin by email address",
+    describe: "Add or remove server admin by email address",
     builder: (yargs) => {
-        return yargs.option("email", {
-            type: "string",
-            demandOption: true,
-            describe: "User email address"
-        });
+        return yargs
+            .option("email", {
+                type: "string",
+                demandOption: true,
+                describe: "User email address"
+            })
+            .option("remove", {
+                type: "boolean",
+                default: false,
+                describe: "Remove server admin status from the user"
+            });
     },
-    handler: async (argv: { email: string }) => {
+    handler: async (argv: SetServerAdminArgs) => {
         try {
             const email = argv.email.trim().toLowerCase();
 
@@ -31,6 +38,33 @@ export const setServerAdmin: CommandModule<{}, SetServerAdminArgs> = {
                 process.exit(1);
             }
 
+            if (argv.remove) {
+                if (!user.serverAdmin) {
+                    console.log(`User '${email}' is not a server admin`);
+                    process.exit(0);
+                }
+
+                const serverAdmins = await db
+                    .select()
+                    .from(users)
+                    .where(eq(users.serverAdmin, true));
+
+                if (serverAdmins.length <= 1) {
+                    console.error(
+                        "Cannot remove server admin: at least one server admin must exist"
+                    );
+                    process.exit(1);
+                }
+
+                await db
+                    .update(users)
+                    .set({ serverAdmin: false })
+                    .where(eq(users.userId, user.userId));
+
+                console.log(`Server admin status removed from user '${email}'`);
+                process.exit(0);
+            }
+
             if (user.serverAdmin) {
                 console.log(`User '${email}' is already a server admin`);
                 process.exit(0);

compose.example.yaml

@@ -41,7 +41,7 @@ services:
       - 80:80 # Port for traefik because of the network_mode
 
   traefik:
-    image: traefik:v3.6
+    image: traefik:v3.7
     container_name: traefik
     restart: unless-stopped
     network_mode: service:gerbil # Ports appear on the gerbil service

install/config/config.yml

@@ -38,7 +38,5 @@ flags:
     disable_user_create_org: false
     allow_raw_resources: true
 
-{{if .IsPostgreSQL}}
-postgres:
-  connection_string: postgresql://pangolin:{{.IsPostgreSQLPass}}@postgres:5432/pangolin
-{{end}}
+{{if .IsPostgreSQL}}postgres:
+    connection_string: postgresql://pangolin:{{.IsPostgreSQLPass}}@postgres:5432/pangolin{{end}}

install/config/docker-compose.yml

@@ -7,23 +7,17 @@ services:
     deploy:
       resources:
         limits:
-          memory: 1g
+          memory: 2g
         reservations:
-          memory: 256m
-{{if or .IsPostgreSQL .IsRedis}}
-    depends_on:
-    {{if .IsPostgreSQL}}
-      postgres:
-        condition: service_healthy
-    {{end}}
-    {{if .IsRedis}}
-      redis:
-        condition: service_healthy
-    {{end}}
+          memory: 512m
+    {{if or .IsPostgreSQL .IsRedis}}depends_on:
+      {{if .IsPostgreSQL}}postgres:
+          condition: service_healthy{{end}}
+      {{if .IsRedis}}redis:
+          condition: service_healthy{{end}}
     networks:
       - default
-      - backend
-{{end}}
+      - backend{{end}}
     volumes:
       - ./config:/app/config
     healthcheck:
@@ -31,8 +25,8 @@ services:
       interval: "10s"
       timeout: "10s"
       retries: 15
-{{if .InstallGerbil}}
-  gerbil:
+
+  {{if .InstallGerbil}}gerbil:
     image: docker.io/fosrl/gerbil:{{.GerbilVersion}}
     container_name: gerbil
     restart: unless-stopped
@@ -53,17 +47,16 @@ services:
       - 21820:21820/udp
       - 443:443
       - 443:443/udp # For http3 QUIC if desired
-      - 80:80
-{{end}}
+      - 80:80{{end}}
+
   traefik:
-    image: docker.io/traefik:v3.6
+    image: docker.io/traefik:v3.7
     container_name: traefik
     restart: unless-stopped
-{{if .InstallGerbil}}    network_mode: service:gerbil # Ports appear on the gerbil service{{end}}{{if not .InstallGerbil}}
+    {{if .InstallGerbil}}network_mode: service:gerbil # Ports appear on the gerbil service{{end}}{{if not .InstallGerbil}}
     ports:
       - 443:443
-      - 80:80
-{{end}}
+      - 80:80{{end}}
     depends_on:
       pangolin:
         condition: service_healthy
@@ -74,8 +67,7 @@ services:
       - ./config/letsencrypt:/letsencrypt # Volume to store the Let's Encrypt certificates
       - ./config/traefik/logs:/var/log/traefik # Volume to store Traefik logs
 
-{{if .IsPostgreSQL}}
-  postgres:
+  {{if .IsPostgreSQL}}postgres:
     image: postgres:18
     container_name: postgres
     restart: unless-stopped
@@ -91,11 +83,9 @@ services:
       timeout: 5s
       retries: 5
     networks:
-      - backend
-{{end}}
+      - backend{{end}}
 
-{{if .IsRedis}}
-  redis:
+  {{if .IsRedis}}redis:
     image: redis:8-trixie
     container_name: redis
     restart: unless-stopped
@@ -113,17 +103,14 @@ services:
       retries: 3
       start_period: 10s
     networks:
-      - backend
-{{end}}
+      - backend{{end}}
 
 networks:
   default:
     driver: bridge
     name: pangolin_frontend
 {{if .EnableIPv6}}    enable_ipv6: true{{end}}
-{{if or .IsPostgreSQL .IsRedis}}
-  backend:
+{{if or .IsPostgreSQL .IsRedis}}  backend:
     driver: bridge
     name: pangolin_backend
-    internal: true
-{{end}}
+    internal: true{{end}}

install/config/privateConfig.yml

@@ -1,6 +1,4 @@
-{{if .IsRedis}}
-redis:
+{{if .IsRedis}}redis:
   host: "redis"
   port: 6379
-  password: "{{.IsRedisPass}}"
-{{end}}
+  password: "{{.IsRedisPass}}"{{end}}

install/go.mod

@@ -5,7 +5,7 @@ go 1.25.0
 require (
 	github.com/charmbracelet/huh v1.0.0
 	github.com/charmbracelet/lipgloss v1.1.0
-	golang.org/x/term v0.43.0
+	golang.org/x/term v0.44.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -33,6 +33,6 @@ require (
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	golang.org/x/sync v0.15.0 // indirect
-	golang.org/x/sys v0.44.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
 	golang.org/x/text v0.23.0 // indirect
 )

install/go.sum

@@ -69,10 +69,10 @@ golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
 golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
-golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
-golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
+golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
 golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
 golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=

install/main.go

@@ -71,9 +71,12 @@ const (
 	Undefined SupportedContainer = "undefined"
 )
 
+var redisFlag *bool
+
 func main() {
 
 	crowdsecFlag := flag.Bool("crowdsec", false, "Enable the CrowdSec installation prompt")
+	redisFlag = flag.Bool("redis", false, "Install Redis as caching solution. Required for HA. Not required for the Enterprise version.")
 	flag.Parse()
 
 	// print a banner about prerequisites - opening port 80, 443, 51820, and 21820 on the VPS and firewall and pointing your domain to the VPS IP with a records. Docs are at http://localhost:3000/Getting%20Started/dns-networking
@@ -491,13 +494,13 @@ func collectUserInput() Config {
 
 	config.IsEnterprise = readBoolNoDefault("Do you want to install the Enterprise version of Pangolin? The EE is free for personal use or for businesses making less than 100k USD annually.")
     if config.IsEnterprise {
-        config.IsRedis = readBool("Do you want to run the Redis containers locally? Required for HA.")
-        if config.IsRedis {
+        if *redisFlag {
+			config.IsRedis = true
             config.IsRedisPass = readPassword("Enter a unique password for the Redis service.")
         }
     }
 
-    config.IsPostgreSQL = readBool("Do you want to run the PostgreSQL containers locally? Otherwise, default to the local SQLite database only.", false)
+    config.IsPostgreSQL = readBool("Do you want to use PostgreSQL (not recommended for most users)?", false)
 	if config.IsPostgreSQL {
 		config.IsPostgreSQLPass = readPassword("Enter a unique password for the PostgreSQL pangolin user.")
 	}
@@ -544,7 +547,7 @@ func collectUserInput() Config {
 	fmt.Println("\n=== Advanced Configuration ===")
 
 	config.EnableIPv6 = readBool("Is your server IPv6 capable?", true)
-	config.EnableMaxMind = readBool("Do you want to download the MaxMind GeoLite2 Country and ADN databases for blocking functionality?", true)
+	config.EnableMaxMind = readBool("Do you want to download the MaxMind GeoLite2 Country and ASN databases for blocking functionality?", true)
 
 	if config.DashboardDomain == "" {
 		fmt.Println("Error: Dashboard Domain name is required")

messages/en-US.json

@@ -66,9 +66,15 @@
     "local": "Local",
     "edit": "Edit",
     "siteConfirmDelete": "Confirm Delete Site",
+    "siteConfirmDeleteAndResources": "Confirm Delete Site and Resources",
     "siteDelete": "Delete Site",
-    "siteMessageRemove": "Once removed the site will no longer be accessible. All targets associated with the site will also be removed.",
+    "siteDeleteAndResources": "Delete Site and Resources",
+    "siteMessageRemove": "Once removed the site will no longer be accessible. Targets associated with this site will be removed, but resources will remain.",
+    "siteMessageRemoveAndResources": "This will permanently delete all public and private resources linked to this site, even if a resource is also associated with other sites.",
     "siteQuestionRemove": "Are you sure you want to remove the site from the organization?",
+    "siteQuestionRemoveAndResources": "Are you sure you want to delete this site and all associated resources?",
+    "sitesTableDeleteSite": "Delete Site",
+    "sitesTableDeleteSiteAndResources": "Delete Site and Resources",
     "siteManageSites": "Manage Sites",
     "siteDescription": "Create and manage sites to enable connectivity to private networks",
     "sitesBannerTitle": "Connect Any Network",
@@ -101,6 +107,8 @@
     "sitesTableViewPrivateResources": "View Private Resources",
     "siteInstallNewt": "Install Site",
     "siteInstallNewtDescription": "Install the site connector for your system",
+    "siteInstallKubernetesDocsDescription": "For more and up to date Kubernetes installation information, see <docsLink>docs.pangolin.net/manage/sites/install-kubernetes</docsLink>.",
+    "siteInstallAdvantechDocsDescription": "For Advantech modem installation instructions, see <docsLink>docs.pangolin.net/manage/sites/install-advantech</docsLink>.",
     "WgConfiguration": "WireGuard Configuration",
     "WgConfigurationDescription": "Use the following configuration to connect to the network",
     "operatingSystem": "Operating System",
@@ -115,6 +123,16 @@
     "siteUpdated": "Site updated",
     "siteUpdatedDescription": "The site has been updated.",
     "siteGeneralDescription": "Configure the general settings for this site",
+    "siteRestartTitle": "Restart Site",
+    "siteRestartDescription": "Restart the WireGuard tunnel for this site. This will briefly interrupt connectivity.",
+    "siteRestartBody": "Use this if the site tunnel is not functioning correctly and you want to force a reconnect without restarting the host.",
+    "siteRestartButton": "Restart Site",
+    "siteRestartDialogMessage": "Are you sure you want to restart the WireGuard tunnel for <b>{name}</b>? The site will briefly lose connectivity.",
+    "siteRestartWarning": "The site will briefly disconnect while the tunnel restarts.",
+    "siteRestarted": "Site restarted",
+    "siteRestartedDescription": "The WireGuard tunnel has been restarted.",
+    "siteErrorRestart": "Failed to restart site",
+    "siteErrorRestartDescription": "An error occurred while restarting the site.",
     "siteSettingDescription": "Configure the settings on the site",
     "siteResourcesTab": "Resources",
     "siteResourcesNoneOnSite": "This site has no public or private resources yet.",
@@ -148,19 +166,19 @@
     "siteCredentialsSaveDescription": "You will only be able to see this once. Make sure to copy it to a secure place.",
     "siteInfo": "Site Information",
     "status": "Status",
-    "shareTitle": "Manage Share Links",
+    "shareTitle": "Manage Shareable Links",
     "shareDescription": "Create shareable links to grant temporary or permanent access to proxy resources",
-    "shareSearch": "Search share links...",
-    "shareCreate": "Create Share Link",
+    "shareSearch": "Search shareable links...",
+    "shareCreate": "Create Shareable Link",
     "shareErrorDelete": "Failed to delete link",
     "shareErrorDeleteMessage": "An error occurred deleting link",
     "shareDeleted": "Link deleted",
     "shareDeletedDescription": "The link has been deleted",
-    "shareDelete": "Delete Share Link",
-    "shareDeleteConfirm": "Confirm Delete Share Link",
+    "shareDelete": "Delete Shareable Link",
+    "shareDeleteConfirm": "Confirm Delete Shareable Link",
     "shareQuestionRemove": "Are you sure you want to delete this share link?",
     "shareMessageRemove": "Once deleted, the link will no longer work and anyone using it will lose access to the resource.",
-    "shareTokenDescription": "The access token can be passed in two ways: as a query parameter or in the request headers. These must be passed from the client on every request for authenticated access.",
+    "shareTokenDescription": "The access token can be passed as a query parameter or in request headers. By default it must be sent on every request. If session persistence is enabled, the first request exchanges it for a session cookie.",
     "accessToken": "Access Token",
     "usageExamples": "Usage Examples",
     "tokenId": "Token ID",
@@ -177,8 +195,15 @@
     "shareCreateDescription": "Anyone with this link can access the resource",
     "shareTitleOptional": "Title (optional)",
     "sharePathOptional": "Path (optional)",
+    "sharePathDescription": "The link will redirect users to this path after authentication.",
+    "shareAssociateUserOptional": "Associate User (optional)",
+    "shareAssociateUserDescription": "When set, requests using this link are attributed to the user in access logs and identity headers. The link is removed if the user leaves the organization.",
+    "userSelect": "Select user",
+    "usersNotFound": "No users found",
     "expireIn": "Expire In",
     "neverExpire": "Never expire",
+    "sharePersistSession": "Persist session after first use",
+    "sharePersistSessionDescription": "When enabled, the first request with this token via a query param or header sets a session cookie so later requests do not need the token. Leave off for API clients that should send the token on every request.",
     "shareExpireDescription": "Expiration time is how long the link will be usable and provide access to the resource. After this time, the link will no longer work, and users who used this link will lose access to the resource.",
     "shareSeeOnce": "You will only be able to see this link once. Make sure to copy it.",
     "shareAccessHint": "Anyone with this link can access the resource. Share it with care.",
@@ -200,8 +225,8 @@
     "shareErrorSelectResource": "Please select a resource",
     "proxyResourceTitle": "Manage Public Resources",
     "proxyResourceDescription": "Create and manage resources that are publicly accessible through a web browser",
-    "proxyResourcesBannerTitle": "Web-based Public Access",
-    "proxyResourcesBannerDescription": "Public resources are HTTPS proxies accessible to anyone on the internet through a web browser. Unlike private resources, they do not require client-side software and can include identity and context-aware access policies.",
+    "publicResourcesBannerTitle": "Web-based Public Access",
+    "publicResourcesBannerDescription": "Public resources are proxies accessible to anyone on the internet through a web browser and include identity and context-aware access policies. Unlike private resources, they do not require client-side software.",
     "clientResourceTitle": "Manage Private Resources",
     "clientResourceDescription": "Create and manage resources that are only accessible through a connected client",
     "privateResourcesBannerTitle": "Zero-Trust Private Access",
@@ -209,15 +234,19 @@
     "resourcesSearch": "Search resources...",
     "resourceAdd": "Add Resource",
     "resourceErrorDelte": "Error deleting resource",
-    "resourcePoliciesTitle": "Manage Resource Policies",
-    "resourcePoliciesAttachedResourcesColumnTitle": "Attached resources",
+    "resourcePoliciesBannerTitle": "Re-use Authentication and Access Rules",
+    "resourcePoliciesBannerDescription": "Shared resource policies let you define authentication methods and access rules once, then attach them to multiple public resources. When you update a policy, every linked resource inherits the change automatically.",
+    "resourcePoliciesBannerButtonText": "Learn More",
+    "resourcePoliciesTitle": "Manage Public Resource Policies",
+    "resourcePoliciesAttachedResourcesColumnTitle": "Resources",
     "resourcePoliciesAttachedResources": "{count} resource(s)",
+    "resourcePoliciesAttachedResourcesCount": "{count, plural, one {# resource} other {# resources}}",
     "resourcePoliciesAttachedResourcesEmpty": "no resources",
-    "resourcePoliciesDescription": "Create and manage authentication policies to control access to your resources",
+    "resourcePoliciesDescription": "Create and manage authentication policies to control access to your public resources",
     "resourcePoliciesSearch": "Search policies...",
     "resourcePoliciesAdd": "Add Policy",
     "resourcePoliciesDefaultBadgeText": "Default policy",
-    "resourcePoliciesCreate": "Create Resource Policy",
+    "resourcePoliciesCreate": "Create Public Resource Policy",
     "resourcePoliciesCreateDescription": "Follow the steps below to create a new policy",
     "resourcePolicyName": "Policy Name",
     "resourcePolicyNameDescription": "Give this policy a name to identify it across your resources",
@@ -243,6 +272,8 @@
     "resourceRawDescriptionCloud": "Proxy requests over raw TCP/UDP using a port number. Requires sites to connect to a remote node.",
     "resourceCreate": "Create Resource",
     "resourceCreateDescription": "Follow the steps below to create a new resource",
+    "resourcePublicCreate": "Create Public Resource",
+    "resourcePublicCreateDescription": "Follow the steps below to create a new public resource that is accessible through a web browser",
     "resourceCreateGeneralDescription": "Configure the basic resource settings including the name and the type",
     "resourceSeeAll": "See All Resources",
     "resourceCreateGeneral": "General",
@@ -274,7 +305,7 @@
     "back": "Back",
     "cancel": "Cancel",
     "resourceConfig": "Configuration Snippets",
-    "resourceConfigDescription": "Copy and paste these configuration snippets to set up the TCP/UDP resource",
+    "resourceConfigDescription": "Copy and paste these configuration snippets to set up the TCP/UDP resource.",
     "resourceAddEntrypoints": "Traefik: Add Entrypoints",
     "resourceExposePorts": "Gerbil: Expose Ports in Docker Compose",
     "resourceLearnRaw": "Learn how to configure TCP/UDP resources",
@@ -287,6 +318,8 @@
     "labelDelete": "Delete Label",
     "labelAdd": "Add Label",
     "labelCreateSuccessMessage": "Label Created Successfully",
+    "labelDuplicateError": "Duplicate Label",
+    "labelDuplicateErrorDescription": "A label with this name already exists.",
     "labelEditSuccessMessage": "Label Modified Successfully",
     "labelNameField": "Label Name",
     "labelColorField": "Label Color",
@@ -311,7 +344,7 @@
     "rules": "Rules",
     "resourceSettingDescription": "Configure the settings on the resource",
     "resourceSetting": "{resourceName} Settings",
-    "resourcePolicySettingDescription": "Configure the settings on the resource policy",
+    "resourcePolicySettingDescription": "Configure the settings on this public resource policy",
     "resourcePolicySetting": "{policyName} Settings",
     "alwaysAllow": "Bypass Auth",
     "alwaysDeny": "Block Access",
@@ -422,8 +455,14 @@
     "provisioningManage": "Provisioning",
     "provisioningDescription": "Manage provisioning keys and review pending sites awaiting approval.",
     "pendingSites": "Pending Sites",
-    "siteApproveSuccess": "Site approved successfully",
+    "siteApproveSuccess": "Site and associated resources approved successfully",
     "siteApproveError": "Error approving site",
+    "siteReject": "Reject Site",
+    "siteQuestionReject": "Are you sure you want to reject this site?",
+    "siteMessageReject": "This will permanently delete the site and any associated resources that are still pending.",
+    "siteConfirmReject": "Confirm Reject Site",
+    "siteRejectSuccess": "Site rejected successfully",
+    "siteRejectError": "Error rejecting site",
     "provisioningKeys": "Provisioning Keys",
     "searchProvisioningKeys": "Search provisioning keys...",
     "provisioningKeysAdd": "Generate Provisioning Key",
@@ -439,12 +478,12 @@
     "provisioningKeysSave": "Save the provisioning key",
     "provisioningKeysSaveDescription": "You will only be able to see this once. Copy it to a secure place.",
     "provisioningKeysErrorCreate": "Error creating provisioning key",
-    "provisioningKeysList": "New provisioning key",
-    "provisioningKeysMaxBatchSize": "Max batch size",
+    "provisioningKeysList": "New Provisioning Key",
+    "provisioningKeysMaxBatchSize": "Max Batch Size",
     "provisioningKeysUnlimitedBatchSize": "Unlimited batch size (no limit)",
     "provisioningKeysMaxBatchUnlimited": "Unlimited",
     "provisioningKeysMaxBatchSizeInvalid": "Enter a valid max batch size (1–1,000,000).",
-    "provisioningKeysValidUntil": "Valid until",
+    "provisioningKeysValidUntil": "Valid Until",
     "provisioningKeysValidUntilHint": "Leave empty for no expiration.",
     "provisioningKeysValidUntilInvalid": "Enter a valid date and time.",
     "provisioningKeysNumUsed": "Times used",
@@ -453,7 +492,7 @@
     "provisioningKeysNeverUsed": "Never",
     "provisioningKeysEdit": "Edit Provisioning Key",
     "provisioningKeysEditDescription": "Update the max batch size and expiration time for this key.",
-    "provisioningKeysApproveNewSites": "Approve new sites",
+    "provisioningKeysApproveNewSites": "Approve New Sites",
     "provisioningKeysApproveNewSitesDescription": "Automatically approve sites that register with this key.",
     "provisioningKeysUpdateError": "Error updating provisioning key",
     "provisioningKeysUpdated": "Provisioning key updated",
@@ -588,7 +627,8 @@
     "idpNameInternal": "Internal",
     "emailInvalid": "Invalid email address",
     "inviteValidityDuration": "Please select a duration",
-    "accessRoleSelectPlease": "Please select a role",
+    "accessRoleSelectPlease": "A user must belong to at least one role.",
+    "accessRoleRequired": "Role required",
     "removeOwnAdminRoleConfirmTitle": "Remove your administrator access?",
     "removeOwnAdminRoleConfirmDescription": "You will no longer have administrator permissions in this organization after saving. Another administrator can restore access if needed.",
     "removeOwnAdminRoleConfirmButton": "Remove My Administrator Access",
@@ -719,7 +759,7 @@
     "targetSubmit": "Add Target",
     "targetNoOne": "This resource doesn't have any targets. Add a target to configure where to send requests to the backend.",
     "targetNoOneDescription": "Adding more than one target above will enable load balancing.",
-    "targetsSubmit": "Save Targets",
+    "targetsSubmit": "Save Settings",
     "addTarget": "Add Target",
     "proxyMultiSiteRoundRobinNodeHelp": "Round robin routing will not work between sites that are not connected to the same node, but failover will work.",
     "targetErrorInvalidIp": "Invalid IP address",
@@ -753,11 +793,11 @@
     "rulesErrorDuplicate": "Duplicate rule",
     "rulesErrorDuplicateDescription": "A rule with these settings already exists",
     "rulesErrorInvalidIpAddressRange": "Invalid CIDR",
-    "rulesErrorInvalidIpAddressRangeDescription": "Please enter a valid CIDR value",
-    "rulesErrorInvalidUrl": "Invalid URL path",
-    "rulesErrorInvalidUrlDescription": "Please enter a valid URL path value",
-    "rulesErrorInvalidIpAddress": "Invalid IP",
-    "rulesErrorInvalidIpAddressDescription": "Please enter a valid IP address",
+    "rulesErrorInvalidIpAddressRangeDescription": "Enter a valid CIDR range (e.g., 10.0.0.0/8).",
+    "rulesErrorInvalidUrl": "Invalid path",
+    "rulesErrorInvalidUrlDescription": "Enter a valid URL path or pattern (e.g., /api/*).",
+    "rulesErrorInvalidIpAddress": "Invalid IP address",
+    "rulesErrorInvalidIpAddressDescription": "Enter a valid IPv4 or IPv6 address.",
     "rulesErrorUpdate": "Failed to update rules",
     "rulesErrorUpdateDescription": "An error occurred while updating rules",
     "rulesUpdated": "Enable Rules",
@@ -765,15 +805,24 @@
     "rulesMatchIpAddressRangeDescription": "Enter an address in CIDR format (e.g., 103.21.244.0/22)",
     "rulesMatchIpAddress": "Enter an IP address (e.g., 103.21.244.12)",
     "rulesMatchUrl": "Enter a URL path or pattern (e.g., /api/v1/todos or /api/v1/*)",
-    "rulesErrorInvalidPriority": "Invalid Priority",
-    "rulesErrorInvalidPriorityDescription": "Please enter a valid priority",
-    "rulesErrorDuplicatePriority": "Duplicate Priorities",
-    "rulesErrorDuplicatePriorityDescription": "Please enter unique priorities",
+    "rulesErrorInvalidPriority": "Invalid priority",
+    "rulesErrorInvalidPriorityDescription": "Enter a whole number of 1 or higher.",
+    "rulesErrorDuplicatePriority": "Duplicate priorities",
+    "rulesErrorDuplicatePriorityDescription": "Each rule must have a unique priority number.",
+    "rulesErrorValidation": "Invalid rules",
+    "rulesErrorValidationRuleDescription": "Rule {ruleNumber}: {message}",
+    "rulesErrorInvalidMatchTypeDescription": "Select a valid match type (path, IP, CIDR, country, region, or ASN).",
+    "rulesErrorValueRequired": "Enter a value for this rule.",
+    "rulesErrorInvalidCountry": "Invalid country",
+    "rulesErrorInvalidCountryDescription": "Select a valid country.",
+    "rulesErrorInvalidAsn": "Invalid ASN",
+    "rulesErrorInvalidAsnDescription": "Enter a valid ASN (e.g., AS15169).",
     "ruleUpdated": "Rules updated",
     "ruleUpdatedDescription": "Rules updated successfully",
     "ruleErrorUpdate": "Operation failed",
     "ruleErrorUpdateDescription": "An error occurred during the save operation",
     "rulesPriority": "Priority",
+    "rulesReorderDragHandle": "Drag to reorder rule priority",
     "rulesAction": "Action",
     "rulesMatchType": "Match Type",
     "value": "Value",
@@ -792,7 +841,7 @@
     "rulesResource": "Resource Rules Configuration",
     "rulesResourceDescription": "Configure rules to control access to the resource",
     "ruleSubmit": "Add Rule",
-    "rulesNoOne": "No rules. Add a rule using the form.",
+    "rulesNoOne": "No rules yet.",
     "rulesOrder": "Rules are evaluated by priority in ascending order.",
     "rulesSubmit": "Save Rules",
     "policyErrorCreate": "Error creating policy",
@@ -803,7 +852,48 @@
     "policyErrorUpdateMessageDescription": "An unexpected error occurred",
     "policyCreatedSuccess": "Resource policy succesfully created",
     "policyUpdatedSuccess": "Resource policy succesfully updated",
-    "authMethodsSave": "Save auth methods",
+    "authMethodsSave": "Save Settings",
+    "policyAuthStackTitle": "Authentication",
+    "policyAuthStackDescription": "Control which authentication methods are required to access this resource",
+    "policyAuthOrLogicTitle": "Multiple authentication methods active",
+    "policyAuthOrLogicBanner": "Visitors may authenticate using any one of the active methods below. They do not need to complete all of them.",
+    "policyAuthMethodActive": "Active",
+    "policyAuthMethodOff": "Off",
+    "policyAuthSsoTitle": "Platform SSO",
+    "policyAuthSsoDescription": "Require sign-in through your organization's identity provider",
+    "policyAuthSsoSummary": "{idp} · {users} users, {roles} roles",
+    "policyAuthSsoDefaultIdp": "Default provider",
+    "policyAuthAddDefaultIdentityProvider": "Add Default Identity Provider",
+    "policyAuthOtherMethodsTitle": "Other Methods",
+    "policyAuthOtherMethodsDescription": "Optional methods visitors can use instead of or alongside platform SSO",
+    "policyAuthPasscodeTitle": "Passcode",
+    "policyAuthPasscodeDescription": "Require a shared alphanumeric passcode to access the resource",
+    "policyAuthPasscodeSummary": "Passcode set",
+    "policyAuthPincodeTitle": "PIN Code",
+    "policyAuthPincodeDescription": "A short numeric code required to access the resource",
+    "policyAuthPincodeSummary": "6-digit PIN set",
+    "policyAuthEmailTitle": "Email Whitelist",
+    "policyAuthEmailDescription": "Allow listed email addresses with one-time passwords",
+    "policyAuthEmailSummary": "{count} addresses allowed",
+    "policyAuthEmailOtpCallout": "Enabling email whitelist sends a one-time password to the visitor's email on login.",
+    "policyAuthHeaderAuthTitle": "Basic Header Auth",
+    "policyAuthHeaderAuthDescription": "Validate a custom HTTP header name and value on each request",
+    "policyAuthHeaderAuthSummary": "Header configured",
+    "policyAuthHeaderName": "Username",
+    "policyAuthHeaderValue": "Password",
+    "policyAuthSetPasscode": "Set Passcode",
+    "policyAuthSetPincode": "Set PIN Code",
+    "policyAuthSetEmailWhitelist": "Set Email Whitelist",
+    "policyAuthSetHeaderAuth": "Set Basic Header Auth",
+    "policyAccessRulesTitle": "Access Rules",
+    "policyAccessRulesEnableDescription": "When enabled, rules are evaluated in descending order until one evaluates as true.",
+    "policyAccessRulesFirstMatch": "Rules are evaluated top to bottom. The first matching rule decides the outcome.",
+    "policyAccessRulesHowItWorks": "Rules match requests by path, IP address, location, or other criteria. Each rule applies an action: bypass authentication, block access, or pass to authentication. If no rule matches, traffic continues to authentication.",
+    "policyAccessRulesFallthroughOff": "When rules are disabled, all traffic passes through to authentication.",
+    "policyAccessRulesFallthroughOn": "When no rule matches, traffic passes through to authentication.",
+    "rulesPlaceholderCidr": "10.0.0.0/8",
+    "rulesPlaceholderPath": "/admin/*",
+    "rulesPlaceholderGeo": "RU, KP",
     "rulesSave": "Save Rules",
     "resourceErrorCreate": "Error creating resource",
     "resourceErrorCreateDescription": "An error occurred when creating the resource",
@@ -824,9 +914,9 @@
     "resourcesErrorUpdateDescription": "An error occurred while updating the resource",
     "access": "Access",
     "accessControl": "Access Control",
-    "shareLink": "{resource} Share Link",
+    "shareLink": "{resource} Shareable Link",
     "resourceSelect": "Select resource",
-    "shareLinks": "Share Links",
+    "shareLinks": "Shareable Links",
     "share": "Shareable Links",
     "shareDescription2": "Create shareable links to resources. Links provide temporary or unlimited access to your resource. You can configure the expiration duration of the link when you create one.",
     "shareEasyCreate": "Easy to create and share",
@@ -916,10 +1006,18 @@
     "resourceRoleDescription": "Admins can always access this resource.",
     "resourcePolicySelectTitle": "Resource Access Policy",
     "resourcePolicySelectDescription": "Select the resource policy type for authentication",
+    "resourcePolicyTypeLabel": "Policy type",
+    "resourcePolicyLabel": "Resource policy",
     "resourcePolicyInline": "Inline Resource Policy",
     "resourcePolicyInlineDescription": "Access Policy scoped to only this resource",
     "resourcePolicyShared": "Shared Resource Policy",
-    "resourcePolicySharedDescription": "This resource uses a shared policy. Policy-level settings (auth methods, email whitelist) are locked. You can add resource-specific rules, roles, and users below.",
+    "resourcePolicySharedDescription": "This resource uses a shared policy.",
+    "sharedPolicy": "Shared Policy",
+    "sharedPolicyNoneDescription": "This resource has its own policy.",
+    "resourceSharedPolicyOwnDescription": "This resource has its own authentication and access rules controls.",
+    "resourceSharedPolicyInheritedDescription": "This resource inherits from <policyLink>{policyName}</policyLink>.",
+    "resourceSharedPolicyAuthenticationNotice": "This resource is using a shared policy. Some authentication settings can be edited on this resource to add to the policy. To change the underlying policy, you must edit to <policyLink>{policyName}</policyLink>.",
+    "resourceSharedPolicyRulesNotice": "This resource is using a shared policy. Some access rules can be edited on this resource. To change the underlying policy, you must edit <policyLink>{policyName}</policyLink>.",
     "resourceUsersRoles": "Access Controls",
     "resourceUsersRolesDescription": "Configure which users and roles can visit this resource",
     "resourceUsersRolesSubmit": "Save Access Controls",
@@ -944,7 +1042,14 @@
     "resourceVisibilityTitle": "Visibility",
     "resourceVisibilityTitleDescription": "Completely enable or disable resource visibility",
     "resourceGeneral": "General Settings",
-    "resourceGeneralDescription": "Configure the general settings for this resource",
+    "resourceGeneralDescription": "Configure name, address, and access policy for this resource.",
+    "resourceGeneralDetailsSubsection": "Resource Details",
+    "resourceGeneralDetailsSubsectionDescription": "Set the display name, identifier, and publicly accessible domain for this resource.",
+    "resourceGeneralDetailsSubsectionPortDescription": "Set the display name, identifier, and public port for this resource.",
+    "resourceGeneralPublicAddressSubsection": "Public Address",
+    "resourceGeneralPublicAddressSubsectionDescription": "Configure how users reach this resource.",
+    "resourceGeneralAuthenticationAccessSubsection": "Authentication & Access",
+    "resourceGeneralAuthenticationAccessSubsectionDescription": "Choose whether this resource uses its own policy or inherits from a shared policy.",
     "resourceEnable": "Enable Resource",
     "resourceTransfer": "Transfer Resource",
     "resourceTransferDescription": "Transfer this resource to a different site",
@@ -1220,11 +1325,14 @@
     "addLabels": "Add labels",
     "siteLabelsTab": "Labels",
     "siteLabelsDescription": "Manage labels associated with this site.",
-    "labelsNotFound": "Labels not found",
+    "labelsNotFound": "No labels found.",
+    "labelsEmptyCreateHint": "Start typing above to create a label.",
     "labelSearch": "Search labels",
+    "labelSearchOrCreate": "Search or create a label",
     "accessLabelFilterCount": "{count, plural, one {# label} other {# labels}}",
     "labelOverflowCount": "+{count, plural, one {# label} other {# labels}}",
     "accessLabelFilterClear": "Clear label filters",
+    "accessFilterClear": "Clear filters",
     "selectColor": "Select color",
     "createNewLabel": "Create new org label \"{label}\"",
     "inviteInvalidDescription": "The invite link is invalid.",
@@ -1301,6 +1409,7 @@
     "createOrgUser": "Create Org User",
     "actionUpdateOrg": "Update Organization",
     "actionRemoveInvitation": "Remove Invitation",
+    "actionRemoveUserRole": "Remove User Role",
     "actionUpdateUser": "Update User",
     "actionGetUser": "Get User",
     "actionGetOrgUser": "Get Organization User",
@@ -1318,10 +1427,13 @@
     "actionApplyBlueprint": "Apply Blueprint",
     "actionListBlueprints": "List Blueprints",
     "actionGetBlueprint": "Get Blueprint",
+    "actionCreateOrgWideLauncherView": "Create Org-Wide Launcher View",
     "setupToken": "Setup Token",
     "setupTokenDescription": "Enter the setup token from the server console.",
     "setupTokenRequired": "Setup token is required",
     "actionUpdateSite": "Update Site",
+    "actionApproveSite": "Approve Site",
+    "actionRejectSite": "Reject Site",
     "actionResetSiteBandwidth": "Reset Organization Bandwidth",
     "actionListSiteRoles": "List Allowed Site Roles",
     "actionCreateResource": "Create Resource",
@@ -1337,6 +1449,15 @@
     "actionSetResourcePincode": "Set Resource Pincode",
     "actionSetResourceEmailWhitelist": "Set Resource Email Whitelist",
     "actionGetResourceEmailWhitelist": "Get Resource Email Whitelist",
+    "actionGetResourcePolicy": "Get Resource Policy",
+    "actionUpdateResourcePolicy": "Update Resource Policy",
+    "actionSetResourcePolicyUsers": "Set Resource Policy Users",
+    "actionSetResourcePolicyRoles": "Set Resource Policy Roles",
+    "actionSetResourcePolicyPassword": "Set Resource Policy Password",
+    "actionSetResourcePolicyPincode": "Set Resource Policy Pincode",
+    "actionSetResourcePolicyHeaderAuth": "Set Resource Policy Header Authentication",
+    "actionSetResourcePolicyWhitelist": "Set Resource Policy Email Whitelist",
+    "actionSetResourcePolicyRules": "Set Resource Policy Rules",
     "actionCreateTarget": "Create Target",
     "actionDeleteTarget": "Delete Target",
     "actionGetTarget": "Get Target",
@@ -1356,6 +1477,7 @@
     "actionGenerateAccessToken": "Generate Access Token",
     "actionDeleteAccessToken": "Delete Access Token",
     "actionListAccessTokens": "List Access Tokens",
+    "actionCreateResourceSessionToken": "Create Resource Session Token",
     "actionCreateResourceRule": "Create Resource Rule",
     "actionDeleteResourceRule": "Delete Resource Rule",
     "actionListResourceRules": "List Resource Rules",
@@ -1395,6 +1517,10 @@
     "actionListInvitations": "List Invitations",
     "actionExportLogs": "Export Logs",
     "actionViewLogs": "View Logs",
+    "actionCreateSiteProvisioningKey": "Create Site Provisioning Key",
+    "actionListSiteProvisioningKeys": "List Site Provisioning Keys",
+    "actionUpdateSiteProvisioningKey": "Update Site Provisioning Key",
+    "actionDeleteSiteProvisioningKey": "Delete Site Provisioning Key",
     "noneSelected": "None selected",
     "orgNotFound2": "No organizations found.",
     "search": "Search…",
@@ -1409,10 +1535,35 @@
     "otpAuthDescription": "Enter the code from your authenticator app or one of your single-use backup codes.",
     "otpAuthSubmit": "Submit Code",
     "idpContinue": "Or continue with",
+    "idpLastUsed": "Last Used",
     "otpAuthBack": "Back to Password",
     "navbar": "Navigation Menu",
     "navbarDescription": "Main navigation menu for the application",
     "navbarDocsLink": "Documentation",
+    "commandPaletteTitle": "Command Palette",
+    "commandPaletteDescription": "Search for pages, organizations, resources, and actions",
+    "commandPaletteSearchPlaceholder": "Search pages, resources, actions...",
+    "commandPaletteNoResults": "No results found.",
+    "commandPaletteSearching": "Searching...",
+    "commandPaletteNavigation": "Navigation",
+    "commandPaletteOrganizations": "Organizations",
+    "commandPaletteSites": "Sites",
+    "commandPaletteResources": "Resources",
+    "commandPaletteUsers": "Users",
+    "commandPaletteClients": "Machine Clients",
+    "commandPaletteActions": "Actions",
+    "commandPaletteCreateSite": "Create Site",
+    "commandPaletteCreateProxyResource": "Create Public Resource",
+    "commandPaletteCreatePrivateResource": "Create Private Resource",
+    "commandPaletteCreateUser": "Create User",
+    "commandPaletteCreateApiKey": "Create API Key",
+    "commandPaletteCreateMachineClient": "Create Machine Client",
+    "commandPaletteCreateAlertRule": "Create Alert Rule",
+    "commandPaletteCreateIdentityProvider": "Create Identity Provider",
+    "commandPaletteToggleTheme": "Toggle Theme",
+    "commandPaletteChooseOrganization": "Choose Organization",
+    "commandPaletteShortcutMac": "⌘K",
+    "commandPaletteShortcutWindows": "Ctrl K",
     "otpErrorEnable": "Unable to enable 2FA",
     "otpErrorEnableDescription": "An error occurred while enabling 2FA",
     "otpSetupCheckCode": "Please enter a 6-digit code",
@@ -1461,8 +1612,8 @@
     "sidebarResources": "Resources",
     "sidebarProxyResources": "Public",
     "sidebarClientResources": "Private",
-    "sidebarPolicies": "Policies",
-    "sidebarResourcePolicies": "Resources",
+    "sidebarPolicies": "Shared Policies",
+    "sidebarResourcePolicies": "Public Resources",
     "sidebarAccessControl": "Access Control",
     "sidebarLogsAndAnalytics": "Logs & Analytics",
     "sidebarTeam": "Team",
@@ -1470,7 +1621,7 @@
     "sidebarAdmin": "Admin",
     "sidebarInvitations": "Invitations",
     "sidebarRoles": "Roles",
-    "sidebarShareableLinks": "Links",
+    "sidebarShareableLinks": "Shareable Links",
     "sidebarApiKeys": "API Keys",
     "sidebarProvisioning": "Provisioning",
     "sidebarSettings": "Settings",
@@ -1490,6 +1641,45 @@
     "sidebarManagement": "Management",
     "sidebarBillingAndLicenses": "Billing & Licenses",
     "sidebarLogsAnalytics": "Analytics",
+    "commandSites": "Sites",
+    "commandActionModeInfo": "Type \">\" To Open Action Mode",
+    "commandResources": "Resources",
+    "commandProxyResources": "Public Resources",
+    "commandClientResources": "Private Resources",
+    "commandClients": "Clients",
+    "commandUserDevices": "User Devices",
+    "commandMachineClients": "Machine Clients",
+    "commandDomains": "Domains",
+    "commandRemoteExitNodes": "Remote Nodes",
+    "commandTeam": "Team",
+    "commandUsers": "Users",
+    "commandRoles": "Roles",
+    "commandInvitations": "Invitations",
+    "commandPolicies": "Shared Policies",
+    "commandResourcePolicies": "Public Resources Policies",
+    "commandIdentityProviders": "Identity Providers",
+    "commandApprovals": "Approval Requests",
+    "commandShareableLinks": "Shareable Links",
+    "commandOrganization": "Organization",
+    "commandLogsAndAnalytics": "Logs & Analytics",
+    "commandLogsAnalytics": "Analytics",
+    "commandLogsRequest": "HTTP Request Logs",
+    "commandLogsAccess": "Authentication Logs",
+    "commandLogsAction": "Admin Action Logs",
+    "commandLogsConnection": "Network Logs",
+    "commandLogsStreaming": "Event Streaming",
+    "commandManagement": "Management",
+    "commandAlerting": "Alerting",
+    "commandProvisioning": "Provisioning",
+    "commandBluePrints": "Blueprints",
+    "commandApiKeys": "API Keys",
+    "commandBillingAndLicenses": "Billing & Licenses",
+    "commandBilling": "Billing",
+    "commandEnterpriseLicenses": "Licenses",
+    "commandSettings": "Settings",
+    "commandLauncher": "Launcher",
+    "commandResourceLauncher": "Resource Launcher",
+    "commandSearchResults": "Search Results",
     "alertingTitle": "Alerting",
     "alertingDescription": "Define sources, triggers, and actions for notifications",
     "alertingRules": "Alert rules",
@@ -1561,7 +1751,7 @@
     "alertingActionType": "Action type",
     "alertingNotifyUsers": "Users",
     "alertingNotifyRoles": "Roles",
-    "alertingNotifyEmails": "Email addresses",
+    "alertingNotifyEmails": "Email Addresses",
     "alertingEmailPlaceholder": "Add email and press Enter",
     "alertingWebhookMethod": "HTTP method",
     "alertingWebhookSecret": "Signing secret (optional)",
@@ -1647,7 +1837,7 @@
     "standaloneHcFilterResourceIdFallback": "Resource {id}",
     "blueprints": "Blueprints",
     "blueprintsLog": "Blueprints Log",
-    "blueprintsDescription": "View past blueprint applications and their results",
+    "blueprintsDescription": "View past blueprint applications and their results or apply a new blueprint",
     "blueprintAdd": "Add Blueprint",
     "blueprintGoBack": "See all Blueprints",
     "blueprintCreate": "Create Blueprint",
@@ -1667,10 +1857,10 @@
     "enableDockerSocket": "Enable Docker Blueprint",
     "enableDockerSocketDescription": "Enable Docker Socket label scraping for blueprint labels. Socket path must be provided to the site connector. Read about how this works in <docsLink>the documentation</docsLink>.",
     "newtAutoUpdate": "Enable Site Auto-Update",
-    "newtAutoUpdateDescription": "When enabled, site connectors will automatically update to the latest version when a new release is available.",
+    "newtAutoUpdateDescription": "When enabled, site connectors will automatically download the latest version and restart themselves. This can be overridden on a per-site basis.",
     "siteAutoUpdate": "Site Auto-Update",
     "siteAutoUpdateLabel": "Enable Auto-Update",
-    "siteAutoUpdateDescription": "Control whether this site's connector automatically downloads the latest version.",
+    "siteAutoUpdateDescription": "When enabled, this site's connector will automatically download the latest version and restart itself.",
     "siteAutoUpdateOrgDefault": "Organization default: {state}",
     "siteAutoUpdateOverriding": "Overriding organization setting",
     "siteAutoUpdateResetToOrg": "Reset to Organization Default",
@@ -1768,9 +1958,9 @@
     "accountSetupSuccess": "Account setup completed! Welcome to Pangolin!",
     "documentation": "Documentation",
     "saveAllSettings": "Save All Settings",
-    "saveResourceTargets": "Save Targets",
-    "saveResourceHttp": "Save Proxy Settings",
-    "saveProxyProtocol": "Save Proxy protocol settings",
+    "saveResourceTargets": "Save Settings",
+    "saveResourceHttp": "Save Settings",
+    "saveProxyProtocol": "Save Settings",
     "settingsUpdated": "Settings updated",
     "settingsUpdatedDescription": "Settings updated successfully",
     "settingsErrorUpdate": "Failed to update settings",
@@ -1821,6 +2011,9 @@
     "billingDomains": "Domains",
     "billingOrganizations": "Orgs",
     "billingRemoteExitNodes": "Remote Nodes",
+    "billingPublicResources": "Public Resources",
+    "billingPrivateResources": "Private Resources",
+    "billingMachineClients": "Machine Clients",
     "billingNoLimitConfigured": "No limit configured",
     "billingEstimatedPeriod": "Estimated Billing Period",
     "billingIncludedUsage": "Included Usage",
@@ -1849,6 +2042,9 @@
     "billingUsersInfo": "How many users you can use",
     "billingDomainInfo": "How many domains you can use",
     "billingRemoteExitNodesInfo": "How many remote nodes you can use",
+    "billingPublicResourcesInfo": "How many public resources you can use",
+    "billingPrivateResourcesInfo": "How many private resources you can use",
+    "billingMachineClientsInfo": "How many machine clients you can use",
     "billingLicenseKeys": "License Keys",
     "billingLicenseKeysDescription": "Manage your license key subscriptions",
     "billingLicenseSubscription": "License Subscription",
@@ -1994,6 +2190,7 @@
     "subnetPlaceholder": "Subnet",
     "addressDescription": "The internal address of the client. Must fall within the organization's subnet.",
     "selectSites": "Select sites",
+    "selectLabels": "Select labels",
     "sitesDescription": "The client will have connectivity to the selected sites",
     "clientInstallOlm": "Install Machine Client",
     "clientInstallOlmDescription": "Install the machine client for your system",
@@ -2027,13 +2224,13 @@
     "healthCheckUnknown": "Unknown",
     "healthCheck": "Health Check",
     "configureHealthCheck": "Configure Health Check",
-    "configureHealthCheckDescription": "Set up health monitoring for {target}",
+    "configureHealthCheckDescription": "Set up monitoring for your resource to ensure it is always available",
     "enableHealthChecks": "Enable Health Checks",
     "healthCheckDisabledStateDescription": "When disabled, the site will not perform health checks and the state will be considered unknown.",
     "enableHealthChecksDescription": "Monitor the health of this target. You can monitor a different endpoint than the target if required.",
     "healthScheme": "Method",
     "healthSelectScheme": "Select Method",
-    "healthCheckPortInvalid": "Health check port must be between 1 and 65535",
+    "healthCheckPortInvalid": "Port must be between 1 and 65535",
     "healthCheckPath": "Path",
     "healthHostname": "IP / Host",
     "healthPort": "Port",
@@ -2046,6 +2243,7 @@
     "requireDeviceApproval": "Require Device Approvals",
     "requireDeviceApprovalDescription": "Users with this role need new devices approved by an admin before they can connect and access resources.",
     "sshSettings": "SSH Settings",
+    "sshAccess": "SSH Access",
     "rdpSettings": "RDP Settings",
     "vncSettings": "VNC Settings",
     "sshServer": "SSH Server",
@@ -2072,8 +2270,13 @@
     "sshDaemonDisclaimer": "Ensure your target host is properly configured to run the auth daemon before completing this setup, or provisioning will fail.",
     "sshDaemonPort": "Daemon Port",
     "sshServerDestination": "Server Destination",
-    "sshServerDestinationDescription": "Configure the destination and port of the SSH server",
+    "sshServerDestinationDescription": "Configure the destination of the SSH server",
     "destination": "Destination",
+    "destinationRequired": "Destination is required.",
+    "domainRequired": "Domain is required.",
+    "proxyPortRequired": "Port is required.",
+    "invalidPathConfiguration": "Invalid path configuration.",
+    "invalidRewritePathConfiguration": "Invalid rewrite path configuration.",
     "bgTargetMultiSiteDisclaimer": "Selecting multiple sites enables resilient routing and failover for high availability.",
     "roleAllowSsh": "Allow SSH",
     "roleAllowSshAllow": "Allow",
@@ -2088,10 +2291,25 @@
     "sshSudoModeCommandsDescription": "User can run only the specified commands with sudo.",
     "sshSudo": "Allow sudo",
     "sshSudoCommands": "Sudo Commands",
-    "sshSudoCommandsDescription": "Comma separated list of commands the user is allowed to run with sudo. Absolute paths must be used.",
+    "sshSudoCommandsDescription": "List of commands the user is allowed to run with sudo, one per line. Absolute paths must be used.",
     "sshCreateHomeDir": "Create Home Directory",
     "sshUnixGroups": "Unix Groups",
-    "sshUnixGroupsDescription": "Comma separated Unix groups to add the user to on the target host.",
+    "sshUnixGroupsDescription": "Unix groups to add the user to on the target host, one per line.",
+    "roleTextFieldPlaceholder": "Enter values, or drop a .txt or .csv file",
+    "roleTextImportTitle": "Import from File",
+    "roleTextImportDescription": "Importing {fileName} into {fieldLabel}.",
+    "roleTextImportSkipHeader": "Skip First Row (Header)",
+    "roleTextImportOverride": "Replace Existing",
+    "roleTextImportAppend": "Append to Existing",
+    "roleTextImportMode": "Import Mode",
+    "roleTextImportPreview": "Preview",
+    "roleTextImportItemCount": "{count, plural, =0 {No items to import} one {1 item to import} other {# items to import}}",
+    "roleTextImportTotalCount": "{existing} existing + {imported} imported = {total} total",
+    "roleTextImportConfirm": "Import",
+    "roleTextImportInvalidFile": "Unsupported file type",
+    "roleTextImportInvalidFileDescription": "Only .txt and .csv files are supported.",
+    "roleTextImportEmpty": "No items found in file",
+    "roleTextImportEmptyDescription": "The file does not contain any importable items.",
     "retryAttempts": "Retry Attempts",
     "expectedResponseCodes": "Expected Response Codes",
     "expectedResponseCodesDescription": "HTTP status code that indicates healthy status. If left blank, 200-300 is considered healthy.",
@@ -2195,11 +2413,19 @@
     "createInternalResourceDialogClose": "Close",
     "createInternalResourceDialogCreateClientResource": "Create Private Resource",
     "createInternalResourceDialogCreateClientResourceDescription": "Create a new resource that will only be accessible to clients connected to the organization",
+    "privateResourceGeneralDescription": "Configure the name, identifier, and other general resource settings.",
+    "privateResourceCreatePageSeeAll": "See All Private Resources",
+    "privateResourceAllowIcmpPing": "Allow ICMP Ping",
+    "privateResourceNetworkAccess": "Network Access",
+    "privateResourceNetworkAccessDescription": "Control TCP/UDP port access and whether ICMP ping is allowed for this resource.",
+    "hostSettings": "Host Settings",
+    "cidrSettings": "CIDR Settings",
     "createInternalResourceDialogResourceProperties": "Resource Properties",
     "createInternalResourceDialogName": "Name",
     "createInternalResourceDialogSite": "Site",
     "selectSite": "Select site...",
     "multiSitesSelectorSitesCount": "{count, plural, one {# site} other {# sites}}",
+    "labelsSelectorLabelsCount": "{count, plural, one {# label} other {# labels}}",
     "noSitesFound": "No sites found.",
     "createInternalResourceDialogProtocol": "Protocol",
     "createInternalResourceDialogTcp": "TCP",
@@ -2240,6 +2466,7 @@
     "createInternalResourceDialogDestinationCidrDescription": "The CIDR range of the resource on the site's network.",
     "createInternalResourceDialogAlias": "Alias",
     "createInternalResourceDialogAliasDescription": "An optional internal DNS alias for this resource.",
+    "internalResourceAliasLocalWarning": "Aliases ending in .local can cause resolution issues due to mDNS on some networks.",
     "internalResourceDownstreamSchemeRequired": "Scheme is required for HTTP resources",
     "internalResourceHttpPortRequired": "Destination port is required for HTTP resources",
     "siteConfiguration": "Configuration",
@@ -2273,6 +2500,21 @@
     "sidebarRemoteExitNodes": "Remote Nodes",
     "remoteExitNodeId": "ID",
     "remoteExitNodeSecretKey": "Secret",
+    "remoteExitNodeNetworkingTitle": "Network Settings",
+    "remoteExitNodeNetworkingDescription": "Configure how this remote exit node routes traffic and which sites prefer to connect through it. Advanced features to be used with backhaul networking configurations.",
+    "remoteExitNodeNetworkingSave": "Save Settings",
+    "remoteExitNodeNetworkingSaveSuccessTitle": "Network settings saved",
+    "remoteExitNodeNetworkingSaveSuccessDescription": "Network settings have been updated successfully.",
+    "remoteExitNodeNetworkingSaveError": "Failed to save network settings",
+    "remoteExitNodeNetworkingSubnetsTitle": "Remote Subnets",
+    "remoteExitNodeNetworkingSubnetsDescription": "Define the CIDR ranges that this remote exit node will route traffic to. Type a valid CIDR (e.g. <code>10.0.0.0/8</code>) and press Enter to add.",
+    "remoteExitNodeNetworkingSubnetsPlaceholder": "Add a CIDR range (e.g. 10.0.0.0/8)",
+    "remoteExitNodeNetworkingSubnetsLoadError": "Failed to load subnets",
+    "remoteExitNodeNetworkingLabelsTitle": "Preference Labels",
+    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will be enforced to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsButtonText": "Select labels...",
+    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Search labels...",
+    "remoteExitNodeNetworkingLabelsLoadError": "Failed to load labels",
     "remoteExitNodeCreate": {
         "title": "Create Remote Node",
         "description": "Create a new self-hosted remote relay and proxy server node",
@@ -2326,6 +2568,7 @@
     "noRemoteExitNodesAvailableDescription": "No nodes are available for this organization. Create a node first to use local sites.",
     "exitNode": "Exit Node",
     "country": "Country",
+    "countryIsNot": "Country Is Not",
     "rulesMatchCountry": "Currently based on source IP",
     "region": "Region",
     "selectRegion": "Select region",
@@ -2451,6 +2694,7 @@
     "idpGoogleDescription": "Google OAuth2/OIDC provider",
     "idpAzureDescription": "Microsoft Azure OAuth2/OIDC provider",
     "subnet": "Subnet",
+    "utilitySubnet": "Utility Subnet",
     "subnetDescription": "The subnet for this organization's network configuration.",
     "customDomain": "Custom Domain",
     "authPage": "Authentication Pages",
@@ -2534,6 +2778,9 @@
     "twoFactorSetupRequired": "Two-factor authentication setup is required. Please log in again via {dashboardUrl}/auth/login complete this step. Then, come back here.",
     "additionalSecurityRequired": "Additional Security Required",
     "organizationRequiresAdditionalSteps": "This organization requires additional security steps before you can access resources.",
+    "sessionExpired": "Session Expired",
+    "sessionExpiredReauthRequired": "Your session has expired per your organization's security policy. Please re-authenticate to continue.",
+    "reauthenticate": "Re-authenticate",
     "completeTheseSteps": "Complete these steps",
     "enableTwoFactorAuthentication": "Enable two-factor authentication",
     "completeSecuritySteps": "Complete Security Steps",
@@ -2848,8 +3095,8 @@
     "sourceAddress": "Source Address",
     "destinationAddress": "Destination Address",
     "duration": "Duration",
-    "licenseRequiredToUse": "An <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> license or <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink> is required to use this feature. <bookADemoLink>Book a free demo or POC trial to learn more</bookADemoLink>.",
-    "ossEnterpriseEditionRequired": "The <enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> is required to use this feature. This feature is also available in <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>. <bookADemoLink>Book a free demo or POC trial to learn more</bookADemoLink>.",
+    "licenseRequiredToUse": "An <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> license or <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink> is required to use this feature. <bookADemoLink>Book a free demo or POC trial to learn more.</bookADemoLink>",
+    "ossEnterpriseEditionRequired": "The <enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> is required to use this feature. This feature is also available in <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>. <bookADemoLink>Book a free demo or POC trial to learn more.</bookADemoLink>",
     "certResolver": "Certificate Resolver",
     "certResolverDescription": "Select the certificate resolver to use for this resource.",
     "selectCertResolver": "Select Certificate Resolver",
@@ -2869,15 +3116,17 @@
     "orgOrDomainIdMissing": "Organization or Domain ID is missing",
     "loadingDNSRecords": "Loading DNS records...",
     "olmUpdateAvailableInfo": "An updated version of Olm is available. Please update to the latest version for the best experience.",
+    "updateAvailableInfo": "An updated version is available. Please update to the latest version for the best experience.",
     "client": "Client",
     "proxyProtocol": "Proxy Protocol Settings",
     "proxyProtocolDescription": "Configure Proxy Protocol to preserve client IP addresses for TCP services.",
     "enableProxyProtocol": "Enable Proxy Protocol",
     "proxyProtocolInfo": "Preserve client IP addresses for TCP backends",
     "proxyProtocolVersion": "Proxy Protocol Version",
-    "version1": " Version 1 (Recommended)",
+    "version1": "Version 1 (Recommended)",
     "version2": "Version 2",
-    "versionDescription": "Version 1 is text-based and widely supported. Version 2 is binary and more efficient but less compatible. Make sure servers transport is added to dynamic config.",
+    "version1Description": "Text-based and widely supported. Make sure servers transport is added to dynamic config.",
+    "version2Description": "Binary and more efficient but less compatible. Make sure servers transport is added to dynamic config.",
     "warning": "Warning",
     "proxyProtocolWarning": "The backend application must be configured to accept Proxy Protocol connections. If your backend doesn't support Proxy Protocol, enabling this will break all connections so only enable this if you know what you're doing. Make sure to configure your backend to trust Proxy Protocol headers from Traefik.",
     "restarting": "Restarting...",
@@ -3034,14 +3283,14 @@
     "enterConfirmation": "Enter confirmation",
     "blueprintViewDetails": "Details",
     "defaultIdentityProvider": "Default Identity Provider",
-    "defaultIdentityProviderDescription": "When a default identity provider is selected, the user will be automatically redirected to the provider for authentication.",
+    "defaultIdentityProviderDescription": "The user will be automatically redirected to this identity provider for authentication.",
     "editInternalResourceDialogNetworkSettings": "Network Settings",
     "editInternalResourceDialogAccessPolicy": "Access Policy",
     "editInternalResourceDialogAddRoles": "Add Roles",
     "editInternalResourceDialogAddUsers": "Add Users",
     "editInternalResourceDialogAddClients": "Add Clients",
     "editInternalResourceDialogDestinationLabel": "Destination",
-    "editInternalResourceDialogDestinationDescription": "Choose where this resource runs and how clients reach it. Selecting multiple sites will create a high availability resource that can be accessed from any of the selected sites.",
+    "editInternalResourceDialogDestinationDescription": "Configure how clients reach this resource.",
     "internalResourceFormMultiSiteRoutingHelp": "Selecting multiple sites enables resilient routing and failover for high availability.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Learn more",
     "editInternalResourceDialogPortRestrictionsDescription": "Restrict access to specific TCP/UDP ports or allow/block all ports.",
@@ -3075,6 +3324,7 @@
     "maintenanceModeType": "Maintenance Mode Type",
     "showMaintenancePage": "Show a maintenance page to visitors",
     "enableMaintenanceMode": "Enable Maintenance Mode",
+    "enableMaintenanceModeDescription": "When enabled, visitors will see a maintenance page instead of your resource.",
     "automatic": "Automatic",
     "automaticModeDescription": " Show maintenance page only when all backend targets are down or unhealthy. Your resource continues working normally as long as at least one target is healthy.",
     "forced": "Forced",
@@ -3082,6 +3332,8 @@
     "warning:": "Warning:",
     "forcedeModeWarning": "All traffic will be directed to the maintenance page. Your backend resources will not receive any requests.",
     "pageTitle": "Page Title",
+    "maintenancePageContentSubsection": "Page Content",
+    "maintenancePageContentSubsectionDescription": "Customize the content displayed on the maintenance page",
     "pageTitleDescription": "The main heading displayed on the maintenance page",
     "maintenancePageMessage": "Maintenance Message",
     "maintenancePageMessagePlaceholder": "We'll be back soon! Our site is currently undergoing scheduled maintenance.",
@@ -3431,6 +3683,80 @@
     "memberPortalEmailWhitelist": "Email Whitelist",
     "memberPortalResourceDisabled": "Resource Disabled",
     "memberPortalShowingResources": "Showing {start}-{end} of {total} resources",
+    "resourceLauncherTitle": "Resource Launcher",
+    "resourceSidebarLauncherTitle": "Launcher",
+    "resourceLauncherDescription": "View all available resources and launch them from one central hub",
+    "resourceLauncherSearchPlaceholder": "Search your resources...",
+    "resourceLauncherDefaultView": "Default",
+    "resourceLauncherSaveView": "Save View",
+    "resourceLauncherSaveToCurrentView": "Save to Current View",
+    "resourceLauncherSaveDefaultPersonal": "Save for Me",
+    "resourceLauncherResetView": "Reset View",
+    "resourceLauncherResetSystemDefault": "Reset to System Default",
+    "resourceLauncherSystemDefaultRestored": "System default restored",
+    "resourceLauncherSystemDefaultRestoredDescription": "The default view has been reset to the original settings.",
+    "resourceLauncherSaveAsNewView": "Save as New View",
+    "resourceLauncherSaveAsNewViewDescription": "Give this view a name to save your current filters and layout.",
+    "resourceLauncherSaveForEveryone": "Save for Everyone",
+    "resourceLauncherSaveForEveryoneDescription": "Share this view with all organization members. When unchecked, the view is only visible to you.",
+    "resourceLauncherMakePersonal": "Make Personal",
+    "resourceLauncherFilter": "Filter",
+    "resourceLauncherFilterWithCount": "Filter, {count} applied",
+    "resourceLauncherSort": "Sort",
+    "resourceLauncherSortAscending": "Sort ascending",
+    "resourceLauncherSortDescending": "Sort descending",
+    "resourceLauncherSettings": "Settings",
+    "resourceLauncherGroupBy": "Group By",
+    "resourceLauncherGroupBySite": "Site",
+    "resourceLauncherGroupByLabel": "Label",
+    "resourceLauncherGroupByNone": "None",
+    "resourceLauncherLayout": "Layout",
+    "resourceLauncherLayoutGrid": "Grid",
+    "resourceLauncherLayoutList": "List",
+    "resourceLauncherShowLabels": "Show Labels",
+    "resourceLauncherShowSiteTags": "Show Site Tags",
+    "resourceLauncherShowRecents": "Show Recents",
+    "resourceLauncherDeleteView": "Delete View",
+    "resourceLauncherDeleteViewTitle": "Delete View",
+    "resourceLauncherDeleteViewQuestion": "Are you sure you want to delete this launcher view?",
+    "resourceLauncherDeleteViewConfirm": "Delete View",
+    "resourceLauncherViewAsAdmin": "View as Admin",
+    "resourceLauncherResourceDetailsDescription": "Connection information and status for this resource.",
+    "resourceLauncherResourceDetails": "Resource Details",
+    "resourceLauncherAuthMethodsDescription": "Authentication methods enabled for this resource.",
+    "resourceLauncherPrivateClientRequired": "Connect with a client on your device to access this resource privately.",
+    "resourceLauncherPrivateClientRequiredTitle": "Client Connection Required",
+    "resourceLauncherDownloadClient": "Download client",
+    "resourceLauncherFailedToLoadDetails": "Could not load resource details. You may no longer have access to this resource.",
+    "resourceLauncherNoPortRestrictions": "No port restrictions",
+    "resourceLauncherTcp": "TCP",
+    "resourceLauncherUdp": "UDP",
+    "resourceLauncherUnlabeled": "Unlabeled",
+    "resourceLauncherNoSite": "No Site",
+    "resourceLauncherNoResourcesInGroup": "No resources in this group",
+    "resourceLauncherEmptyStateTitle": "No Resources Available",
+    "resourceLauncherEmptyStateDescription": "You don't have access to any resources yet. Contact your administrator to request access.",
+    "resourceLauncherEmptyStateNoResultsTitle": "No Resources Found",
+    "resourceLauncherEmptyStateNoResultsDescription": "No resources match your current search or filters. Try adjusting them to find what you are looking for.",
+    "resourceLauncherEmptyStateNoResultsWithQuery": "No resources match \"{query}\". Try adjusting your search or clearing filters to see all resources.",
+    "resourceLauncherSearchFirstTitle": "Search or Filter to Browse",
+    "resourceLauncherSearchFirstDescription": "You have access to many resources. Use search or filter by site or label to find what you need.",
+    "resourceLauncherSiteGroupingDisabled": "Site grouping is unavailable at this scale. Filter by site to group a smaller set.",
+    "resourceLauncherLabelGroupingDisabled": "Label grouping is unavailable at this scale.",
+    "resourceLauncherCompactModeHint": "Showing a simplified list for faster browsing. Use search or filters to narrow results.",
+    "resourceLauncherCompactGroupingHint": "Apply site or label filters to enable grouping.",
+    "resourceLauncherCopiedToClipboard": "Copied to clipboard",
+    "resourceLauncherCopiedAccessDescription": "Resource access has been copied to your clipboard.",
+    "resourceLauncherViewNamePlaceholder": "View name",
+    "resourceLauncherViewNameLabel": "View Name",
+    "resourceLauncherViewSaved": "View saved",
+    "resourceLauncherViewSavedDescription": "Your launcher view has been saved.",
+    "resourceLauncherViewSaveFailed": "Failed to save view",
+    "resourceLauncherViewSaveFailedDescription": "Could not save the launcher view. Please try again.",
+    "resourceLauncherViewDeleted": "View deleted",
+    "resourceLauncherViewDeletedDescription": "The launcher view has been deleted.",
+    "resourceLauncherViewDeleteFailed": "Failed to delete view",
+    "resourceLauncherViewDeleteFailedDescription": "Could not delete the launcher view. Please try again.",
     "memberPortalPrevious": "Previous",
     "memberPortalNext": "Next",
     "httpSettings": "HTTP Settings",
@@ -3441,18 +3767,60 @@
     "sshConnecting": "Connecting…",
     "sshInitializing": "Initializing…",
     "sshSignInTitle": "Sign in to SSH",
-    "sshSignInDescription": "Enter your SSH credentials",
+    "sshSignInDescription": "Enter your SSH credentials to connect",
     "sshPasswordTab": "Password",
     "sshPrivateKeyTab": "Private Key",
     "sshPrivateKeyField": "Private Key",
     "sshPrivateKeyDisclaimer": "Your private key is not stored or visible to Pangolin. Alternatively, you can use short-lived certificates for seamless authentication using your existing Pangolin identity.",
     "sshLearnMore": "Learn more",
     "sshPrivateKeyFile": "Private Key File",
-    "sshAuthenticate": "Authenticate",
+    "sshAuthenticate": "Connect",
     "sshTerminate": "Terminate",
     "sshPoweredBy": "Powered by",
     "sshErrorNoTarget": "No target specified",
     "sshErrorWebSocket": "WebSocket connection failed",
     "sshErrorAuthFailed": "Authentication failed",
-    "sshErrorConnectionClosed": "Connection closed before authentication completed"
+    "sshErrorConnectionClosed": "Connection closed before authentication completed",
+    "sitePangolinSshDescription": "Allow SSH access to resources on this site. This can be changed later.",
+    "browserGatewayNoResourceForDomain": "No resource found for this domain",
+    "browserGatewayNoTarget": "No target",
+    "browserGatewayConnect": "Connect",
+    "browserGatewayCtrlAltDel": "Ctrl+Alt+Del",
+    "sshErrorSignKeyFailed": "Failed to sign SSH key for PAM push authentication. Did you sign in as a user?",
+    "sshTerminalError": "Error: {error}",
+    "sshConnectionClosedCode": "Connection closed (code {code})",
+    "sshPrivateKeyPlaceholder": "-----BEGIN OPENSSH PRIVATE KEY-----",
+    "sshPrivateKeyRequired": "Private key is required",
+    "vncTitle": "VNC",
+    "vncSignInDescription": "Enter your VNC credentials to connect",
+    "vncUsernameOptional": "Username (optional)",
+    "vncPasswordOptional": "Password (optional)",
+    "vncNoResourceTarget": "No resource target is available",
+    "vncFailedToLoadNovnc": "Failed to load noVNC",
+    "vncAuthFailedStatus": "Status {status}",
+    "vncPasteClipboard": "Paste clipboard",
+    "rdpTitle": "RDP",
+    "rdpSignInTitle": "Sign in to Remote Desktop",
+    "rdpSignInDescription": "Enter Windows credentials to connect",
+    "rdpLoadingModule": "Loading module...",
+    "rdpFailedToLoadModule": "Failed to load RDP module",
+    "rdpNotReady": "Not ready",
+    "rdpModuleInitializing": "RDP module is still initializing",
+    "rdpDownloadingFiles": "Downloading {count} file(s) from remote…",
+    "rdpDownloadFailed": "Download failed: {fileName}",
+    "rdpUploaded": "Uploaded: {fileName}",
+    "rdpNoConnectionTarget": "No connection target available",
+    "rdpConnectionFailed": "Connection failed",
+    "rdpFit": "Fit",
+    "rdpFull": "Full",
+    "rdpReal": "Real",
+    "rdpMeta": "Meta",
+    "rdpUploadFiles": "Upload files",
+    "rdpFilesReadyToPaste": "Files ready to paste",
+    "rdpFilesReadyToPasteDescription": "{count} file(s) copied to remote clipboard — press Ctrl+V on the remote desktop to paste.",
+    "rdpUploadFailed": "Upload failed",
+    "rdpUnicodeKeyboardMode": "Unicode keyboard mode",
+    "sessionToolbarShow": "Show toolbar",
+    "sessionToolbarHide": "Hide toolbar",
+    "actionUpdateSiteApprovals": "Update Site Approvals"
 }

messages/zh-TW.json

@@ -152,8 +152,8 @@
     "shareErrorSelectResource": "請選擇一個資源",
     "proxyResourceTitle": "管理公開資源",
     "proxyResourceDescription": "建立和管理可透過網頁瀏覽器公開存取的資源",
-    "proxyResourcesBannerTitle": "基於網頁的公開存取",
-    "proxyResourcesBannerDescription": "公開資源是任何人都可以透過網頁瀏覽器存取的 HTTPS 或 TCP/UDP 代理。與私有資源不同，它們不需要客戶端軟體，並且可以包含基於身份和情境感知的存取策略。",
+    "publicResourcesBannerTitle": "基於網頁的公開存取",
+    "publicResourcesBannerDescription": "公開資源是任何人都可以透過網頁瀏覽器存取的 HTTPS 或 TCP/UDP 代理。與私有資源不同，它們不需要客戶端軟體，並且可以包含基於身份和情境感知的存取策略。",
     "clientResourceTitle": "管理私有資源",
     "clientResourceDescription": "建立和管理只能透過已連接的客戶端存取的資源",
     "privateResourcesBannerTitle": "零信任私有存取",
@@ -1099,6 +1099,7 @@
     "actionGenerateAccessToken": "生成訪問令牌",
     "actionDeleteAccessToken": "刪除訪問令牌",
     "actionListAccessTokens": "訪問令牌",
+    "actionCreateResourceSessionToken": "建立資源工作階段權杖",
     "actionCreateResourceRule": "創建資源規則",
     "actionDeleteResourceRule": "刪除資源規則",
     "actionListResourceRules": "列出資源規則",

package-lock.json

@@ -12,7 +12,7 @@
                 "@asteasolutions/zod-to-openapi": "8.5.0",
                 "@aws-sdk/client-s3": "3.1056.0",
                 "@devolutions/iron-remote-desktop": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-0.0.0.tgz",
-                "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.0.tgz",
+                "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
                 "@headlessui/react": "2.2.10",
                 "@hookform/resolvers": "5.4.0",
                 "@monaco-editor/react": "4.7.0",
@@ -70,7 +70,7 @@
                 "input-otp": "1.4.2",
                 "ioredis": "5.11.0",
                 "jmespath": "0.16.0",
-                "js-yaml": "4.1.1",
+                "js-yaml": "4.2.0",
                 "jsonwebtoken": "9.0.3",
                 "lucide-react": "1.17.0",
                 "maxmind": "5.0.6",
@@ -80,7 +80,7 @@
                 "next-themes": "0.4.6",
                 "nextjs-toploader": "3.9.17",
                 "node-cache": "5.1.2",
-                "nodemailer": "8.0.9",
+                "nodemailer": "9.0.1",
                 "oslo": "1.2.1",
                 "pg": "8.21.0",
                 "posthog-node": "5.35.6",
@@ -142,7 +142,7 @@
                 "@types/yargs": "17.0.35",
                 "babel-plugin-react-compiler": "1.0.0",
                 "drizzle-kit": "0.31.10",
-                "esbuild": "0.28.0",
+                "esbuild": "0.28.1",
                 "esbuild-node-externals": "1.22.0",
                 "eslint": "10.4.0",
                 "eslint-config-next": "16.2.6",
@@ -1124,9 +1124,9 @@
             "integrity": "sha512-9o7PkCw9fdvGTPs0hgsUJG10QleGgcdsSCw1ekLpUOlVXtWCuiuPH+0bPDFhLWxqbVA+8pyVhwqdOI+t1T3TNA=="
         },
         "node_modules/@devolutions/iron-remote-desktop-rdp": {
-            "version": "0.0.0",
-            "resolved": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.0.tgz",
-            "integrity": "sha512-O0YVpOJDwUzekH3N2QKj+48WP+56wI0sj4VmaJkGoW5XgyAj2ONn2k3i+vk17Eavx+Vg6vAg3lwYRAOK4kKIDQ=="
+            "version": "0.0.1",
+            "resolved": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
+            "integrity": "sha512-sIHllJ6rJfAgClsUFjJfVGFjIxm6ZQRyGfinwCzHYgwnHAMFE+Kvm0YzR9tg811Fhjm5F6gNUSLAll+7Eh0Deg=="
         },
         "node_modules/@dotenvx/dotenvx": {
             "version": "1.69.1",
@@ -1248,9 +1248,9 @@
             }
         },
         "node_modules/@esbuild/aix-ppc64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.0.tgz",
-            "integrity": "sha512-lhRUCeuOyJQURhTxl4WkpFTjIsbDayJHih5kZC1giwE+MhIzAb7mEsQMqMf18rHLsrb5qI1tafG20mLxEWcWlA==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz",
+            "integrity": "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==",
             "cpu": [
                 "ppc64"
             ],
@@ -1265,9 +1265,9 @@
             }
         },
         "node_modules/@esbuild/android-arm": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.0.tgz",
-            "integrity": "sha512-wqh0ByljabXLKHeWXYLqoJ5jKC4XBaw6Hk08OfMrCRd2nP2ZQ5eleDZC41XHyCNgktBGYMbqnrJKq/K/lzPMSQ==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.1.tgz",
+            "integrity": "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==",
             "cpu": [
                 "arm"
             ],
@@ -1282,9 +1282,9 @@
             }
         },
         "node_modules/@esbuild/android-arm64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.0.tgz",
-            "integrity": "sha512-+WzIXQOSaGs33tLEgYPYe/yQHf0WTU0X42Jca3y8NWMbUVhp7rUnw+vAsRC/QiDrdD31IszMrZy+qwPOPjd+rw==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.1.tgz",
+            "integrity": "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==",
             "cpu": [
                 "arm64"
             ],
@@ -1299,9 +1299,9 @@
             }
         },
         "node_modules/@esbuild/android-x64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.0.tgz",
-            "integrity": "sha512-+VJggoaKhk2VNNqVL7f6S189UzShHC/mR9EE8rDdSkdpN0KflSwWY/gWjDrNxxisg8Fp1ZCD9jLMo4m0OUfeUA==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.1.tgz",
+            "integrity": "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==",
             "cpu": [
                 "x64"
             ],
@@ -1316,9 +1316,9 @@
             }
         },
         "node_modules/@esbuild/darwin-arm64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.0.tgz",
-            "integrity": "sha512-0T+A9WZm+bZ84nZBtk1ckYsOvyA3x7e2Acj1KdVfV4/2tdG4fzUp91YHx+GArWLtwqp77pBXVCPn2We7Letr0Q==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.1.tgz",
+            "integrity": "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==",
             "cpu": [
                 "arm64"
             ],
@@ -1333,9 +1333,9 @@
             }
         },
         "node_modules/@esbuild/darwin-x64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.0.tgz",
-            "integrity": "sha512-fyzLm/DLDl/84OCfp2f/XQ4flmORsjU7VKt8HLjvIXChJoFFOIL6pLJPH4Yhd1n1gGFF9mPwtlN5Wf82DZs+LQ==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.1.tgz",
+            "integrity": "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==",
             "cpu": [
                 "x64"
             ],
@@ -1350,9 +1350,9 @@
             }
         },
         "node_modules/@esbuild/freebsd-arm64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.0.tgz",
-            "integrity": "sha512-l9GeW5UZBT9k9brBYI+0WDffcRxgHQD8ShN2Ur4xWq/NFzUKm3k5lsH4PdaRgb2w7mI9u61nr2gI2mLI27Nh3Q==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.1.tgz",
+            "integrity": "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==",
             "cpu": [
                 "arm64"
             ],
@@ -1367,9 +1367,9 @@
             }
         },
         "node_modules/@esbuild/freebsd-x64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.0.tgz",
-            "integrity": "sha512-BXoQai/A0wPO6Es3yFJ7APCiKGc1tdAEOgeTNy3SsB491S3aHn4S4r3e976eUnPdU+NbdtmBuLncYir2tMU9Nw==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.1.tgz",
+            "integrity": "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==",
             "cpu": [
                 "x64"
             ],
@@ -1384,9 +1384,9 @@
             }
         },
         "node_modules/@esbuild/linux-arm": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.0.tgz",
-            "integrity": "sha512-CjaaREJagqJp7iTaNQjjidaNbCKYcd4IDkzbwwxtSvjI7NZm79qiHc8HqciMddQ6CKvJT6aBd8lO9kN/ZudLlw==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.1.tgz",
+            "integrity": "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==",
             "cpu": [
                 "arm"
             ],
@@ -1401,9 +1401,9 @@
             }
         },
         "node_modules/@esbuild/linux-arm64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.0.tgz",
-            "integrity": "sha512-RVyzfb3FWsGA55n6WY0MEIEPURL1FcbhFE6BffZEMEekfCzCIMtB5yyDcFnVbTnwk+CLAgTujmV/Lgvih56W+A==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.1.tgz",
+            "integrity": "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==",
             "cpu": [
                 "arm64"
             ],
@@ -1418,9 +1418,9 @@
             }
         },
         "node_modules/@esbuild/linux-ia32": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.0.tgz",
-            "integrity": "sha512-KBnSTt1kxl9x70q+ydterVdl+Cn0H18ngRMRCEQfrbqdUuntQQ0LoMZv47uB97NljZFzY6HcfqEZ2SAyIUTQBQ==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.1.tgz",
+            "integrity": "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==",
             "cpu": [
                 "ia32"
             ],
@@ -1435,9 +1435,9 @@
             }
         },
         "node_modules/@esbuild/linux-loong64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.0.tgz",
-            "integrity": "sha512-zpSlUce1mnxzgBADvxKXX5sl8aYQHo2ezvMNI8I0lbblJtp8V4odlm3Yzlj7gPyt3T8ReksE6bK+pT3WD+aJRg==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.1.tgz",
+            "integrity": "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==",
             "cpu": [
                 "loong64"
             ],
@@ -1452,9 +1452,9 @@
             }
         },
         "node_modules/@esbuild/linux-mips64el": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.0.tgz",
-            "integrity": "sha512-2jIfP6mmjkdmeTlsX/9vmdmhBmKADrWqN7zcdtHIeNSCH1SqIoNI63cYsjQR8J+wGa4Y5izRcSHSm8K3QWmk3w==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.1.tgz",
+            "integrity": "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==",
             "cpu": [
                 "mips64el"
             ],
@@ -1469,9 +1469,9 @@
             }
         },
         "node_modules/@esbuild/linux-ppc64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.0.tgz",
-            "integrity": "sha512-bc0FE9wWeC0WBm49IQMPSPILRocGTQt3j5KPCA8os6VprfuJ7KD+5PzESSrJ6GmPIPJK965ZJHTUlSA6GNYEhg==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.1.tgz",
+            "integrity": "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==",
             "cpu": [
                 "ppc64"
             ],
@@ -1486,9 +1486,9 @@
             }
         },
         "node_modules/@esbuild/linux-riscv64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.0.tgz",
-            "integrity": "sha512-SQPZOwoTTT/HXFXQJG/vBX8sOFagGqvZyXcgLA3NhIqcBv1BJU1d46c0rGcrij2B56Z2rNiSLaZOYW5cUk7yLQ==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.1.tgz",
+            "integrity": "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==",
             "cpu": [
                 "riscv64"
             ],
@@ -1503,9 +1503,9 @@
             }
         },
         "node_modules/@esbuild/linux-s390x": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.0.tgz",
-            "integrity": "sha512-SCfR0HN8CEEjnYnySJTd2cw0k9OHB/YFzt5zgJEwa+wL/T/raGWYMBqwDNAC6dqFKmJYZoQBRfHjgwLHGSrn3Q==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.1.tgz",
+            "integrity": "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==",
             "cpu": [
                 "s390x"
             ],
@@ -1520,9 +1520,9 @@
             }
         },
         "node_modules/@esbuild/linux-x64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.0.tgz",
-            "integrity": "sha512-us0dSb9iFxIi8srnpl931Nvs65it/Jd2a2K3qs7fz2WfGPHqzfzZTfec7oxZJRNPXPnNYZtanmRc4AL/JwVzHQ==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.1.tgz",
+            "integrity": "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==",
             "cpu": [
                 "x64"
             ],
@@ -1537,9 +1537,9 @@
             }
         },
         "node_modules/@esbuild/netbsd-arm64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.0.tgz",
-            "integrity": "sha512-CR/RYotgtCKwtftMwJlUU7xCVNg3lMYZ0RzTmAHSfLCXw3NtZtNpswLEj/Kkf6kEL3Gw+BpOekRX0BYCtklhUw==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.1.tgz",
+            "integrity": "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==",
             "cpu": [
                 "arm64"
             ],
@@ -1554,9 +1554,9 @@
             }
         },
         "node_modules/@esbuild/netbsd-x64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.0.tgz",
-            "integrity": "sha512-nU1yhmYutL+fQ71Kxnhg8uEOdC0pwEW9entHykTgEbna2pw2dkbFSMeqjjyHZoCmt8SBkOSvV+yNmm94aUrrqw==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.1.tgz",
+            "integrity": "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==",
             "cpu": [
                 "x64"
             ],
@@ -1571,9 +1571,9 @@
             }
         },
         "node_modules/@esbuild/openbsd-arm64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.0.tgz",
-            "integrity": "sha512-cXb5vApOsRsxsEl4mcZ1XY3D4DzcoMxR/nnc4IyqYs0rTI8ZKmW6kyyg+11Z8yvgMfAEldKzP7AdP64HnSC/6g==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.1.tgz",
+            "integrity": "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==",
             "cpu": [
                 "arm64"
             ],
@@ -1588,9 +1588,9 @@
             }
         },
         "node_modules/@esbuild/openbsd-x64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.0.tgz",
-            "integrity": "sha512-8wZM2qqtv9UP3mzy7HiGYNH/zjTA355mpeuA+859TyR+e+Tc08IHYpLJuMsfpDJwoLo1ikIJI8jC3GFjnRClzA==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.1.tgz",
+            "integrity": "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==",
             "cpu": [
                 "x64"
             ],
@@ -1605,9 +1605,9 @@
             }
         },
         "node_modules/@esbuild/openharmony-arm64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.0.tgz",
-            "integrity": "sha512-FLGfyizszcef5C3YtoyQDACyg95+dndv79i2EekILBofh5wpCa1KuBqOWKrEHZg3zrL3t5ouE5jgr94vA+Wb2w==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.1.tgz",
+            "integrity": "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==",
             "cpu": [
                 "arm64"
             ],
@@ -1622,9 +1622,9 @@
             }
         },
         "node_modules/@esbuild/sunos-x64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.0.tgz",
-            "integrity": "sha512-1ZgjUoEdHZZl/YlV76TSCz9Hqj9h9YmMGAgAPYd+q4SicWNX3G5GCyx9uhQWSLcbvPW8Ni7lj4gDa1T40akdlw==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.1.tgz",
+            "integrity": "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==",
             "cpu": [
                 "x64"
             ],
@@ -1639,9 +1639,9 @@
             }
         },
         "node_modules/@esbuild/win32-arm64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.0.tgz",
-            "integrity": "sha512-Q9StnDmQ/enxnpxCCLSg0oo4+34B9TdXpuyPeTedN/6+iXBJ4J+zwfQI28u/Jl40nOYAxGoNi7mFP40RUtkmUA==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.1.tgz",
+            "integrity": "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==",
             "cpu": [
                 "arm64"
             ],
@@ -1656,9 +1656,9 @@
             }
         },
         "node_modules/@esbuild/win32-ia32": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.0.tgz",
-            "integrity": "sha512-zF3ag/gfiCe6U2iczcRzSYJKH1DCI+ByzSENHlM2FcDbEeo5Zd2C86Aq0tKUYAJJ1obRP84ymxIAksZUcdztHA==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.1.tgz",
+            "integrity": "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==",
             "cpu": [
                 "ia32"
             ],
@@ -1673,9 +1673,9 @@
             }
         },
         "node_modules/@esbuild/win32-x64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.0.tgz",
-            "integrity": "sha512-pEl1bO9mfAmIC+tW5btTmrKaujg3zGtUmWNdCw/xs70FBjwAL3o9OEKNHvNmnyylD6ubxUERiEhdsL0xBQ9efw==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.1.tgz",
+            "integrity": "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==",
             "cpu": [
                 "x64"
             ],
@@ -2076,9 +2076,6 @@
             "cpu": [
                 "arm"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "LGPL-3.0-or-later",
             "optional": true,
             "os": [
@@ -2095,9 +2092,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "LGPL-3.0-or-later",
             "optional": true,
             "os": [
@@ -2114,9 +2108,6 @@
             "cpu": [
                 "ppc64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "LGPL-3.0-or-later",
             "optional": true,
             "os": [
@@ -2133,9 +2124,6 @@
             "cpu": [
                 "riscv64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "LGPL-3.0-or-later",
             "optional": true,
             "os": [
@@ -2152,9 +2140,6 @@
             "cpu": [
                 "s390x"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "LGPL-3.0-or-later",
             "optional": true,
             "os": [
@@ -2187,9 +2172,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "musl"
-            ],
             "license": "LGPL-3.0-or-later",
             "optional": true,
             "os": [
@@ -2222,9 +2204,6 @@
             "cpu": [
                 "arm"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "Apache-2.0",
             "optional": true,
             "os": [
@@ -2247,9 +2226,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "Apache-2.0",
             "optional": true,
             "os": [
@@ -2272,9 +2248,6 @@
             "cpu": [
                 "ppc64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "Apache-2.0",
             "optional": true,
             "os": [
@@ -2297,9 +2270,6 @@
             "cpu": [
                 "riscv64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "Apache-2.0",
             "optional": true,
             "os": [
@@ -2322,9 +2292,6 @@
             "cpu": [
                 "s390x"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "Apache-2.0",
             "optional": true,
             "os": [
@@ -2369,9 +2336,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "musl"
-            ],
             "license": "Apache-2.0",
             "optional": true,
             "os": [
@@ -2664,9 +2628,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2683,9 +2644,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "musl"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2941,9 +2899,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2960,9 +2915,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "musl"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -3200,9 +3152,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -3219,9 +3168,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "musl"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -3582,9 +3528,6 @@
             "cpu": [
                 "arm"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -3605,9 +3548,6 @@
             "cpu": [
                 "arm"
             ],
-            "libc": [
-                "musl"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -3628,9 +3568,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -3651,9 +3588,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "musl"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -6873,9 +6807,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "Apache-2.0 AND MIT",
             "optional": true,
             "os": [
@@ -6892,9 +6823,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "musl"
-            ],
             "license": "Apache-2.0 AND MIT",
             "optional": true,
             "os": [
@@ -6911,9 +6839,6 @@
             "cpu": [
                 "ppc64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "Apache-2.0 AND MIT",
             "optional": true,
             "os": [
@@ -6930,9 +6855,6 @@
             "cpu": [
                 "s390x"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "Apache-2.0 AND MIT",
             "optional": true,
             "os": [
@@ -7200,9 +7122,6 @@
                 "arm64"
             ],
             "dev": true,
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -7220,9 +7139,6 @@
                 "arm64"
             ],
             "dev": true,
-            "libc": [
-                "musl"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -7296,6 +7212,72 @@
                 "node": ">=14.0.0"
             }
         },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/core": {
+            "version": "1.10.0",
+            "dev": true,
+            "inBundle": true,
+            "license": "MIT",
+            "optional": true,
+            "dependencies": {
+                "@emnapi/wasi-threads": "1.2.1",
+                "tslib": "^2.4.0"
+            }
+        },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/runtime": {
+            "version": "1.10.0",
+            "dev": true,
+            "inBundle": true,
+            "license": "MIT",
+            "optional": true,
+            "dependencies": {
+                "tslib": "^2.4.0"
+            }
+        },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
+            "version": "1.2.1",
+            "dev": true,
+            "inBundle": true,
+            "license": "MIT",
+            "optional": true,
+            "dependencies": {
+                "tslib": "^2.4.0"
+            }
+        },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@napi-rs/wasm-runtime": {
+            "version": "1.1.4",
+            "dev": true,
+            "inBundle": true,
+            "license": "MIT",
+            "optional": true,
+            "dependencies": {
+                "@tybys/wasm-util": "^0.10.1"
+            },
+            "funding": {
+                "type": "github",
+                "url": "https://github.com/sponsors/Brooooooklyn"
+            },
+            "peerDependencies": {
+                "@emnapi/core": "^1.7.1",
+                "@emnapi/runtime": "^1.7.1"
+            }
+        },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@tybys/wasm-util": {
+            "version": "0.10.1",
+            "dev": true,
+            "inBundle": true,
+            "license": "MIT",
+            "optional": true,
+            "dependencies": {
+                "tslib": "^2.4.0"
+            }
+        },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/tslib": {
+            "version": "2.8.1",
+            "dev": true,
+            "inBundle": true,
+            "license": "0BSD",
+            "optional": true
+        },
         "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
             "version": "4.3.0",
             "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.0.tgz",
@@ -8448,9 +8430,6 @@
                 "arm64"
             ],
             "dev": true,
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -8465,9 +8444,6 @@
                 "arm64"
             ],
             "dev": true,
-            "libc": [
-                "musl"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -8482,9 +8458,6 @@
                 "ppc64"
             ],
             "dev": true,
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -8499,9 +8472,6 @@
                 "riscv64"
             ],
             "dev": true,
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -8516,9 +8486,6 @@
                 "riscv64"
             ],
             "dev": true,
-            "libc": [
-                "musl"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -8533,9 +8500,6 @@
                 "s390x"
             ],
             "dev": true,
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -11261,9 +11225,9 @@
             ]
         },
         "node_modules/esbuild": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.0.tgz",
-            "integrity": "sha512-sNR9MHpXSUV/XB4zmsFKN+QgVG82Cc7+/aaxJ8Adi8hyOac+EXptIp45QBPaVyX3N70664wRbTcLTOemCAnyqw==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.1.tgz",
+            "integrity": "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==",
             "dev": true,
             "hasInstallScript": true,
             "license": "MIT",
@@ -11274,32 +11238,32 @@
                 "node": ">=18"
             },
             "optionalDependencies": {
-                "@esbuild/aix-ppc64": "0.28.0",
-                "@esbuild/android-arm": "0.28.0",
-                "@esbuild/android-arm64": "0.28.0",
-                "@esbuild/android-x64": "0.28.0",
-                "@esbuild/darwin-arm64": "0.28.0",
-                "@esbuild/darwin-x64": "0.28.0",
-                "@esbuild/freebsd-arm64": "0.28.0",
-                "@esbuild/freebsd-x64": "0.28.0",
-                "@esbuild/linux-arm": "0.28.0",
-                "@esbuild/linux-arm64": "0.28.0",
-                "@esbuild/linux-ia32": "0.28.0",
-                "@esbuild/linux-loong64": "0.28.0",
-                "@esbuild/linux-mips64el": "0.28.0",
-                "@esbuild/linux-ppc64": "0.28.0",
-                "@esbuild/linux-riscv64": "0.28.0",
-                "@esbuild/linux-s390x": "0.28.0",
-                "@esbuild/linux-x64": "0.28.0",
-                "@esbuild/netbsd-arm64": "0.28.0",
-                "@esbuild/netbsd-x64": "0.28.0",
-                "@esbuild/openbsd-arm64": "0.28.0",
-                "@esbuild/openbsd-x64": "0.28.0",
-                "@esbuild/openharmony-arm64": "0.28.0",
-                "@esbuild/sunos-x64": "0.28.0",
-                "@esbuild/win32-arm64": "0.28.0",
-                "@esbuild/win32-ia32": "0.28.0",
-                "@esbuild/win32-x64": "0.28.0"
+                "@esbuild/aix-ppc64": "0.28.1",
+                "@esbuild/android-arm": "0.28.1",
+                "@esbuild/android-arm64": "0.28.1",
+                "@esbuild/android-x64": "0.28.1",
+                "@esbuild/darwin-arm64": "0.28.1",
+                "@esbuild/darwin-x64": "0.28.1",
+                "@esbuild/freebsd-arm64": "0.28.1",
+                "@esbuild/freebsd-x64": "0.28.1",
+                "@esbuild/linux-arm": "0.28.1",
+                "@esbuild/linux-arm64": "0.28.1",
+                "@esbuild/linux-ia32": "0.28.1",
+                "@esbuild/linux-loong64": "0.28.1",
+                "@esbuild/linux-mips64el": "0.28.1",
+                "@esbuild/linux-ppc64": "0.28.1",
+                "@esbuild/linux-riscv64": "0.28.1",
+                "@esbuild/linux-s390x": "0.28.1",
+                "@esbuild/linux-x64": "0.28.1",
+                "@esbuild/netbsd-arm64": "0.28.1",
+                "@esbuild/netbsd-x64": "0.28.1",
+                "@esbuild/openbsd-arm64": "0.28.1",
+                "@esbuild/openbsd-x64": "0.28.1",
+                "@esbuild/openharmony-arm64": "0.28.1",
+                "@esbuild/sunos-x64": "0.28.1",
+                "@esbuild/win32-arm64": "0.28.1",
+                "@esbuild/win32-ia32": "0.28.1",
+                "@esbuild/win32-x64": "0.28.1"
             }
         },
         "node_modules/esbuild-node-externals": {
@@ -12191,16 +12155,16 @@
             }
         },
         "node_modules/form-data": {
-            "version": "4.0.5",
-            "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
-            "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
+            "version": "4.0.6",
+            "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz",
+            "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==",
             "license": "MIT",
             "dependencies": {
                 "asynckit": "^0.4.0",
                 "combined-stream": "^1.0.8",
                 "es-set-tostringtag": "^2.1.0",
-                "hasown": "^2.0.2",
-                "mime-types": "^2.1.12"
+                "hasown": "^2.0.4",
+                "mime-types": "^2.1.35"
             },
             "engines": {
                 "node": ">= 6"
@@ -12629,9 +12593,9 @@
             }
         },
         "node_modules/hasown": {
-            "version": "2.0.3",
-            "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.3.tgz",
-            "integrity": "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==",
+            "version": "2.0.4",
+            "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+            "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
             "license": "MIT",
             "dependencies": {
                 "function-bind": "^1.1.2"
@@ -13425,9 +13389,19 @@
             "license": "MIT"
         },
         "node_modules/js-yaml": {
-            "version": "4.1.1",
-            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-            "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+            "version": "4.2.0",
+            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
+            "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+            "funding": [
+                {
+                    "type": "github",
+                    "url": "https://github.com/sponsors/puzrin"
+                },
+                {
+                    "type": "github",
+                    "url": "https://github.com/sponsors/nodeca"
+                }
+            ],
             "license": "MIT",
             "dependencies": {
                 "argparse": "^2.0.1"
@@ -13767,9 +13741,6 @@
                 "arm64"
             ],
             "dev": true,
-            "libc": [
-                "glibc"
-            ],
             "license": "MPL-2.0",
             "optional": true,
             "os": [
@@ -13791,9 +13762,6 @@
                 "arm64"
             ],
             "dev": true,
-            "libc": [
-                "musl"
-            ],
             "license": "MPL-2.0",
             "optional": true,
             "os": [
@@ -14574,9 +14542,9 @@
             "license": "MIT"
         },
         "node_modules/nodemailer": {
-            "version": "8.0.9",
-            "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-8.0.9.tgz",
-            "integrity": "sha512-5ofa7BUN8+C+Hckh5V2GjeeOGRQBx0CJQA6KxrvuZfC8iU4/q7sLn8XrtEEhJkjV6HdyIiQs7Bba6bTao8JhkA==",
+            "version": "9.0.1",
+            "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-9.0.1.tgz",
+            "integrity": "sha512-Gwv8SQewT616ZM/URn0H54b8PWo/Wum7md3EW2aWy1lO27+WZCX+Xyak3J+NlmHUjDh5ME+uesJUDRbR3Ye8Bw==",
             "license": "MIT-0",
             "engines": {
                 "node": ">=6.0.0"
@@ -15001,9 +14969,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -15020,9 +14985,6 @@
             "cpu": [
                 "arm64"
             ],
-            "libc": [
-                "musl"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [

package.json

@@ -34,7 +34,7 @@
     "dependencies": {
         "@asteasolutions/zod-to-openapi": "8.5.0",
         "@devolutions/iron-remote-desktop": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-0.0.0.tgz",
-        "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.0.tgz",
+        "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
         "@aws-sdk/client-s3": "3.1056.0",
         "@headlessui/react": "2.2.10",
         "@hookform/resolvers": "5.4.0",
@@ -93,7 +93,7 @@
         "input-otp": "1.4.2",
         "ioredis": "5.11.0",
         "jmespath": "0.16.0",
-        "js-yaml": "4.1.1",
+        "js-yaml": "4.2.0",
         "jsonwebtoken": "9.0.3",
         "lucide-react": "1.17.0",
         "maxmind": "5.0.6",
@@ -103,7 +103,7 @@
         "next-themes": "0.4.6",
         "nextjs-toploader": "3.9.17",
         "node-cache": "5.1.2",
-        "nodemailer": "8.0.9",
+        "nodemailer": "9.0.1",
         "oslo": "1.2.1",
         "pg": "8.21.0",
         "posthog-node": "5.35.6",
@@ -165,7 +165,7 @@
         "@types/yargs": "17.0.35",
         "babel-plugin-react-compiler": "1.0.0",
         "drizzle-kit": "0.31.10",
-        "esbuild": "0.28.0",
+        "esbuild": "0.28.1",
         "esbuild-node-externals": "1.22.0",
         "eslint": "10.4.0",
         "eslint-config-next": "16.2.6",
@@ -179,7 +179,7 @@
         "typescript-eslint": "8.60.0"
     },
     "overrides": {
-        "esbuild": "0.28.0",
+        "esbuild": "0.28.1",
         "dompurify": "3.4.0",
         "postcss": "8.5.15"
     }

server/auth/actions.ts

@@ -21,6 +21,8 @@ export enum ActionsEnum {
     getSite = "getSite",
     listSites = "listSites",
     updateSite = "updateSite",
+    updateSiteApprovals = "updateSiteApprovals",
+    restartSite = "restartSite",
     resetSiteBandwidth = "resetSiteBandwidth",
     reGenerateSecret = "reGenerateSecret",
     createResource = "createResource",
@@ -70,6 +72,7 @@ export enum ActionsEnum {
     setResourceWhitelist = "setResourceWhitelist",
     getResourceWhitelist = "getResourceWhitelist",
     generateAccessToken = "generateAccessToken",
+    createResourceSessionToken = "createResourceSessionToken",
     deleteAcessToken = "deleteAcessToken",
     listAccessTokens = "listAccessTokens",
     createResourceRule = "createResourceRule",
@@ -178,7 +181,8 @@ export enum ActionsEnum {
     setResourcePolicyPincode = "setResourcePolicyPincode",
     setResourcePolicyHeaderAuth = "setResourcePolicyHeaderAuth",
     setResourcePolicyWhitelist = "setResourcePolicyWhitelist",
-    setResourcePolicyRules = "setResourcePolicyRules"
+    setResourcePolicyRules = "setResourcePolicyRules",
+    createOrgWideLauncherView = "createOrgWideLauncherView"
 }
 
 export async function checkUserActionPermission(

server/auth/canUserAccessResource.ts

@@ -1,6 +1,12 @@
 import { db } from "@server/db";
-import { and, eq, inArray } from "drizzle-orm";
-import { roleResources, userResources } from "@server/db";
+import { and, eq, inArray, isNull, or } from "drizzle-orm";
+import {
+    rolePolicies,
+    roleResources,
+    resources,
+    userPolicies,
+    userResources
+} from "@server/db";
 
 export async function canUserAccessResource({
     userId,
@@ -11,9 +17,14 @@ export async function canUserAccessResource({
     resourceId: number;
     roleIds: number[];
 }): Promise<boolean> {
-    const roleResourceAccess =
+    const [
+        roleResourceAccess,
+        rolePolicyAccess,
+        userResourceAccess,
+        userPolicyAccess
+    ] = await Promise.all([
         roleIds.length > 0
-            ? await db
+            ? db
                   .select()
                   .from(roleResources)
                   .where(
@@ -23,26 +34,87 @@ export async function canUserAccessResource({
                       )
                   )
                   .limit(1)
-            : [];
-
-    if (roleResourceAccess.length > 0) {
-        return true;
-    }
-
-    const userResourceAccess = await db
-        .select()
-        .from(userResources)
-        .where(
-            and(
-                eq(userResources.userId, userId),
-                eq(userResources.resourceId, resourceId)
+            : [],
+        roleIds.length > 0
+            ? db
+                  .select({
+                      roleId: rolePolicies.roleId,
+                      resourcePolicyId: rolePolicies.resourcePolicyId
+                  })
+                  .from(rolePolicies)
+                  .innerJoin(
+                      resources,
+                      // Shared policy wins; only use default policy when no shared
+                      // policy is assigned to the resource.
+                      or(
+                          eq(
+                              resources.resourcePolicyId,
+                              rolePolicies.resourcePolicyId
+                          ),
+                          and(
+                              isNull(resources.resourcePolicyId),
+                              eq(
+                                  resources.defaultResourcePolicyId,
+                                  rolePolicies.resourcePolicyId
+                              )
+                          )
+                      )
+                  )
+                  .where(
+                      and(
+                          eq(resources.resourceId, resourceId),
+                          inArray(rolePolicies.roleId, roleIds)
+                      )
+                  )
+                  .limit(1)
+            : [],
+        db
+            .select()
+            .from(userResources)
+            .where(
+                and(
+                    eq(userResources.userId, userId),
+                    eq(userResources.resourceId, resourceId)
+                )
             )
-        )
-        .limit(1);
+            .limit(1),
+        db
+            .select({
+                userId: userPolicies.userId,
+                resourcePolicyId: userPolicies.resourcePolicyId
+            })
+            .from(userPolicies)
+            .innerJoin(
+                resources,
+                // Shared policy wins; only use default policy when no shared
+                // policy is assigned to the resource.
+                or(
+                    eq(
+                        resources.resourcePolicyId,
+                        userPolicies.resourcePolicyId
+                    ),
+                    and(
+                        isNull(resources.resourcePolicyId),
+                        eq(
+                            resources.defaultResourcePolicyId,
+                            userPolicies.resourcePolicyId
+                        )
+                    )
+                )
+            )
+            .where(
+                and(
+                    eq(resources.resourceId, resourceId),
+                    eq(userPolicies.userId, userId)
+                )
+            )
+            .limit(1)
+    ]);
 
-    if (userResourceAccess.length > 0) {
-        return true;
-    }
-
-    return false;
+    return (
+        roleResourceAccess.length > 0 ||
+        rolePolicyAccess.length > 0 ||
+        userResourceAccess.length > 0 ||
+        userPolicyAccess.length > 0
+    );
 }

server/auth/sessions/app.ts

@@ -12,7 +12,7 @@ import {
     users
 } from "@server/db";
 import { db } from "@server/db";
-import { eq, inArray } from "drizzle-orm";
+import { and, eq, inArray, ne } from "drizzle-orm";
 import config from "@server/lib/config";
 import type { RandomReader } from "@oslojs/crypto/random";
 import { generateRandomString } from "@oslojs/crypto/random";
@@ -136,6 +136,45 @@ export async function invalidateAllSessions(userId: string): Promise<void> {
     }
 }
 
+export async function invalidateAllSessionsExceptCurrent(
+    userId: string,
+    currentSessionId: string
+): Promise<void> {
+    try {
+        await db.transaction(async (trx) => {
+            const userSessions = await trx
+                .select()
+                .from(sessions)
+                .where(
+                    and(
+                        eq(sessions.userId, userId),
+                        ne(sessions.sessionId, currentSessionId)
+                    )
+                );
+
+            if (userSessions.length > 0) {
+                await trx.delete(resourceSessions).where(
+                    inArray(
+                        resourceSessions.userSessionId,
+                        userSessions.map((s) => s.sessionId)
+                    )
+                );
+            }
+
+            await trx
+                .delete(sessions)
+                .where(
+                    and(
+                        eq(sessions.userId, userId),
+                        ne(sessions.sessionId, currentSessionId)
+                    )
+                );
+        });
+    } catch (e) {
+        logger.error("Failed to invalidate user sessions except current", e);
+    }
+}
+
 export function serializeSessionCookie(
     token: string,
     isSecure: boolean,

server/db/countries.ts

@@ -795,10 +795,13 @@ export const COUNTRIES = [
         name: "Serbia",
         code: "RS"
     },
-    {
-        name: "Serbia and Montenegro",
-        code: "CS"
-    },
+    // Removed as this is a deprecated ISO country code, not supported anymore
+    // Also the individual flags for Serbia & Montenegro are already included in the list
+    // more details: https://en.wikipedia.org/wiki/ISO_3166-2:CS
+    // {
+    //     name: "Serbia and Montenegro",
+    //     code: "CS"
+    // },
     {
         name: "Seychelles",
         code: "SC"

server/db/pg/driver.ts

@@ -87,7 +87,7 @@ function createDb() {
 
 export const db = createDb();
 export default db;
-export const primaryDb = db.$primary as typeof db; // is this typeof a problem - techincally they are different types
+export const primaryDb = db.$primary as typeof db; // is this typeof a problem - technically they are different types
 export type Transaction = Parameters<
     Parameters<(typeof db)["transaction"]>[0]
 >[0];

server/db/pg/logsDriver.ts

@@ -2,7 +2,7 @@ import { drizzle as DrizzlePostgres } from "drizzle-orm/node-postgres";
 import { readConfigFile } from "@server/lib/readConfigFile";
 import { withReplicas } from "drizzle-orm/pg-core";
 import { build } from "@server/build";
-import { db as mainDb, primaryDb as mainPrimaryDb } from "./driver";
+import { db as mainDb } from "./driver";
 import { createPool } from "./poolConfig";
 
 function createLogsDb() {
@@ -63,8 +63,7 @@ function createLogsDb() {
             })
         );
     } else {
-        const maxReplicaConnections =
-            poolConfig?.max_replica_connections || 20;
+        const maxReplicaConnections = poolConfig?.max_replica_connections || 20;
         for (const conn of replicaConnections) {
             const replicaPool = createPool(
                 conn.connection_string,
@@ -91,4 +90,4 @@ function createLogsDb() {
 
 export const logsDb = createLogsDb();
 export default logsDb;
-export const primaryLogsDb = logsDb.$primary;
+export const primaryLogsDb = logsDb.$primary;

server/db/pg/poolConfig.ts

@@ -1,5 +1,5 @@
+import config from "@server/lib/config";
 import { Pool, PoolConfig } from "pg";
-import logger from "@server/logger";
 
 export function createPoolConfig(
     connectionString: string,
@@ -27,7 +27,7 @@ export function attachPoolErrorHandlers(pool: Pool, label: string): void {
     pool.on("error", (err) => {
         // This catches errors on idle clients in the pool. Without this
         // handler an unexpected disconnect would crash the process.
-        logger.error(
+        console.error(
             `Unexpected error on idle ${label} database client: ${err.message}`
         );
     });
@@ -36,10 +36,32 @@ export function attachPoolErrorHandlers(pool: Pool, label: string): void {
         // Set a statement timeout on every new connection so a single slow
         // query can't block the pool forever
         client.query("SET statement_timeout = '30s'").catch((err: Error) => {
-            logger.warn(
+            console.warn(
                 `Failed to set statement_timeout on ${label} client: ${err.message}`
             );
         });
+
+        // Disable JIT compilation for this connection. Our hot-path queries
+        // (e.g. resource-by-domain lookups) join many tables but only ever
+        // return a handful of rows. When planner row estimates drift (e.g.
+        // due to autovacuum lag under write-heavy load), Postgres decides
+        // these plans are expensive enough to JIT-compile, which can add
+        // multiple seconds of pure compilation overhead per query and
+        // saturate the connection pool. JIT never pays off for these
+        // short-lived OLTP queries, so it's disabled outright rather than
+        // relying on statistics staying fresh.
+        //
+        // Set via a runtime SET command rather than the `options: "-c
+        // jit=off"` startup parameter: connections in SaaS mode go through
+        // a pooler (e.g. PgBouncer) that rejects arbitrary startup packet
+        // options with a protocol_violation (08P01) error.
+        if (config.getRawConfig().postgres?.pool.jit_mode == false) {
+            client.query("SET jit = off").catch((err: Error) => {
+                console.warn(
+                    `Failed to set jit=off on ${label} client: ${err.message}`
+                );
+            });
+        }
     });
 }
 
@@ -60,4 +82,4 @@ export function createPool(
     );
     attachPoolErrorHandlers(pool, label);
     return pool;
-}
+}

server/db/pg/schema/privateSchema.ts

@@ -2,6 +2,7 @@ import {
     pgTable,
     serial,
     varchar,
+    unique,
     boolean,
     integer,
     bigint,
@@ -11,7 +12,7 @@ import {
     primaryKey,
     uniqueIndex
 } from "drizzle-orm/pg-core";
-import { InferSelectModel } from "drizzle-orm";
+import { InferSelectModel, sql } from "drizzle-orm";
 import {
     domains,
     orgs,
@@ -19,12 +20,13 @@ import {
     roles,
     users,
     exitNodes,
-    sessions,
-    clients,
     resources,
     siteResources,
     targetHealthCheck,
-    sites
+    sites,
+    clients,
+    sessions,
+    labels
 } from "./schema";
 
 export const certificates = pgTable("certificates", {
@@ -197,6 +199,42 @@ export const remoteExitNodes = pgTable("remoteExitNode", {
     })
 });
 
+export const remoteExitNodeResources = pgTable("remoteExitNodeResources", {
+    remoteExitNodeResourceId: serial("remoteExitNodeResourceId").primaryKey(),
+    remoteExitNodeId: varchar("remoteExitNodeId")
+        .notNull()
+        .references(() => remoteExitNodes.remoteExitNodeId, {
+            onDelete: "cascade"
+        }),
+    destination: varchar("destination").notNull() // a cidr range
+});
+
+export const remoteExitNodePreferenceLabels = pgTable(
+    // this controls what sites are enforced to connect to this node
+    "remoteExitNodePreferenceLabels",
+    {
+        remoteExitNodePreferenceLabelId: serial(
+            "remoteExitNodePreferenceLabelId"
+        ).primaryKey(),
+        remoteExitNodeId: varchar("remoteExitNodeId")
+            .references(() => remoteExitNodes.remoteExitNodeId, {
+                onDelete: "cascade"
+            })
+            .notNull(),
+        labelId: integer("labelId")
+            .references(() => labels.labelId, {
+                onDelete: "cascade"
+            })
+            .notNull()
+    },
+    (t) => [
+        unique("remote_exit_node_preference_label_uniq").on(
+            t.remoteExitNodeId,
+            t.labelId
+        )
+    ]
+);
+
 export const remoteExitNodeSessions = pgTable("remoteExitNodeSession", {
     sessionId: varchar("id").primaryKey(),
     remoteExitNodeId: varchar("remoteExitNodeId")
@@ -207,17 +245,28 @@ export const remoteExitNodeSessions = pgTable("remoteExitNodeSession", {
     expiresAt: bigint("expiresAt", { mode: "number" }).notNull()
 });
 
-export const loginPage = pgTable("loginPage", {
-    loginPageId: serial("loginPageId").primaryKey(),
-    subdomain: varchar("subdomain"),
-    fullDomain: varchar("fullDomain"),
-    exitNodeId: integer("exitNodeId").references(() => exitNodes.exitNodeId, {
-        onDelete: "set null"
-    }),
-    domainId: varchar("domainId").references(() => domains.domainId, {
-        onDelete: "set null"
-    })
-});
+export const loginPage = pgTable(
+    "loginPage",
+    {
+        loginPageId: serial("loginPageId").primaryKey(),
+        subdomain: varchar("subdomain"),
+        fullDomain: varchar("fullDomain"),
+        exitNodeId: integer("exitNodeId").references(
+            () => exitNodes.exitNodeId,
+            {
+                onDelete: "set null"
+            }
+        ),
+        domainId: varchar("domainId").references(() => domains.domainId, {
+            onDelete: "set null"
+        })
+    },
+    (t) => [
+        index("idx_loginpage_fulldomain")
+            .on(t.fullDomain)
+            .where(sql`${t.fullDomain} IS NOT NULL`)
+    ]
+);
 
 export const loginPageOrg = pgTable("loginPageOrg", {
     loginPageId: integer("loginPageId")
@@ -580,24 +629,6 @@ export const trialNotifications = pgTable("trialNotifications", {
     sentAt: bigint("sentAt", { mode: "number" }).notNull()
 });
 
-export const browserGatewayTarget = pgTable("browserGatewayTarget", {
-    browserGatewayTargetId: serial("browserGatewayTargetId").primaryKey(),
-    resourceId: integer("resourceId")
-        .references(() => resources.resourceId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
-    siteId: integer("siteId")
-        .references(() => sites.siteId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
-    authToken: varchar("authToken").notNull(),
-    type: varchar("type").notNull(), // "ssh", "rdp", "vnc"
-    destination: varchar("destination").notNull(),
-    destinationPort: integer("destinationPort").notNull()
-});
-
 export type Approval = InferSelectModel<typeof approvals>;
 export type Limit = InferSelectModel<typeof limits>;
 export type Account = InferSelectModel<typeof account>;
@@ -645,6 +676,3 @@ export type AlertEmailRecipients = InferSelectModel<
 >;
 export type AlertWebhookActions = InferSelectModel<typeof alertWebhookActions>;
 export type TrialNotification = InferSelectModel<typeof trialNotifications>;
-export type BrowserGatewayTarget = InferSelectModel<
-    typeof browserGatewayTarget
->;

server/db/queries/verifySessionQueries.ts

@@ -45,9 +45,9 @@ export type ResourceWithAuth = {
     password: ResourcePassword | ResourcePolicyPassword | null;
     headerAuth: ResourceHeaderAuth | ResourcePolicyHeaderAuth | null;
     headerAuthExtendedCompatibility: ResourceHeaderAuthExtendedCompatibility | null;
-    applyRules: boolean;
-    sso: boolean;
-    emailWhitelistEnabled: boolean;
+    applyRules: boolean | null;
+    sso: boolean | null;
+    emailWhitelistEnabled: boolean | null;
     org: Org;
 };
 

server/db/sqlite/driver.ts

@@ -1,6 +1,5 @@
 import { drizzle as DrizzleSqlite } from "drizzle-orm/better-sqlite3";
 import Database from "better-sqlite3";
-import type BetterSqlite3 from "better-sqlite3";
 import * as schema from "./schema/schema";
 import path from "path";
 import fs from "fs";
@@ -12,68 +11,31 @@ export const exists = checkFileExists(location);
 
 bootstrapVolume();
 
-/**
- * Wraps better-sqlite3 Statement to call `finalize()` immediately after
- * execution, freeing native sqlite3_stmt memory deterministically instead
- * of waiting for GC. Fixes steady off-heap growth under load (#2120).
- * WARNING: Finalizes after first execution — incompatible with drizzle's
- * reusable .prepare() builders. No such usage exists in this codebase.
- */
-function autoFinalizeStatement(
-    stmt: BetterSqlite3.Statement
-): BetterSqlite3.Statement {
-    const wrapExec = <T extends (...args: any[]) => any>(fn: T): T => {
-        return function (this: any, ...args: any[]) {
-            try {
-                return fn.apply(this, args);
-            } finally {
-                try {
-                    // finalize() exists on the native Statement at runtime but
-                    // is missing from @types/better-sqlite3.
-                    (stmt as any).finalize();
-                } catch {
-                    // Already finalized — harmless
-                }
-            }
-        } as unknown as T;
-    };
-
-    stmt.run = wrapExec(stmt.run);
-    stmt.get = wrapExec(stmt.get);
-    stmt.all = wrapExec(stmt.all);
-
-    return stmt;
-}
-
 function createDb() {
     const sqlite = new Database(location);
 
     if (process.env.ENABLE_SQLITE_WAL_MODE == "true") {
         // Enable WAL mode — allows concurrent readers + single writer, preventing
         // contention across subsystems (verifySession, Traefik, audit, ping).
+        // NOTE: journal_mode persists in the DB file once set; unsetting this
+        // env var does NOT revert an existing WAL database.
         sqlite.pragma("journal_mode = WAL");
         // NORMAL sync mode: safe with WAL, reduces write lock hold time.
         sqlite.pragma("synchronous = NORMAL");
     }
 
-    // Wait up to 5s on SQLITE_BUSY instead of failing — prevents audit log
-    // retry loops that accumulate memory.
-    sqlite.pragma("busy_timeout = 5000");
+    // No busy_timeout pragma: better-sqlite3 already arms
+    // sqlite3_busy_timeout(db, 5000) via its default `timeout` option
+    // (lib/database.js), so an explicit pragma is redundant.
 
-    // 64 MB page cache (default 2 MB) — reduces I/O round-trips on large
-    // TraefikConfigManager JOINs that block the event loop.
-    sqlite.pragma("cache_size = -65536");
+    // Intentionally NOT setting cache_size or mmap_size: a large page cache plus
+    // a multi-hundred-MB mmap region inflate RSS and cause page-cache thrashing
+    // on small (~1 GB) instances. Leave SQLite on its conservative defaults.
 
-    // 256 MB memory-mapped I/O — OS serves reads from page cache directly,
-    // reducing event-loop blocking.
-    sqlite.pragma("mmap_size = 268435456");
-
-    // Wrap prepare() so every drizzle-orm statement is auto-finalized after
-    // first use, preventing sqlite3_stmt accumulation between GC cycles.
-    const originalPrepare = sqlite.prepare.bind(sqlite);
-    (sqlite as any).prepare = function autoFinalizePrepare(source: string) {
-        return autoFinalizeStatement(originalPrepare(source));
-    };
+    // Intentionally NOT wrapping prepare()/statements: better-sqlite3 finalizes
+    // sqlite3_stmt in the Statement destructor at GC, and drizzle-orm prepares a
+    // fresh statement per query (no statement cache), so statements cannot
+    // accumulate. better-sqlite3 11.x exposes no Statement.finalize() at all.
 
     return DrizzleSqlite(sqlite, {
         schema

server/db/sqlite/schema/privateSchema.ts

@@ -12,6 +12,7 @@ import {
     clients,
     domains,
     exitNodes,
+    labels,
     orgs,
     resources,
     roles,
@@ -21,9 +22,6 @@ import {
     targetHealthCheck,
     users
 } from "./schema";
-import { serial, varchar } from "drizzle-orm/mysql-core";
-import { pgTable } from "drizzle-orm/pg-core";
-import { bigint } from "zod";
 
 export const certificates = sqliteTable("certificates", {
     certId: integer("certId").primaryKey({ autoIncrement: true }),
@@ -195,6 +193,44 @@ export const remoteExitNodes = sqliteTable("remoteExitNode", {
     })
 });
 
+export const remoteExitNodeResources = sqliteTable("remoteExitNodeResources", {
+    remoteExitNodeResourceId: integer("remoteExitNodeResourceId").primaryKey({
+        autoIncrement: true
+    }),
+    remoteExitNodeId: text("remoteExitNodeId")
+        .notNull()
+        .references(() => remoteExitNodes.remoteExitNodeId, {
+            onDelete: "cascade"
+        }),
+    destination: text("destination").notNull() // a cidr range
+});
+
+export const remoteExitNodePreferenceLabels = sqliteTable(
+    // this controls what sites are enforced to connect to this node
+    "remoteExitNodePreferenceLabels",
+    {
+        remoteExitNodePreferenceLabelId: integer(
+            "remoteExitNodePreferenceLabelId"
+        ).primaryKey({ autoIncrement: true }),
+        remoteExitNodeId: text("remoteExitNodeId")
+            .references(() => remoteExitNodes.remoteExitNodeId, {
+                onDelete: "cascade"
+            })
+            .notNull(),
+        labelId: integer("labelId")
+            .references(() => labels.labelId, {
+                onDelete: "cascade"
+            })
+            .notNull()
+    },
+    (t) => [
+        uniqueIndex("remote_exit_node_preference_label_uniq").on(
+            t.remoteExitNodeId,
+            t.labelId
+        )
+    ]
+);
+
 export const remoteExitNodeSessions = sqliteTable("remoteExitNodeSession", {
     sessionId: text("id").primaryKey(),
     remoteExitNodeId: text("remoteExitNodeId")
@@ -588,26 +624,6 @@ export const trialNotifications = sqliteTable("trialNotifications", {
     sentAt: integer("sentAt").notNull()
 });
 
-export const browserGatewayTarget = sqliteTable("browserGatewayTarget", {
-    browserGatewayTargetId: integer("browserGatewayTargetId").primaryKey({
-        autoIncrement: true
-    }),
-    resourceId: integer("resourceId")
-        .references(() => resources.resourceId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
-    siteId: integer("siteId")
-        .references(() => sites.siteId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
-    authToken: text("authToken").notNull(),
-    type: text("type").notNull(), // "ssh", "rdp", "vnc"
-    destination: text("destination").notNull(),
-    destinationPort: integer("destinationPort").notNull()
-});
-
 export type Approval = InferSelectModel<typeof approvals>;
 export type Limit = InferSelectModel<typeof limits>;
 export type Account = InferSelectModel<typeof account>;
@@ -647,6 +663,3 @@ export type AlertEmailAction = InferSelectModel<typeof alertEmailActions>;
 export type AlertEmailRecipient = InferSelectModel<typeof alertEmailRecipients>;
 export type AlertWebhookAction = InferSelectModel<typeof alertWebhookActions>;
 export type TrialNotification = InferSelectModel<typeof trialNotifications>;
-export type BrowserGatewayTarget = InferSelectModel<
-    typeof browserGatewayTarget
->;

server/db/sqlite/schema/schema.ts

@@ -20,8 +20,10 @@ export const domains = sqliteTable("domains", {
     failed: integer("failed", { mode: "boolean" }).notNull().default(false),
     tries: integer("tries").notNull().default(0),
     certResolver: text("certResolver"),
+    customCertResolver: text("customCertResolver"),
     preferWildcardCert: integer("preferWildcardCert", { mode: "boolean" }),
-    errorMessage: text("errorMessage")
+    errorMessage: text("errorMessage"),
+    lastCheckedAt: integer("lastCheckedAt")
 });
 
 export const dnsRecords = sqliteTable("dnsRecords", {
@@ -116,6 +118,7 @@ export const sites = sqliteTable("sites", {
     // exit node stuff that is how to connect to the site when it has a wg server
     address: text("address"), // this is the address of the wireguard interface in newt
     endpoint: text("endpoint"), // this is how to reach gerbil externally - gets put into the wireguard config
+    localEndpoints: text("localEndpoints"), // JSON encoded list of string ips on the local machine to try to connect to
     publicKey: text("publicKey"), // TODO: Fix typo in publicKey
     lastHolePunch: integer("lastHolePunch"),
     listenPort: integer("listenPort"),
@@ -165,14 +168,12 @@ export const resources = sqliteTable("resources", {
     blockAccess: integer("blockAccess", { mode: "boolean" })
         .notNull()
         .default(false),
-    sso: integer("sso", { mode: "boolean" }).notNull().default(true),
     proxyPort: integer("proxyPort"),
-    emailWhitelistEnabled: integer("emailWhitelistEnabled", { mode: "boolean" })
-        .notNull()
-        .default(false),
-    applyRules: integer("applyRules", { mode: "boolean" })
-        .notNull()
-        .default(false),
+    sso: integer("sso", { mode: "boolean" }),
+    emailWhitelistEnabled: integer("emailWhitelistEnabled", {
+        mode: "boolean"
+    }),
+    applyRules: integer("applyRules", { mode: "boolean" }),
     enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
     stickySession: integer("stickySession", { mode: "boolean" })
         .notNull()
@@ -209,7 +210,8 @@ export const resources = sqliteTable("resources", {
     authDaemonMode: text("authDaemonMode")
         .$type<"site" | "remote" | "native">()
         .default("site"),
-    authDaemonPort: integer("authDaemonPort").default(22123)
+    authDaemonPort: integer("authDaemonPort").default(22123),
+    status: text("status").$type<"pending" | "approved">().default("approved")
 });
 
 export const labels = sqliteTable("labels", {
@@ -223,6 +225,23 @@ export const labels = sqliteTable("labels", {
         .notNull()
 });
 
+export const launcherViews = sqliteTable("launcherViews", {
+    viewId: integer("viewId").primaryKey({ autoIncrement: true }),
+    orgId: text("orgId")
+        .notNull()
+        .references(() => orgs.orgId, { onDelete: "cascade" }),
+    userId: text("userId").references(() => users.userId, {
+        onDelete: "cascade"
+    }),
+    name: text("name").notNull(),
+    config: text("config").notNull(),
+    isDefault: integer("isDefault", { mode: "boolean" })
+        .notNull()
+        .default(false),
+    createdAt: text("createdAt").notNull(),
+    updatedAt: text("updatedAt").notNull()
+});
+
 export const siteLabels = sqliteTable(
     "siteLabels",
     {
@@ -322,7 +341,12 @@ export const targets = sqliteTable("targets", {
     pathMatchType: text("pathMatchType"), // exact, prefix, regex
     rewritePath: text("rewritePath"), // if set, rewrites the path to this value before sending to the target
     rewritePathType: text("rewritePathType"), // exact, prefix, regex, stripPrefix
-    priority: integer("priority").notNull().default(100)
+    priority: integer("priority").notNull().default(100),
+    mode: text("mode")
+        .$type<"http" | "tcp" | "udp" | "ssh" | "rdp" | "vnc">()
+        .notNull()
+        .default("http"),
+    authToken: text("authToken")
 });
 
 export const targetHealthCheck = sqliteTable("targetHealthCheck", {
@@ -425,7 +449,8 @@ export const siteResources = sqliteTable("siteResources", {
         onDelete: "set null"
     }),
     subdomain: text("subdomain"),
-    fullDomain: text("fullDomain")
+    fullDomain: text("fullDomain"),
+    status: text("status").$type<"pending" | "approved">().default("approved")
 });
 
 export const networks = sqliteTable("networks", {
@@ -1101,12 +1126,18 @@ export const resourceAccessToken = sqliteTable("resourceAccessToken", {
     resourceId: integer("resourceId")
         .notNull()
         .references(() => resources.resourceId, { onDelete: "cascade" }),
+    userId: text("userId").references(() => users.userId, {
+        onDelete: "cascade"
+    }),
     path: text("path"),
     tokenHash: text("tokenHash").notNull(),
     sessionLength: integer("sessionLength").notNull(),
     expiresAt: integer("expiresAt"),
     title: text("title"),
     description: text("description"),
+    persistSession: integer("persistSession", { mode: "boolean" })
+        .notNull()
+        .default(false),
     createdAt: integer("createdAt").notNull()
 });
 
@@ -1202,7 +1233,17 @@ export const resourceRules = sqliteTable("resourceRules", {
     enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
     priority: integer("priority").notNull(),
     action: text("action").notNull(), // ACCEPT, DROP, PASS
-    match: text("match").notNull(), // CIDR, PATH, IP
+    match: text("match")
+        .$type<
+            | "CIDR"
+            | "PATH"
+            | "IP"
+            | "COUNTRY"
+            | "COUNTRY_IS_NOT"
+            | "ASN"
+            | "REGION"
+        >()
+        .notNull(), // CIDR, PATH, IP
     value: text("value").notNull()
 });
 
@@ -1248,7 +1289,17 @@ export const resourcePolicyRules = sqliteTable("resourcePolicyRules", {
     enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
     priority: integer("priority").notNull(),
     action: text("action").$type<"ACCEPT" | "DROP" | "PASS">().notNull(),
-    match: text("match").$type<"CIDR" | "PATH" | "IP">().notNull(),
+    match: text("match")
+        .$type<
+            | "CIDR"
+            | "PATH"
+            | "IP"
+            | "COUNTRY"
+            | "COUNTRY_IS_NOT"
+            | "ASN"
+            | "REGION"
+        >()
+        .notNull(),
     value: text("value").notNull()
 });
 
@@ -1544,6 +1595,7 @@ export type RoundTripMessageTracker = InferSelectModel<
 >;
 export type StatusHistory = InferSelectModel<typeof statusHistory>;
 export type Label = InferSelectModel<typeof labels>;
+export type LauncherView = InferSelectModel<typeof launcherViews>;
 export type ResourcePolicy = InferSelectModel<typeof resourcePolicies>;
 export type ResourcePolicyPincode = InferSelectModel<
     typeof resourcePolicyPincode

server/index.ts

@@ -24,6 +24,7 @@ import license from "#dynamic/license/license";
 import { initLogCleanupInterval } from "@server/lib/cleanupLogs";
 import { initAcmeCertSync } from "#dynamic/lib/acmeCertSync";
 import { fetchServerIp } from "@server/lib/serverIpService";
+import { startRebuildQueueProcessor } from "@server/lib/rebuildClientAssociations";
 
 async function startServers() {
     await setHostMeta();
@@ -41,6 +42,7 @@ async function startServers() {
 
     initLogCleanupInterval();
     initAcmeCertSync();
+    startRebuildQueueProcessor();
 
     // Start all servers
     const apiServer = createApiServer();

server/integrationApiServer.ts

@@ -157,7 +157,9 @@ function getOpenApiDocumentation() {
                         content: {
                             "application/json": {
                                 schema: z.object({
-                                    data: z.unknown().nullable(),
+                                    data: z
+                                        .record(z.string(), z.any())
+                                        .nullable(),
                                     success: z.boolean(),
                                     error: z.boolean(),
                                     message: z.string(),

server/lib/billing/features.ts

@@ -1,28 +1,39 @@
-export enum FeatureId {
+export enum LimitId {
     USERS = "users",
     SITES = "sites",
     EGRESS_DATA_MB = "egressDataMb",
     DOMAINS = "domains",
     REMOTE_EXIT_NODES = "remoteExitNodes",
-    ORGINIZATIONS = "organizations",
+    ORGANIZATIONS = "organizations",
+    PUBLIC_RESOURCES = "publicResources",
+    PRIVATE_RESOURCES = "privateResources",
+    MACHINE_CLIENTS = "machineClients",
     TIER1 = "tier1"
 }
 
-export async function getFeatureDisplayName(featureId: FeatureId): Promise<string> {
+export async function getFeatureDisplayName(
+    featureId: LimitId
+): Promise<string> {
     switch (featureId) {
-        case FeatureId.USERS:
+        case LimitId.USERS:
             return "Users";
-        case FeatureId.SITES:
+        case LimitId.SITES:
             return "Sites";
-        case FeatureId.EGRESS_DATA_MB:
+        case LimitId.EGRESS_DATA_MB:
             return "Egress Data (MB)";
-        case FeatureId.DOMAINS:
+        case LimitId.DOMAINS:
             return "Domains";
-        case FeatureId.REMOTE_EXIT_NODES:
+        case LimitId.REMOTE_EXIT_NODES:
             return "Remote Exit Nodes";
-        case FeatureId.ORGINIZATIONS:
+        case LimitId.ORGANIZATIONS:
             return "Organizations";
-        case FeatureId.TIER1:
+        case LimitId.PUBLIC_RESOURCES:
+            return "Public Resources";
+        case LimitId.PRIVATE_RESOURCES:
+            return "Private Resources";
+        case LimitId.MACHINE_CLIENTS:
+            return "Machine Clients";
+        case LimitId.TIER1:
             return "Home Lab";
         default:
             return featureId;
@@ -30,15 +41,16 @@ export async function getFeatureDisplayName(featureId: FeatureId): Promise<strin
 }
 
 // this is from the old system
-export const FeatureMeterIds: Partial<Record<FeatureId, string>> = { // right now we are not charging for any data
+export const FeatureMeterIds: Partial<Record<LimitId, string>> = {
+    // right now we are not charging for any data
     // [FeatureId.EGRESS_DATA_MB]: "mtr_61Srreh9eWrExDSCe41D3Ee2Ir7Wm5YW"
 };
 
-export const FeatureMeterIdsSandbox: Partial<Record<FeatureId, string>> = {
+export const FeatureMeterIdsSandbox: Partial<Record<LimitId, string>> = {
     // [FeatureId.EGRESS_DATA_MB]: "mtr_test_61Snh2a2m6qome5Kv41DCpkOb237B3dQ"
 };
 
-export function getFeatureMeterId(featureId: FeatureId): string | undefined {
+export function getFeatureMeterId(featureId: LimitId): string | undefined {
     if (
         process.env.ENVIRONMENT == "prod" &&
         process.env.SANDBOX_MODE !== "true"
@@ -49,22 +61,20 @@ export function getFeatureMeterId(featureId: FeatureId): string | undefined {
     }
 }
 
-export function getFeatureIdByMetricId(
-    metricId: string
-): FeatureId | undefined {
-    return (Object.entries(FeatureMeterIds) as [FeatureId, string][]).find(
+export function getFeatureIdByMetricId(metricId: string): LimitId | undefined {
+    return (Object.entries(FeatureMeterIds) as [LimitId, string][]).find(
         ([_, v]) => v === metricId
     )?.[0];
 }
 
-export type FeaturePriceSet = Partial<Record<FeatureId, string>>;
+export type FeaturePriceSet = Partial<Record<LimitId, string>>;
 
 export const tier1FeaturePriceSet: FeaturePriceSet = {
-    [FeatureId.TIER1]: "price_1SzVE3D3Ee2Ir7Wm6wT5Dl3G"
+    [LimitId.TIER1]: "price_1SzVE3D3Ee2Ir7Wm6wT5Dl3G"
 };
 
 export const tier1FeaturePriceSetSandbox: FeaturePriceSet = {
-    [FeatureId.TIER1]: "price_1SxgpPDCpkOb237Bfo4rIsoT"
+    [LimitId.TIER1]: "price_1SxgpPDCpkOb237Bfo4rIsoT"
 };
 
 export function getTier1FeaturePriceSet(): FeaturePriceSet {
@@ -79,11 +89,11 @@ export function getTier1FeaturePriceSet(): FeaturePriceSet {
 }
 
 export const tier2FeaturePriceSet: FeaturePriceSet = {
-    [FeatureId.USERS]: "price_1SzVCcD3Ee2Ir7Wmn6U3KvPN"
+    [LimitId.USERS]: "price_1SzVCcD3Ee2Ir7Wmn6U3KvPN"
 };
 
 export const tier2FeaturePriceSetSandbox: FeaturePriceSet = {
-    [FeatureId.USERS]: "price_1SxaEHDCpkOb237BD9lBkPiR"
+    [LimitId.USERS]: "price_1SxaEHDCpkOb237BD9lBkPiR"
 };
 
 export function getTier2FeaturePriceSet(): FeaturePriceSet {
@@ -98,11 +108,11 @@ export function getTier2FeaturePriceSet(): FeaturePriceSet {
 }
 
 export const tier3FeaturePriceSet: FeaturePriceSet = {
-    [FeatureId.USERS]: "price_1SzVDKD3Ee2Ir7WmPtOKNusv"
+    [LimitId.USERS]: "price_1SzVDKD3Ee2Ir7WmPtOKNusv"
 };
 
 export const tier3FeaturePriceSetSandbox: FeaturePriceSet = {
-    [FeatureId.USERS]: "price_1SxaEODCpkOb237BiXdCBSfs"
+    [LimitId.USERS]: "price_1SxaEODCpkOb237BiXdCBSfs"
 };
 
 export function getTier3FeaturePriceSet(): FeaturePriceSet {
@@ -116,7 +126,7 @@ export function getTier3FeaturePriceSet(): FeaturePriceSet {
     }
 }
 
-export function getFeatureIdByPriceId(priceId: string): FeatureId | undefined {
+export function getFeatureIdByPriceId(priceId: string): LimitId | undefined {
     // Check all feature price sets
     const allPriceSets = [
         getTier1FeaturePriceSet(),
@@ -125,7 +135,7 @@ export function getFeatureIdByPriceId(priceId: string): FeatureId | undefined {
     ];
 
     for (const priceSet of allPriceSets) {
-        const entry = (Object.entries(priceSet) as [FeatureId, string][]).find(
+        const entry = (Object.entries(priceSet) as [LimitId, string][]).find(
             ([_, price]) => price === priceId
         );
         if (entry) {

server/lib/billing/getLineItems.ts

@@ -1,19 +1,19 @@
 import Stripe from "stripe";
-import { FeatureId, FeaturePriceSet } from "./features";
+import { LimitId, FeaturePriceSet } from "./features";
 import { usageService } from "./usageService";
 
 export async function getLineItems(
     featurePriceSet: FeaturePriceSet,
-    orgId: string,
+    orgId: string
 ): Promise<Stripe.Checkout.SessionCreateParams.LineItem[]> {
-    const users = await usageService.getUsage(orgId, FeatureId.USERS);
+    const users = await usageService.getUsage(orgId, LimitId.USERS);
 
     return Object.entries(featurePriceSet).map(([featureId, priceId]) => {
         let quantity: number | undefined;
 
-        if (featureId === FeatureId.USERS) {
+        if (featureId === LimitId.USERS) {
             quantity = users?.instantaneousValue || 1;
-        } else if (featureId === FeatureId.TIER1) {
+        } else if (featureId === LimitId.TIER1) {
             quantity = 1;
         }
 

server/lib/billing/limitSet.ts

@@ -1,70 +1,82 @@
-import { FeatureId } from "./features";
+import { LimitId } from "./features";
 
 export type LimitSet = Partial<{
-    [key in FeatureId]: {
+    [key in LimitId]: {
         value: number | null; // null indicates no limit
         description?: string;
     };
 }>;
 
 export const freeLimitSet: LimitSet = {
-    [FeatureId.SITES]: { value: 5, description: "Basic limit" },
-    [FeatureId.USERS]: { value: 5, description: "Basic limit" },
-    [FeatureId.DOMAINS]: { value: 5, description: "Basic limit" },
-    [FeatureId.REMOTE_EXIT_NODES]: { value: 1, description: "Basic limit" },
-    [FeatureId.ORGINIZATIONS]: { value: 1, description: "Basic limit" },
+    [LimitId.SITES]: { value: 5, description: "Basic limit" },
+    [LimitId.USERS]: { value: 5, description: "Basic limit" },
+    [LimitId.DOMAINS]: { value: 5, description: "Basic limit" },
+    [LimitId.REMOTE_EXIT_NODES]: { value: 1, description: "Basic limit" },
+    [LimitId.ORGANIZATIONS]: { value: 1, description: "Basic limit" },
+    [LimitId.PUBLIC_RESOURCES]: { value: 15, description: "Basic limit" },
+    [LimitId.PRIVATE_RESOURCES]: { value: 15, description: "Basic limit" },
+    [LimitId.MACHINE_CLIENTS]: { value: 5, description: "Basic limit" }
 };
 
 export const tier1LimitSet: LimitSet = {
-    [FeatureId.USERS]: { value: 7, description: "Home limit" },
-    [FeatureId.SITES]: { value: 10, description: "Home limit" },
-    [FeatureId.DOMAINS]: { value: 10, description: "Home limit" },
-    [FeatureId.REMOTE_EXIT_NODES]: { value: 1, description: "Home limit" },
-    [FeatureId.ORGINIZATIONS]: { value: 1, description: "Home limit" },
+    [LimitId.USERS]: { value: 7, description: "Home limit" },
+    [LimitId.SITES]: { value: 10, description: "Home limit" },
+    [LimitId.DOMAINS]: { value: 10, description: "Home limit" },
+    [LimitId.REMOTE_EXIT_NODES]: { value: 1, description: "Home limit" },
+    [LimitId.ORGANIZATIONS]: { value: 1, description: "Home limit" },
+    [LimitId.PUBLIC_RESOURCES]: { value: 30, description: "Home limit" },
+    [LimitId.PRIVATE_RESOURCES]: { value: 30, description: "Home limit" },
+    [LimitId.MACHINE_CLIENTS]: { value: 10, description: "Home limit" }
 };
 
 export const tier2LimitSet: LimitSet = {
-    [FeatureId.USERS]: {
+    [LimitId.USERS]: {
         value: 50,
         description: "Team limit"
     },
-    [FeatureId.SITES]: {
+    [LimitId.SITES]: {
         value: 50,
         description: "Team limit"
     },
-    [FeatureId.DOMAINS]: {
+    [LimitId.DOMAINS]: {
         value: 50,
         description: "Team limit"
     },
-    [FeatureId.REMOTE_EXIT_NODES]: {
+    [LimitId.REMOTE_EXIT_NODES]: {
         value: 3,
         description: "Team limit"
     },
-    [FeatureId.ORGINIZATIONS]: {
+    [LimitId.ORGANIZATIONS]: {
         value: 1,
         description: "Team limit"
-    }
+    },
+    [LimitId.PUBLIC_RESOURCES]: { value: 150, description: "Team limit" },
+    [LimitId.PRIVATE_RESOURCES]: { value: 150, description: "Team limit" },
+    [LimitId.MACHINE_CLIENTS]: { value: 25, description: "Team limit" }
 };
 
 export const tier3LimitSet: LimitSet = {
-    [FeatureId.USERS]: {
+    [LimitId.USERS]: {
         value: 250,
         description: "Business limit"
     },
-    [FeatureId.SITES]: {
+    [LimitId.SITES]: {
         value: 250,
         description: "Business limit"
     },
-    [FeatureId.DOMAINS]: {
+    [LimitId.DOMAINS]: {
         value: 100,
         description: "Business limit"
     },
-    [FeatureId.REMOTE_EXIT_NODES]: {
+    [LimitId.REMOTE_EXIT_NODES]: {
         value: 20,
         description: "Business limit"
     },
-    [FeatureId.ORGINIZATIONS]: {
+    [LimitId.ORGANIZATIONS]: {
         value: 5,
         description: "Business limit"
     },
+    [LimitId.PUBLIC_RESOURCES]: { value: 750, description: "Business limit" },
+    [LimitId.PRIVATE_RESOURCES]: { value: 750, description: "Business limit" },
+    [LimitId.MACHINE_CLIENTS]: { value: 100, description: "Business limit" }
 };

server/lib/billing/limitsService.ts

@@ -1,7 +1,7 @@
 import { db, limits } from "@server/db";
 import { and, eq } from "drizzle-orm";
 import { LimitSet } from "./limitSet";
-import { FeatureId } from "./features";
+import { LimitId } from "./features";
 import logger from "@server/logger";
 
 class LimitService {
@@ -38,7 +38,7 @@ class LimitService {
 
     async getOrgLimit(
         orgId: string,
-        featureId: FeatureId
+        featureId: LimitId
     ): Promise<number | null> {
         const limitId = `${orgId}-${featureId}`;
         const [limit] = await db

server/lib/billing/tierMatrix.ts

@@ -23,7 +23,6 @@ export enum TierFeature {
     StandaloneHealthChecks = "standaloneHealthChecks",
     AlertingRules = "alertingRules",
     WildcardSubdomain = "wildcardSubdomain",
-    Labels = "labels",
     NewtAutoUpdate = "newtAutoUpdate",
     ResourcePolicies = "resourcePolicies",
     AdvancedPublicResources = "advancedPublicResources",
@@ -31,7 +30,6 @@ export enum TierFeature {
 }
 
 export const tierMatrix: Record<TierFeature, Tier[]> = {
-    [TierFeature.Labels]: ["tier2", "tier3", "enterprise"],
     [TierFeature.OrgOidc]: ["tier1", "tier2", "tier3", "enterprise"],
     [TierFeature.LoginPageDomain]: ["tier1", "tier2", "tier3", "enterprise"],
     [TierFeature.DeviceApprovals]: ["tier1", "tier3", "enterprise"],
@@ -71,16 +69,6 @@ export const tierMatrix: Record<TierFeature, Tier[]> = {
     [TierFeature.WildcardSubdomain]: ["tier1", "tier2", "tier3", "enterprise"],
     [TierFeature.NewtAutoUpdate]: ["tier1", "tier2", "tier3", "enterprise"],
     [TierFeature.ResourcePolicies]: ["tier3", "enterprise"],
-    [TierFeature.AdvancedPublicResources]: [
-        "tier1",
-        "tier2",
-        "tier3",
-        "enterprise"
-    ],
-    [TierFeature.AdvancedPrivateResources]: [
-        "tier1",
-        "tier2",
-        "tier3",
-        "enterprise"
-    ]
+    [TierFeature.AdvancedPublicResources]: ["tier3", "enterprise"],
+    [TierFeature.AdvancedPrivateResources]: ["tier3", "enterprise"]
 };

server/lib/billing/usageService.ts

@@ -9,10 +9,10 @@ import {
     Transaction,
     orgs
 } from "@server/db";
-import { FeatureId, getFeatureMeterId } from "./features";
+import { LimitId, getFeatureMeterId } from "./features";
 import logger from "@server/logger";
 import { build } from "@server/build";
-import cache from "#dynamic/lib/cache";
+import { regionalCache as cache } from "#dynamic/lib/cache";
 
 export function noop() {
     if (build !== "saas") {
@@ -22,7 +22,6 @@ export function noop() {
 }
 
 export class UsageService {
-
     constructor() {
         if (noop()) {
             return;
@@ -38,7 +37,7 @@ export class UsageService {
 
     public async add(
         orgId: string,
-        featureId: FeatureId,
+        featureId: LimitId,
         value: number,
         transaction: any = null
     ): Promise<Usage | null> {
@@ -57,7 +56,10 @@ export class UsageService {
             try {
                 let usage;
                 if (transaction) {
-                    const orgIdToUse = await this.getBillingOrg(orgId, transaction);
+                    const orgIdToUse = await this.getBillingOrg(
+                        orgId,
+                        transaction
+                    );
                     usage = await this.internalAddUsage(
                         orgIdToUse,
                         featureId,
@@ -112,7 +114,7 @@ export class UsageService {
 
     private async internalAddUsage(
         orgId: string, // here the orgId is the billing org already resolved by getBillingOrg in updateCount
-        featureId: FeatureId,
+        featureId: LimitId,
         value: number,
         trx: Transaction
     ): Promise<Usage> {
@@ -161,7 +163,7 @@ export class UsageService {
 
     async updateCount(
         orgId: string,
-        featureId: FeatureId,
+        featureId: LimitId,
         value?: number,
         customerId?: string
     ): Promise<void> {
@@ -225,7 +227,7 @@ export class UsageService {
 
     private async getCustomerId(
         orgId: string,
-        featureId: FeatureId
+        featureId: LimitId
     ): Promise<string | null> {
         const orgIdToUse = await this.getBillingOrg(orgId);
 
@@ -267,18 +269,19 @@ export class UsageService {
 
     public async getUsage(
         orgId: string,
-        featureId: FeatureId,
+        featureId: LimitId,
         trx: Transaction | typeof db = db
     ): Promise<Usage | null> {
         if (noop()) {
             return null;
         }
 
-        const orgIdToUse = await this.getBillingOrg(orgId, trx);
-
-        const usageId = `${orgIdToUse}-${featureId}`;
-
+        let orgIdToUse = orgId;
         try {
+            orgIdToUse = await this.getBillingOrg(orgId, trx);
+
+            const usageId = `${orgIdToUse}-${featureId}`;
+
             const [result] = await trx
                 .select()
                 .from(usage)
@@ -338,8 +341,12 @@ export class UsageService {
                 `Failed to get usage for ${orgIdToUse}/${featureId}:`,
                 error
             );
-            throw error;
+            if (process.env.NODE_ENV !== "development") {
+                throw error;
+            }
         }
+
+        return null;
     }
 
     public async getBillingOrg(
@@ -374,7 +381,7 @@ export class UsageService {
 
     public async checkLimitSet(
         orgId: string,
-        featureId?: FeatureId,
+        featureId?: LimitId,
         usage?: Usage,
         trx: Transaction | typeof db = db
     ): Promise<boolean> {
@@ -382,13 +389,13 @@ export class UsageService {
             return false;
         }
 
-        const orgIdToUse = await this.getBillingOrg(orgId, trx);
-
         // This method should check the current usage against the limits set for the organization
         // and kick out all of the sites on the org
         let hasExceededLimits = false;
-
+        let orgIdToUse = orgId;
         try {
+            orgIdToUse = await this.getBillingOrg(orgId, trx);
+
             let orgLimits: Limit[] = [];
             if (featureId) {
                 // Get all limits set for this organization
@@ -422,7 +429,7 @@ export class UsageService {
                 } else {
                     currentUsage = await this.getUsage(
                         orgIdToUse,
-                        limit.featureId as FeatureId,
+                        limit.featureId as LimitId,
                         trx
                     );
                 }

server/lib/blueprints/applyBlueprint.ts

@@ -3,28 +3,37 @@ import {
     newts,
     blueprints,
     Blueprint,
-    Site,
     siteResources,
     roleSiteResources,
     userSiteResources,
     clientSiteResources
 } from "@server/db";
-import { Config, ConfigSchema } from "./types";
-import { ProxyResourcesResults, updateProxyResources } from "./proxyResources";
+import { Config, ConfigSchema, isTargetsOnlyResource } from "./types";
+import {
+    PublicResourcesResults,
+    updatePublicResources
+} from "./publicResources";
 import { fromError } from "zod-validation-error";
 import logger from "@server/logger";
 import { sites } from "@server/db";
 import { eq, and, isNotNull } from "drizzle-orm";
-import { addTargets as addProxyTargets } from "@server/routers/newt/targets";
+import {
+    addTargets as addProxyTargets,
+    sendBrowserGatewayTargets
+} from "@server/routers/newt/targets";
 import {
     ClientResourcesResults,
-    updateClientResources
-} from "./clientResources";
+    updatePrivateResources
+} from "./privateResources";
+import { updateResourcePolicies } from "./resourcePolicies";
 import { BlueprintSource } from "@server/routers/blueprints/types";
 import { stringify as stringifyYaml } from "yaml";
 import { generateName } from "@server/db/names";
-import { handleMessagingForUpdatedSiteResource } from "@server/routers/siteResource";
-import { rebuildClientAssociationsFromSiteResource } from "../rebuildClientAssociations";
+import {
+    handleMessagingForUpdatedSiteResource,
+    rebuildClientAssociationsFromSiteResource,
+    waitForSiteResourceRebuildIdle
+} from "../rebuildClientAssociations";
 
 type ApplyBlueprintArgs = {
     orgId: string;
@@ -41,40 +50,39 @@ export async function applyBlueprint({
     name,
     source = "API"
 }: ApplyBlueprintArgs): Promise<Blueprint> {
-    // Validate the input data
-    const validationResult = ConfigSchema.safeParse(configData);
-    if (!validationResult.success) {
-        throw new Error(fromError(validationResult.error).toString());
-    }
-
-    const config: Config = validationResult.data;
     let blueprintSucceeded: boolean = false;
-    let blueprintMessage: string;
+    let blueprintMessage = "";
     let error: any | null = null;
 
     try {
-        let proxyResourcesResults: ProxyResourcesResults = [];
-        let clientResourcesResults: ClientResourcesResults = [];
-        await db.transaction(async (trx) => {
-            proxyResourcesResults = await updateProxyResources(
-                orgId,
-                config,
-                trx,
-                siteId
-            );
-            clientResourcesResults = await updateClientResources(
-                orgId,
-                config,
-                trx,
-                siteId
-            );
+        const validationResult = ConfigSchema.safeParse(configData);
+        if (!validationResult.success) {
+            throw new Error(fromError(validationResult.error).toString());
+        }
 
-            logger.debug(
-                `Successfully updated proxy resources for org ${orgId}: ${JSON.stringify(proxyResourcesResults)}`
+        const config: Config = validationResult.data;
+
+        let publicResourcesResults: PublicResourcesResults = [];
+        let privateResourcesResults: ClientResourcesResults = [];
+
+        await db.transaction(async (trx) => {
+            await updateResourcePolicies(orgId, config, trx);
+
+            publicResourcesResults = await updatePublicResources(
+                orgId,
+                config,
+                trx,
+                siteId
+            );
+            privateResourcesResults = await updatePrivateResources(
+                orgId,
+                config,
+                trx,
+                siteId
             );
 
             // We need to update the targets on the newts from the successfully updated information
-            for (const result of proxyResourcesResults) {
+            for (const result of publicResourcesResults) {
                 for (const target of result.targetsToUpdate) {
                     const [site] = await trx
                         .select()
@@ -101,178 +109,63 @@ export async function applyBlueprint({
                                 (hc) => hc.targetId === target.targetId
                             );
 
-                        await addProxyTargets(
-                            site.newt.newtId,
-                            [target],
-                            matchingHealthcheck ? [matchingHealthcheck] : [],
-                            result.proxyResource.mode === "udp" ? "udp" : "tcp",
-                            site.newt.version
-                        );
+                        if (["http", "tcp", "udp"].includes(target.mode)) {
+                            await addProxyTargets(
+                                site.newt.newtId,
+                                [target],
+                                matchingHealthcheck
+                                    ? [matchingHealthcheck]
+                                    : [],
+                                result.proxyResource.mode === "udp"
+                                    ? "udp"
+                                    : "tcp",
+                                site.newt.version
+                            );
+                        } else if (
+                            ["ssh", "rdp", "vnc"].includes(target.mode)
+                        ) {
+                            await sendBrowserGatewayTargets(
+                                site.newt.newtId,
+                                [target],
+                                site.newt.version
+                            );
+                        }
                     }
                 }
             }
 
             logger.debug(
-                `Successfully updated client resources for org ${orgId}: ${JSON.stringify(clientResourcesResults)}`
+                `Successfully updated public resources for org ${orgId}: ${JSON.stringify(publicResourcesResults)}`
             );
 
             // We need to update the targets on the newts from the successfully updated information
-            for (const result of clientResourcesResults) {
-                if (
-                    result.oldSiteResource &&
-                    JSON.stringify(result.newSites?.sort()) !==
-                        JSON.stringify(result.oldSites?.sort())
-                ) {
-                    // query existing associations
-                    const existingRoleIds = await trx
-                        .select()
-                        .from(roleSiteResources)
-                        .where(
-                            eq(
-                                roleSiteResources.siteResourceId,
-                                result.oldSiteResource.siteResourceId
-                            )
+            for (const result of privateResourcesResults) {
+                rebuildClientAssociationsFromSiteResource(
+                    result.newSiteResource
+                )
+                    .then(() =>
+                        waitForSiteResourceRebuildIdle(
+                            result.newSiteResource.siteResourceId
                         )
-                        .then((rows) => rows.map((row) => row.roleId));
-
-                    const existingUserIds = await trx
-                        .select()
-                        .from(userSiteResources)
-                        .where(
-                            eq(
-                                userSiteResources.siteResourceId,
-                                result.oldSiteResource.siteResourceId
-                            )
+                    )
+                    .then(() =>
+                        handleMessagingForUpdatedSiteResource(
+                            result.oldSiteResource,
+                            result.newSiteResource,
+                            result.oldSites.map((s) => s.siteId),
+                            result.newSites.map((s) => s.siteId)
                         )
-                        .then((rows) => rows.map((row) => row.userId));
-
-                    const existingClientIds = await trx
-                        .select()
-                        .from(clientSiteResources)
-                        .where(
-                            eq(
-                                clientSiteResources.siteResourceId,
-                                result.oldSiteResource.siteResourceId
-                            )
-                        )
-                        .then((rows) => rows.map((row) => row.clientId));
-
-                    // delete the existing site resource
-                    await trx
-                        .delete(siteResources)
-                        .where(
-                            and(
-                                eq(
-                                    siteResources.siteResourceId,
-                                    result.oldSiteResource.siteResourceId
-                                )
-                            )
+                    )
+                    .catch((e) => {
+                        logger.error(
+                            `Failed to rebuild and handle messaging for site resource ${result.newSiteResource.siteResourceId}. Error: ${e}`
                         );
-
-                    await rebuildClientAssociationsFromSiteResource(
-                        result.oldSiteResource,
-                        trx
-                    );
-
-                    const [insertedSiteResource] = await trx
-                        .insert(siteResources)
-                        .values({
-                            ...result.newSiteResource
-                        })
-                        .returning();
-
-                    // wait some time to allow for messages to be handled
-                    await new Promise((resolve) => setTimeout(resolve, 750));
-
-                    //////////////////// update the associations ////////////////////
-
-                    if (existingRoleIds.length > 0) {
-                        await trx.insert(roleSiteResources).values(
-                            existingRoleIds.map((roleId) => ({
-                                roleId,
-                                siteResourceId:
-                                    insertedSiteResource!.siteResourceId
-                            }))
-                        );
-                    }
-
-                    if (existingUserIds.length > 0) {
-                        await trx.insert(userSiteResources).values(
-                            existingUserIds.map((userId) => ({
-                                userId,
-                                siteResourceId:
-                                    insertedSiteResource!.siteResourceId
-                            }))
-                        );
-                    }
-
-                    if (existingClientIds.length > 0) {
-                        await trx.insert(clientSiteResources).values(
-                            existingClientIds.map((clientId) => ({
-                                clientId,
-                                siteResourceId:
-                                    insertedSiteResource!.siteResourceId
-                            }))
-                        );
-                    }
-
-                    await rebuildClientAssociationsFromSiteResource(
-                        insertedSiteResource,
-                        trx
-                    );
-                } else {
-                    let good = true;
-                    for (const newSite of result.newSites) {
-                        const [site] = await trx
-                            .select()
-                            .from(sites)
-                            .innerJoin(newts, eq(sites.siteId, newts.siteId))
-                            .where(
-                                and(
-                                    eq(sites.siteId, newSite.siteId),
-                                    eq(sites.orgId, orgId),
-                                    eq(sites.type, "newt"),
-                                    isNotNull(sites.pubKey)
-                                )
-                            )
-                            .limit(1);
-
-                        if (!site) {
-                            logger.debug(
-                                `No newt sites found for client resource ${result.newSiteResource.siteResourceId}, skipping target update`
-                            );
-                            good = false;
-                            break;
-                        }
-
-                        logger.debug(
-                            `Updating client resource ${result.newSiteResource.siteResourceId} on site ${newSite.siteId}`
-                        );
-                    }
-
-                    if (!good) {
-                        continue;
-                    }
-
-                    await handleMessagingForUpdatedSiteResource(
-                        result.oldSiteResource,
-                        result.newSiteResource,
-                        result.newSites.map((site) => ({
-                            siteId: site.siteId,
-                            orgId: result.newSiteResource.orgId
-                        })),
-                        trx
-                    );
-                }
-
-                // await addClientTargets(
-                //     site.newt.newtId,
-                //     result.resource.destination,
-                //     result.resource.destinationPort,
-                //     result.resource.protocol,
-                //     result.resource.proxyPort
-                // );
+                    });
             }
+
+            logger.debug(
+                `Successfully updated private resources for org ${orgId}: ${JSON.stringify(privateResourcesResults)}`
+            );
         });
 
         blueprintSucceeded = true;
@@ -280,7 +173,9 @@ export async function applyBlueprint({
     } catch (err) {
         blueprintSucceeded = false;
         blueprintMessage = `Blueprint applied with errors: ${err}`;
-        logger.error(blueprintMessage);
+        logger.debug(
+            `Org ${orgId} blueprint apply issues: ${blueprintMessage}`
+        );
         error = err;
     }
 

server/lib/blueprints/applyNewtDockerBlueprint.ts

@@ -71,7 +71,10 @@ export async function applyNewtDockerBlueprint(
     let skippedKeys: string[] = [];
 
     try {
-        const blueprint = processContainerLabels(containers);
+        // Some Newt clients can report null/undefined containers when Docker
+        // labels are unavailable. Treat that as an empty blueprint payload.
+        const safeContainers = Array.isArray(containers) ? containers : [];
+        const blueprint = processContainerLabels(safeContainers);
 
         logger.debug(
             `Received Docker blueprint with ${Object.keys(blueprint["proxy-resources"]).length} proxy, ${Object.keys(blueprint["client-resources"]).length} client resource(s)`
@@ -113,7 +116,7 @@ export async function applyNewtDockerBlueprint(
             source: "NEWT"
         });
     } catch (error) {
-        logger.error(`Failed to update database from config: ${error}`);
+        logger.debug(`Failed to update database from config: ${error}`);
         await sendToClient(newtId, {
             type: "newt/blueprint/results",
             data: {

server/lib/blueprints/privateResources.ts

@@ -23,6 +23,11 @@ import logger from "@server/logger";
 import { defaultRoleAllowedActions } from "@server/routers/role/createRole";
 import { getNextAvailableAliasAddress } from "../ip";
 import { createCertificate } from "#dynamic/routers/certificates/createCertificate";
+import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
+import { tierMatrix } from "../billing/tierMatrix";
+import { build } from "@server/build";
+import { LimitId } from "../billing";
+import { usageService } from "../billing/usageService";
 
 async function getDomainForSiteResource(
     siteResourceId: number | undefined,
@@ -103,7 +108,7 @@ export type ClientResourcesResults = {
     oldSites: { siteId: number }[];
 }[];
 
-export async function updateClientResources(
+export async function updatePrivateResources(
     orgId: string,
     config: Config,
     trx: Transaction,
@@ -114,6 +119,30 @@ export async function updateClientResources(
     for (const [resourceNiceId, resourceData] of Object.entries(
         config["client-resources"]
     )) {
+        if (resourceData.mode === "http") {
+            const hasHttpFeature = await isLicensedOrSubscribed(
+                orgId,
+                tierMatrix.advancedPrivateResources
+            );
+            if (!hasHttpFeature) {
+                throw new Error(
+                    "HTTP private resources are not included in your current plan. Please upgrade."
+                );
+            }
+        }
+
+        if (resourceData.mode === "ssh") {
+            const hasSshFeature = await isLicensedOrSubscribed(
+                orgId,
+                tierMatrix.advancedPrivateResources
+            );
+            if (!hasSshFeature) {
+                throw new Error(
+                    "SSH private resources are not included in your current plan. Please upgrade."
+                );
+            }
+        }
+
         const [existingResource] = await trx
             .select()
             .from(siteResources)
@@ -169,17 +198,19 @@ export async function updateClientResources(
             }
         }
 
+        let resourceStatusFromSite: "approved" | "pending" = "approved";
         if (siteId && allSites.length === 0) {
             // only add if there are not provided sites
             // Use the provided siteId directly, but verify it belongs to the org
             const [siteSingle] = await trx
-                .select({ siteId: sites.siteId })
+                .select({ siteId: sites.siteId, status: sites.status })
                 .from(sites)
                 .where(and(eq(sites.siteId, siteId), eq(sites.orgId, orgId)))
                 .limit(1);
             if (siteSingle) {
                 allSites.push(siteSingle);
             }
+            resourceStatusFromSite = siteSingle.status ?? "approved";
         }
 
         if (allSites.length === 0) {
@@ -188,6 +219,13 @@ export async function updateClientResources(
             );
         }
 
+        const resourceEnabled =
+            resourceData.enabled == undefined || resourceData.enabled == null
+                ? true
+                : resourceStatusFromSite === "pending"
+                  ? false
+                  : resourceData.enabled;
+
         if (existingResource) {
             let domainInfo:
                 | { subdomain: string | null; domainId: string }
@@ -201,6 +239,31 @@ export async function updateClientResources(
                 );
             }
 
+            if (resourceData.alias) {
+                const [aliasConflict] = await trx
+                    .select({
+                        siteResourceId: siteResources.siteResourceId
+                    })
+                    .from(siteResources)
+                    .where(
+                        and(
+                            eq(siteResources.orgId, orgId),
+                            eq(siteResources.alias, resourceData.alias),
+                            ne(
+                                siteResources.siteResourceId,
+                                existingResource.siteResourceId
+                            )
+                        )
+                    )
+                    .limit(1);
+
+                if (aliasConflict) {
+                    throw new Error(
+                        `Alias ${resourceData.alias} already in use by another site resource in org ${orgId}`
+                    );
+                }
+            }
+
             // Update existing resource
             const [updatedResource] = await trx
                 .update(siteResources)
@@ -211,8 +274,7 @@ export async function updateClientResources(
                     scheme: resourceData.scheme,
                     destination: resourceData.destination,
                     destinationPort: resourceData["destination-port"],
-                    enabled: true, // hardcoded for now
-                    // enabled: resourceData.enabled ?? true,
+                    enabled: resourceEnabled,
                     alias: resourceData.alias || null,
                     disableIcmp:
                         resourceData["disable-icmp"] ||
@@ -231,7 +293,8 @@ export async function updateClientResources(
                     pamMode: resourceData["auth-daemon"]?.pam || "passthrough",
                     authDaemonMode:
                         resourceData["auth-daemon"]?.mode || "native",
-                    authDaemonPort: resourceData["auth-daemon"]?.port || 22123
+                    authDaemonPort: resourceData["auth-daemon"]?.port || 22123,
+                    status: resourceStatusFromSite
                 })
                 .where(
                     eq(
@@ -366,7 +429,9 @@ export async function updateClientResources(
                         }))
                     );
                     existingRoles.push(created);
-                    logger.info(`Auto-created role "${name}" in org ${orgId} from blueprint`);
+                    logger.info(
+                        `Auto-created role "${name}" in org ${orgId} from blueprint`
+                    );
                 }
 
                 const roleIds = existingRoles.map((role) => role.roleId);
@@ -385,9 +450,41 @@ export async function updateClientResources(
                 oldSites: existingSiteIds
             });
         } else {
+            // create a brand new resource
+
+            if (build == "saas") {
+                const usage = await usageService.getUsage(
+                    orgId,
+                    LimitId.PRIVATE_RESOURCES
+                );
+                if (!usage) {
+                    throw new Error(
+                        `Usage data not found for org ${orgId} and limit ${LimitId.PRIVATE_RESOURCES}`
+                    );
+                }
+                const rejectResource = await usageService.checkLimitSet(
+                    orgId,
+
+                    LimitId.PRIVATE_RESOURCES,
+                    {
+                        ...usage,
+                        instantaneousValue: (usage.instantaneousValue || 0) + 1
+                    } // We need to add one to know if we are violating the limit
+                );
+                if (rejectResource) {
+                    throw new Error(
+                        "Private resource limit exceeded. Please upgrade your plan."
+                    );
+                }
+            }
+
             let aliasAddress: string | null = null;
             let releaseAliasLock: (() => Promise<void>) | null = null;
-            if (resourceData.mode === "host" || resourceData.mode === "http") {
+            if (
+                resourceData.mode === "host" ||
+                resourceData.mode === "http" ||
+                resourceData.mode === "ssh"
+            ) {
                 const { value, release } = await getNextAvailableAliasAddress(
                     orgId,
                     trx
@@ -408,6 +505,27 @@ export async function updateClientResources(
                 );
             }
 
+            if (resourceData.alias) {
+                const [aliasConflict] = await trx
+                    .select({
+                        siteResourceId: siteResources.siteResourceId
+                    })
+                    .from(siteResources)
+                    .where(
+                        and(
+                            eq(siteResources.orgId, orgId),
+                            eq(siteResources.alias, resourceData.alias)
+                        )
+                    )
+                    .limit(1);
+
+                if (aliasConflict) {
+                    throw new Error(
+                        `Alias ${resourceData.alias} already in use by another site resource in org ${orgId}`
+                    );
+                }
+            }
+
             const [network] = await trx
                 .insert(networks)
                 .values({
@@ -430,8 +548,7 @@ export async function updateClientResources(
                     scheme: resourceData.scheme,
                     destination: resourceData.destination,
                     destinationPort: resourceData["destination-port"],
-                    enabled: true, // hardcoded for now
-                    // enabled: resourceData.enabled ?? true,
+                    enabled: resourceEnabled,
                     alias: resourceData.alias || null,
                     aliasAddress: aliasAddress,
                     disableIcmp:
@@ -451,7 +568,8 @@ export async function updateClientResources(
                     pamMode: resourceData["auth-daemon"]?.pam || "passthrough",
                     authDaemonMode:
                         resourceData["auth-daemon"]?.mode || "native",
-                    authDaemonPort: resourceData["auth-daemon"]?.port || 22123
+                    authDaemonPort: resourceData["auth-daemon"]?.port || 22123,
+                    status: resourceStatusFromSite
                 })
                 .returning();
 
@@ -510,7 +628,9 @@ export async function updateClientResources(
                         }))
                     );
                     existingRoles.push(created);
-                    logger.info(`Auto-created role "${name}" in org ${orgId} from blueprint`);
+                    logger.info(
+                        `Auto-created role "${name}" in org ${orgId} from blueprint`
+                    );
                 }
 
                 const roleIds = existingRoles.map((role) => role.roleId);
@@ -575,6 +695,8 @@ export async function updateClientResources(
                 `Created new client resource ${newResource.name} (${newResource.siteResourceId}) for org ${orgId}`
             );
 
+            await usageService.add(orgId, LimitId.PRIVATE_RESOURCES, 1, trx);
+
             results.push({
                 newSiteResource: newResource,
                 newSites: allSites,

server/lib/blueprints/publicResources.ts

@@ -1,85 +1,114 @@
+import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
+import { createCertificate } from "#dynamic/routers/certificates/createCertificate";
+import { hashPassword } from "@server/auth/password";
+import { generateId } from "@server/auth/sessions/app";
+import { build } from "@server/build";
 import {
-    domains,
     domainNamespaces,
+    domains,
     orgDomains,
     Resource,
     resourceHeaderAuth,
     resourceHeaderAuthExtendedCompatibility,
+    resourcePassword,
     resourcePincode,
+    resourcePolicies,
+    resourcePolicyHeaderAuth,
+    resourcePolicyPassword,
+    resourcePolicyPincode,
+    resourcePolicyRules,
+    resourcePolicyWhiteList,
     resourceRules,
+    resources,
     resourceWhitelist,
     roleActions,
+    rolePolicies,
     roleResources,
     roles,
+    Site,
+    sites,
     Target,
     TargetHealthCheck,
     targetHealthCheck,
+    targets,
     Transaction,
     userOrgs,
+    userPolicies,
     userResources,
     users,
-    resourcePolicies,
-    resourcePolicyPassword,
-    resourcePolicyPincode,
-    resourcePolicyHeaderAuth,
-    resourcePolicyRules,
-    resourcePolicyWhiteList,
-    rolePolicies,
-    userPolicies
+    type ResourceRule
 } from "@server/db";
-import { resources, targets, sites } from "@server/db";
-import { eq, and, asc, or, ne, count, isNotNull } from "drizzle-orm";
-import {
-    Config,
-    ConfigSchema,
-    isTargetsOnlyResource,
-    TargetData
-} from "./types";
-import logger from "@server/logger";
-import { createCertificate } from "#dynamic/routers/certificates/createCertificate";
-import { pickPort } from "@server/routers/target/helpers";
-import { resourcePassword } from "@server/db";
 import { getUniqueResourcePolicyName } from "@server/db/names";
-import { hashPassword } from "@server/auth/password";
-import { isValidCIDR, isValidIP, isValidUrlGlobPattern } from "../validators";
 import { isValidRegionId } from "@server/db/regions";
-import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
 import { fireHealthCheckUnknownAlert } from "@server/lib/alerts";
-import { tierMatrix } from "../billing/tierMatrix";
+import serverConfig from "@server/lib/config";
+import { encrypt } from "@server/lib/crypto";
+import logger from "@server/logger";
 import { defaultRoleAllowedActions } from "@server/routers/role/createRole";
+import { pickPort } from "@server/routers/target/helpers";
+import { and, asc, eq, isNotNull, ne, or } from "drizzle-orm";
+import { tierMatrix } from "../billing/tierMatrix";
+import { isValidCIDR, isValidIP, isValidUrlGlobPattern } from "../validators";
+import { Config, isTargetsOnlyResource, TargetData } from "./types";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import next from "next";
+import { LimitId } from "../billing";
+import { usageService } from "../billing/usageService";
 
-export type ProxyResourcesResults = {
+export type PublicResourcesResults = {
     proxyResource: Resource;
     targetsToUpdate: Target[];
     healthchecksToUpdate: TargetHealthCheck[];
 }[];
 
-export async function updateProxyResources(
+export async function updatePublicResources(
     orgId: string,
     config: Config,
     trx: Transaction,
     siteId?: number
-): Promise<ProxyResourcesResults> {
-    const results: ProxyResourcesResults = [];
+): Promise<PublicResourcesResults> {
+    const results: PublicResourcesResults = [];
 
     for (const [resourceNiceId, resourceData] of Object.entries(
         config["proxy-resources"]
     )) {
         const targetsToUpdate: Target[] = [];
         const healthchecksToUpdate: TargetHealthCheck[] = [];
+
         let resource: Resource;
+        let resourceStatusFromSite: "approved" | "pending" = "approved";
+        let providedSite: Partial<Site> | undefined;
+        if (siteId) {
+            // Use the provided siteId directly, but verify it belongs to the org
+            [providedSite] = await trx
+                .select({
+                    siteId: sites.siteId,
+                    type: sites.type,
+                    status: sites.status
+                })
+                .from(sites)
+                .where(and(eq(sites.siteId, siteId), eq(sites.orgId, orgId)))
+                .limit(1);
+
+            resourceStatusFromSite = providedSite?.status ?? "approved";
+        }
 
         async function createTarget( // reusable function to create a target
             resourceId: number,
             targetData: TargetData
         ) {
             const targetSiteId = targetData.site;
-            let site;
+            let site: Partial<Site> | undefined;
 
             if (targetSiteId) {
                 // Look up site by niceId
                 [site] = await trx
-                    .select({ siteId: sites.siteId })
+                    .select({
+                        siteId: sites.siteId,
+                        type: sites.type,
+                        status: sites.status
+                    })
                     .from(sites)
                     .where(
                         and(
@@ -88,15 +117,9 @@ export async function updateProxyResources(
                         )
                     )
                     .limit(1);
-            } else if (siteId) {
+            } else if (siteId && providedSite) {
                 // Use the provided siteId directly, but verify it belongs to the org
-                [site] = await trx
-                    .select({ siteId: sites.siteId })
-                    .from(sites)
-                    .where(
-                        and(eq(sites.siteId, siteId), eq(sites.orgId, orgId))
-                    )
-                    .limit(1);
+                site = providedSite;
             } else {
                 throw new Error(`Target site is required`);
             }
@@ -118,17 +141,28 @@ export async function updateProxyResources(
                 internalPortToCreate = targetData["internal-port"];
             }
 
+            let authToken: string | undefined;
+            if (site.type !== "local") {
+                const plainToken = generateId(48);
+                authToken = encrypt(
+                    plainToken,
+                    serverConfig.getRawConfig().server.secret!
+                );
+            }
+
             // Create target
             const [newTarget] = await trx
                 .insert(targets)
                 .values({
                     resourceId: resourceId,
-                    siteId: site.siteId,
+                    siteId: site.siteId!,
                     ip: targetData.hostname,
+                    mode: resourceData.mode as Target["mode"],
                     method: targetData.method,
                     port: targetData.port,
                     enabled: targetData.enabled,
                     internalPort: internalPortToCreate,
+                    authToken: authToken,
                     path: targetData.path,
                     pathMatchType: targetData["path-match"],
                     rewritePath:
@@ -154,7 +188,7 @@ export async function updateProxyResources(
                 .insert(targetHealthCheck)
                 .values({
                     name: `${targetData.hostname}:${targetData.port}`,
-                    siteId: site.siteId,
+                    siteId: site.siteId!,
                     targetId: newTarget.targetId,
                     orgId: orgId,
                     hcEnabled: healthcheckData?.enabled || false,
@@ -212,7 +246,10 @@ export async function updateProxyResources(
         const resourceEnabled =
             resourceData.enabled == undefined || resourceData.enabled == null
                 ? true
-                : resourceData.enabled;
+                : resourceStatusFromSite === "pending"
+                  ? false
+                  : resourceData.enabled;
+
         const resourceSsl =
             resourceData.ssl == undefined || resourceData.ssl == null
                 ? true
@@ -222,17 +259,59 @@ export async function updateProxyResources(
             headers = JSON.stringify(resourceData.headers);
         }
 
+        if (["ssh", "rdp", "vnc"].includes(resourceData.mode || "")) {
+            const isLicensed = await isLicensedOrSubscribed(
+                orgId,
+                tierMatrix.advancedPublicResources
+            );
+            if (!isLicensed) {
+                throw new Error(
+                    "Your current subscription does not support browser gateway resources. Please upgrade to access this feature."
+                );
+            }
+        }
+
+        if (resourceData.policy) {
+            const isLicensed = await isLicensedOrSubscribed(
+                orgId,
+                tierMatrix.resourcePolicies
+            );
+            if (!isLicensed) {
+                throw new Error(
+                    "Your current subscription does not support shared resource policies. Please upgrade to access this feature."
+                );
+            }
+        }
+
         if (existingResource) {
             let domain;
             if (
                 ["http", "ssh", "rdp", "vnc"].includes(resourceData.mode || "")
             ) {
+                if (resourceData["full-domain"]?.startsWith("*.")) {
+                    const isLicensed = await isLicensedOrSubscribed(
+                        orgId,
+                        tierMatrix.wildcardSubdomain
+                    );
+                    if (!isLicensed) {
+                        throw new Error(
+                            "Wildcard subdomains are not supported on your current plan. Please upgrade to access this feature."
+                        );
+                    }
+                }
+
                 domain = await getDomain(
                     existingResource.resourceId,
                     resourceData["full-domain"]!,
                     orgId,
                     trx
                 );
+
+                await enforceDomainNamespacePaywall(
+                    orgId,
+                    domain.domainId,
+                    trx
+                );
             }
 
             // check if the only key in the resource is targets, if so, skip the update
@@ -346,7 +425,8 @@ export async function updateProxyResources(
                                     ? (resourceData["proxy-protocol-version"] ??
                                       1)
                                     : 1,
-                            resourcePolicyId: sharedPolicy.resourcePolicyId
+                            resourcePolicyId: sharedPolicy.resourcePolicyId,
+                            status: resourceStatusFromSite
                         })
                         .where(
                             eq(
@@ -522,8 +602,16 @@ export async function updateProxyResources(
                                     ? (resourceData["proxy-protocol-version"] ??
                                       1)
                                     : 1,
+                            pamMode:
+                                resourceData["auth-daemon"]?.pam ||
+                                "passthrough",
+                            authDaemonMode:
+                                resourceData["auth-daemon"]?.mode || "native",
+                            authDaemonPort:
+                                resourceData["auth-daemon"]?.port || 22123,
                             resourcePolicyId: null,
-                            defaultResourcePolicyId: inlinePolicyId
+                            defaultResourcePolicyId: inlinePolicyId,
+                            status: resourceStatusFromSite
                         })
                         .where(
                             eq(
@@ -664,7 +752,8 @@ export async function updateProxyResources(
                                     ? "/"
                                     : undefined),
                             rewritePathType: targetData["rewrite-match"],
-                            priority: targetData.priority
+                            priority: targetData.priority,
+                            mode: resourceData.mode
                         })
                         .where(eq(targets.targetId, existingTarget.targetId))
                         .returning();
@@ -839,7 +928,7 @@ export async function updateProxyResources(
                                 .update(resourceRules)
                                 .set({
                                     action: getRuleAction(rule.action),
-                                    match: rule.match.toUpperCase(),
+                                    match: rule.match.toUpperCase() as ResourceRule["match"],
                                     value: getRuleValue(
                                         rule.match.toUpperCase(),
                                         rule.value
@@ -858,7 +947,7 @@ export async function updateProxyResources(
                         await trx.insert(resourceRules).values({
                             resourceId: existingResource.resourceId,
                             action: getRuleAction(rule.action),
-                            match: rule.match.toUpperCase(),
+                            match: rule.match.toUpperCase() as ResourceRule["match"],
                             value: getRuleValue(
                                 rule.match.toUpperCase(),
                                 rule.value
@@ -880,7 +969,45 @@ export async function updateProxyResources(
                 }
             } else {
                 // INLINE POLICY MODE: sync rules into policy-level table
-                const inlinePolicyId = resource!.defaultResourcePolicyId!;
+                let inlinePolicyId = resource!.defaultResourcePolicyId;
+
+                // Targets-only updates skip the auth/policy update branch above,
+                // so pre-1.19 resources can still have no inline policy linked.
+                if (!inlinePolicyId) {
+                    const [adminRole] = await trx
+                        .select()
+                        .from(roles)
+                        .where(
+                            and(eq(roles.isAdmin, true), eq(roles.orgId, orgId))
+                        )
+                        .limit(1);
+
+                    if (!adminRole) {
+                        throw new Error(`Admin role not found`);
+                    }
+
+                    inlinePolicyId = await ensureInlinePolicy(
+                        existingResource.defaultResourcePolicyId,
+                        orgId,
+                        resourceNiceId,
+                        adminRole.roleId,
+                        trx
+                    );
+
+                    [resource] = await trx
+                        .update(resources)
+                        .set({
+                            resourcePolicyId: null,
+                            defaultResourcePolicyId: inlinePolicyId
+                        })
+                        .where(
+                            eq(
+                                resources.resourceId,
+                                existingResource.resourceId
+                            )
+                        )
+                        .returning();
+                }
 
                 // Clear the old resource-level rules table
                 await trx
@@ -902,16 +1029,61 @@ export async function updateProxyResources(
             logger.debug(`Updated resource ${existingResource.resourceId}`);
         } else {
             // create a brand new resource
+
+            if (build === "saas") {
+                const usage = await usageService.getUsage(
+                    orgId,
+                    LimitId.PUBLIC_RESOURCES
+                );
+                if (!usage) {
+                    throw new Error(
+                        `Usage data not found for org ${orgId} and limit ${LimitId.PUBLIC_RESOURCES}`
+                    );
+                }
+                const rejectResource = await usageService.checkLimitSet(
+                    orgId,
+
+                    LimitId.PUBLIC_RESOURCES,
+                    {
+                        ...usage,
+                        instantaneousValue: (usage.instantaneousValue || 0) + 1
+                    } // We need to add one to know if we are violating the limit
+                );
+                if (rejectResource) {
+                    throw new Error(
+                        "Public resource limit exceeded. Please upgrade your plan."
+                    );
+                }
+            }
+
             let domain;
             if (
                 ["http", "ssh", "rdp", "vnc"].includes(resourceData.mode || "")
             ) {
+                if (resourceData["full-domain"]?.startsWith("*.")) {
+                    const isLicensed = await isLicensedOrSubscribed(
+                        orgId,
+                        tierMatrix.wildcardSubdomain
+                    );
+                    if (!isLicensed) {
+                        throw new Error(
+                            "Wildcard subdomains are not supported on your current plan. Please upgrade to access this feature."
+                        );
+                    }
+                }
+
                 domain = await getDomain(
                     undefined,
                     resourceData["full-domain"]!,
                     orgId,
                     trx
                 );
+
+                await enforceDomainNamespacePaywall(
+                    orgId,
+                    domain.domainId,
+                    trx
+                );
             }
 
             const isLicensed = await isLicensedOrSubscribed(
@@ -980,6 +1152,7 @@ export async function updateProxyResources(
                 .values({
                     orgId,
                     niceId: resourceNiceId,
+                    status: resourceStatusFromSite,
                     name: resourceData.name || "Unnamed Resource",
                     mode: resourceData.mode,
                     proxyPort: ["http", "ssh", "rdp", "vnc"].includes(
@@ -1139,7 +1312,7 @@ export async function updateProxyResources(
                     await trx.insert(resourceRules).values({
                         resourceId: newResource.resourceId,
                         action: getRuleAction(rule.action),
-                        match: rule.match.toUpperCase(),
+                        match: rule.match.toUpperCase() as ResourceRule["match"],
                         value: getRuleValue(
                             rule.match.toUpperCase(),
                             rule.value
@@ -1173,6 +1346,8 @@ export async function updateProxyResources(
                 await createTarget(newResource.resourceId, targetData);
             }
 
+            await usageService.add(orgId, LimitId.PUBLIC_RESOURCES, 1, trx);
+
             logger.debug(`Created resource ${newResource.resourceId}`);
         }
 
@@ -1200,7 +1375,7 @@ function getRuleAction(input: string) {
 
 function getRuleValue(match: string, value: string) {
     // if the match is a country, uppercase the value
-    if (match == "COUNTRY") {
+    if (match === "COUNTRY" || match === "COUNTRY_IS_NOT") {
         return value.toUpperCase();
     }
     return value;
@@ -1384,17 +1559,6 @@ async function syncWhitelistUsers(
         .where(eq(resourceWhitelist.resourceId, resourceId));
 
     for (const email of whitelistUsers) {
-        const [user] = await trx
-            .select()
-            .from(users)
-            .innerJoin(userOrgs, eq(users.userId, userOrgs.userId))
-            .where(and(eq(users.email, email), eq(userOrgs.orgId, orgId)))
-            .limit(1);
-
-        if (!user) {
-            throw new Error(`User not found: ${email} in org ${orgId}`);
-        }
-
         const existingWhitelistEntry = existingWhitelist.find(
             (w) => w.email === email
         );
@@ -1866,6 +2030,37 @@ function checkIfTargetChanged(
     return false;
 }
 
+async function enforceDomainNamespacePaywall(
+    orgId: string,
+    domainId: string,
+    trx: Transaction
+) {
+    if (build !== "saas") {
+        return;
+    }
+
+    const hasDomainNamespaceAccess = await isLicensedOrSubscribed(
+        orgId,
+        tierMatrix.domainNamespaces
+    );
+
+    if (hasDomainNamespaceAccess) {
+        return;
+    }
+
+    const [namespaceDomain] = await trx
+        .select()
+        .from(domainNamespaces)
+        .where(eq(domainNamespaces.domainId, domainId))
+        .limit(1);
+
+    if (namespaceDomain) {
+        throw new Error(
+            "Your current subscription does not support custom domain namespaces. Please upgrade to access this feature."
+        );
+    }
+}
+
 export async function getDomain(
     resourceId: number | undefined,
     fullDomain: string,

server/lib/blueprints/resourcePolicies.ts

@@ -0,0 +1,654 @@
+import {
+    db,
+    idp,
+    idpOrg,
+    resourcePolicies,
+    resourcePolicyHeaderAuth,
+    resourcePolicyPassword,
+    resourcePolicyPincode,
+    resourcePolicyRules,
+    resourcePolicyWhiteList,
+    rolePolicies,
+    roles,
+    Transaction,
+    userOrgs,
+    userPolicies,
+    users
+} from "@server/db";
+import { eq, and, or } from "drizzle-orm";
+import { Config, ResourcePolicyData } from "./types";
+import logger from "@server/logger";
+import { getUniqueResourcePolicyName } from "@server/db/names";
+import { hashPassword } from "@server/auth/password";
+import { isValidCIDR, isValidIP, isValidUrlGlobPattern } from "../validators";
+import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
+import { tierMatrix } from "../billing/tierMatrix";
+
+export type ResourcePoliciesResults = {
+    resourcePolicyId: number;
+    niceId: string;
+}[];
+
+export async function updateResourcePolicies(
+    orgId: string,
+    config: Config,
+    trx: Transaction
+): Promise<ResourcePoliciesResults> {
+    const results: ResourcePoliciesResults = [];
+
+    for (const [policyNiceId, policyData] of Object.entries(
+        config["public-policies"]
+    )) {
+        const isLicensed = await isLicensedOrSubscribed(
+            orgId,
+            tierMatrix.resourcePolicies
+        );
+        if (!isLicensed) {
+            throw new Error(
+                "Your current subscription does not support shared resource policies. Please upgrade to access this feature."
+            );
+        }
+
+        // Validate rules
+        for (const rule of policyData.rules) {
+            if (rule.match === "cidr" && !isValidCIDR(rule.value)) {
+                throw new Error(
+                    `Invalid CIDR provided in resource policy '${policyNiceId}': ${rule.value}`
+                );
+            } else if (rule.match === "ip" && !isValidIP(rule.value)) {
+                throw new Error(
+                    `Invalid IP provided in resource policy '${policyNiceId}': ${rule.value}`
+                );
+            } else if (
+                rule.match === "path" &&
+                !isValidUrlGlobPattern(rule.value)
+            ) {
+                throw new Error(
+                    `Invalid URL glob pattern provided in resource policy '${policyNiceId}': ${rule.value}`
+                );
+            }
+        }
+
+        // Validate auto-login-idp if provided
+        if (policyData["auto-login-idp"]) {
+            const [provider] = await trx
+                .select()
+                .from(idp)
+                .innerJoin(idpOrg, eq(idpOrg.idpId, idp.idpId))
+                .where(
+                    and(
+                        eq(idp.idpId, policyData["auto-login-idp"]),
+                        eq(idpOrg.orgId, orgId)
+                    )
+                )
+                .limit(1);
+
+            if (!provider) {
+                throw new Error(
+                    `Identity provider not found for policy '${policyNiceId}' in this organization`
+                );
+            }
+        }
+
+        // Look up the admin role
+        const [adminRole] = await trx
+            .select()
+            .from(roles)
+            .where(and(eq(roles.isAdmin, true), eq(roles.orgId, orgId)))
+            .limit(1);
+
+        if (!adminRole) {
+            throw new Error("Admin role not found");
+        }
+
+        // Find existing policy by niceId and orgId
+        const [existingPolicy] = await trx
+            .select()
+            .from(resourcePolicies)
+            .where(
+                and(
+                    eq(resourcePolicies.niceId, policyNiceId),
+                    eq(resourcePolicies.orgId, orgId)
+                )
+            )
+            .limit(1);
+
+        let resourcePolicyId: number;
+
+        if (existingPolicy) {
+            // Update the existing policy
+            await trx
+                .update(resourcePolicies)
+                .set({
+                    name: policyData.name,
+                    sso: policyData.sso ?? true,
+                    idpId: policyData["auto-login-idp"] ?? null,
+                    emailWhitelistEnabled:
+                        policyData["email-whitelist-enabled"] ??
+                        policyData["whitelist-users"].length > 0,
+                    applyRules:
+                        policyData["apply-rules"] || policyData.rules.length > 0
+                })
+                .where(
+                    eq(
+                        resourcePolicies.resourcePolicyId,
+                        existingPolicy.resourcePolicyId
+                    )
+                );
+
+            resourcePolicyId = existingPolicy.resourcePolicyId;
+
+            // Sync password
+            await trx
+                .delete(resourcePolicyPassword)
+                .where(
+                    eq(
+                        resourcePolicyPassword.resourcePolicyId,
+                        resourcePolicyId
+                    )
+                );
+            if (policyData.password) {
+                const passwordHash = await hashPassword(policyData.password);
+                await trx.insert(resourcePolicyPassword).values({
+                    resourcePolicyId,
+                    passwordHash
+                });
+            }
+
+            // Sync pincode
+            await trx
+                .delete(resourcePolicyPincode)
+                .where(
+                    eq(resourcePolicyPincode.resourcePolicyId, resourcePolicyId)
+                );
+            if (policyData.pincode) {
+                const pincodeHash = await hashPassword(policyData.pincode);
+                await trx.insert(resourcePolicyPincode).values({
+                    resourcePolicyId,
+                    pincodeHash,
+                    digitLength: 6
+                });
+            }
+
+            // Sync header auth
+            await trx
+                .delete(resourcePolicyHeaderAuth)
+                .where(
+                    eq(
+                        resourcePolicyHeaderAuth.resourcePolicyId,
+                        resourcePolicyId
+                    )
+                );
+            if (policyData["basic-auth"]) {
+                const basicAuth = policyData["basic-auth"];
+                const headerAuthHash = await hashPassword(
+                    Buffer.from(
+                        `${basicAuth.user}:${basicAuth.password}`
+                    ).toString("base64")
+                );
+                await trx.insert(resourcePolicyHeaderAuth).values({
+                    resourcePolicyId,
+                    headerAuthHash,
+                    extendedCompatibility:
+                        basicAuth["extended-compatibility"] ?? true
+                });
+            }
+
+            // Sync SSO roles
+            await syncRolePolicies(
+                resourcePolicyId,
+                policyData["sso-roles"],
+                orgId,
+                adminRole.roleId,
+                trx
+            );
+
+            // Sync SSO users
+            await syncUserPolicies(
+                resourcePolicyId,
+                policyData["sso-users"],
+                orgId,
+                trx
+            );
+
+            // Sync whitelist users
+            await syncWhitelistPolicyUsers(
+                resourcePolicyId,
+                policyData["whitelist-users"],
+                trx
+            );
+
+            // Sync rules
+            await syncPolicyRules(resourcePolicyId, policyData.rules, trx);
+
+            logger.debug(
+                `Updated resource policy ${resourcePolicyId} (${policyNiceId})`
+            );
+        } else {
+            // Create a new policy
+            const [newPolicy] = await trx
+                .insert(resourcePolicies)
+                .values({
+                    niceId: policyNiceId,
+                    orgId,
+                    name: policyData.name,
+                    sso: policyData.sso ?? true,
+                    idpId: policyData["auto-login-idp"] ?? null,
+                    emailWhitelistEnabled:
+                        policyData["email-whitelist-enabled"] ??
+                        policyData["whitelist-users"].length > 0,
+                    applyRules:
+                        policyData["apply-rules"] ||
+                        policyData.rules.length > 0,
+                    scope: "global"
+                })
+                .returning();
+
+            resourcePolicyId = newPolicy.resourcePolicyId;
+
+            // Always add admin role
+            await trx.insert(rolePolicies).values({
+                roleId: adminRole.roleId,
+                resourcePolicyId
+            });
+
+            // Add SSO roles
+            await addRolePolicies(
+                resourcePolicyId,
+                policyData["sso-roles"],
+                orgId,
+                adminRole.roleId,
+                trx
+            );
+
+            // Add SSO users
+            await addUserPolicies(
+                resourcePolicyId,
+                policyData["sso-users"],
+                orgId,
+                trx
+            );
+
+            // Add password
+            if (policyData.password) {
+                const passwordHash = await hashPassword(policyData.password);
+                await trx.insert(resourcePolicyPassword).values({
+                    resourcePolicyId,
+                    passwordHash
+                });
+            }
+
+            // Add pincode
+            if (policyData.pincode) {
+                const pincodeHash = await hashPassword(policyData.pincode);
+                await trx.insert(resourcePolicyPincode).values({
+                    resourcePolicyId,
+                    pincodeHash,
+                    digitLength: 6
+                });
+            }
+
+            // Add header auth
+            if (policyData["basic-auth"]) {
+                const basicAuth = policyData["basic-auth"];
+                const headerAuthHash = await hashPassword(
+                    Buffer.from(
+                        `${basicAuth.user}:${basicAuth.password}`
+                    ).toString("base64")
+                );
+                await trx.insert(resourcePolicyHeaderAuth).values({
+                    resourcePolicyId,
+                    headerAuthHash,
+                    extendedCompatibility:
+                        basicAuth["extended-compatibility"] ?? true
+                });
+            }
+
+            // Add whitelist users
+            if (policyData["whitelist-users"].length > 0) {
+                await trx.insert(resourcePolicyWhiteList).values(
+                    policyData["whitelist-users"].map((email) => ({
+                        email,
+                        resourcePolicyId
+                    }))
+                );
+            }
+
+            // Add rules
+            if (policyData.rules.length > 0) {
+                await trx.insert(resourcePolicyRules).values(
+                    policyData.rules.map((rule, index) => ({
+                        resourcePolicyId,
+                        action: getRuleAction(rule.action),
+                        match: getRuleMatch(rule.match),
+                        value: rule.value,
+                        priority: rule.priority ?? index + 1,
+                        enabled: rule.enabled ?? true
+                    }))
+                );
+            }
+
+            logger.debug(
+                `Created resource policy ${resourcePolicyId} (${policyNiceId})`
+            );
+        }
+
+        results.push({ resourcePolicyId, niceId: policyNiceId });
+    }
+
+    return results;
+}
+
+function getRuleAction(input: string): "ACCEPT" | "DROP" | "PASS" {
+    if (input === "allow") return "ACCEPT";
+    if (input === "deny") return "DROP";
+    return "PASS";
+}
+
+function getRuleMatch(
+    input: string
+): "CIDR" | "IP" | "PATH" | "COUNTRY" | "COUNTRY_IS_NOT" | "ASN" | "REGION" {
+    return input.toUpperCase() as
+        | "CIDR"
+        | "IP"
+        | "PATH"
+        | "COUNTRY"
+        | "COUNTRY_IS_NOT"
+        | "ASN"
+        | "REGION";
+}
+
+async function syncRolePolicies(
+    policyId: number,
+    ssoRoles: string[],
+    orgId: string,
+    adminRoleId: number,
+    trx: Transaction
+) {
+    const existingRolePolicies = await trx
+        .select()
+        .from(rolePolicies)
+        .where(eq(rolePolicies.resourcePolicyId, policyId));
+
+    for (const roleName of ssoRoles) {
+        const [role] = await trx
+            .select()
+            .from(roles)
+            .where(and(eq(roles.name, roleName), eq(roles.orgId, orgId)))
+            .limit(1);
+
+        if (!role) {
+            logger.warn(
+                `Role '${roleName}' not found in org '${orgId}', skipping`
+            );
+            continue;
+        }
+
+        if (role.isAdmin) {
+            continue; // admin role is always included, skip
+        }
+
+        const alreadyExists = existingRolePolicies.some(
+            (rp) => rp.roleId === role.roleId
+        );
+
+        if (!alreadyExists) {
+            await trx.insert(rolePolicies).values({
+                roleId: role.roleId,
+                resourcePolicyId: policyId
+            });
+        }
+    }
+
+    // Remove roles no longer in the list (except admin)
+    for (const existingRolePolicy of existingRolePolicies) {
+        if (existingRolePolicy.roleId === adminRoleId) {
+            continue;
+        }
+
+        const [role] = await trx
+            .select()
+            .from(roles)
+            .where(eq(roles.roleId, existingRolePolicy.roleId))
+            .limit(1);
+
+        if (role?.isAdmin) {
+            continue;
+        }
+
+        if (role && !ssoRoles.includes(role.name)) {
+            await trx
+                .delete(rolePolicies)
+                .where(
+                    and(
+                        eq(rolePolicies.resourcePolicyId, policyId),
+                        eq(rolePolicies.roleId, existingRolePolicy.roleId)
+                    )
+                );
+        }
+    }
+}
+
+async function addRolePolicies(
+    policyId: number,
+    ssoRoles: string[],
+    orgId: string,
+    adminRoleId: number,
+    trx: Transaction
+) {
+    for (const roleName of ssoRoles) {
+        const [role] = await trx
+            .select()
+            .from(roles)
+            .where(and(eq(roles.name, roleName), eq(roles.orgId, orgId)))
+            .limit(1);
+
+        if (!role) {
+            logger.warn(
+                `Role '${roleName}' not found in org '${orgId}', skipping`
+            );
+            continue;
+        }
+
+        if (role.isAdmin) {
+            continue; // admin already added
+        }
+
+        await trx.insert(rolePolicies).values({
+            roleId: role.roleId,
+            resourcePolicyId: policyId
+        });
+    }
+}
+
+async function syncUserPolicies(
+    policyId: number,
+    ssoUsers: string[],
+    orgId: string,
+    trx: Transaction
+) {
+    const existingUserPolicies = await trx
+        .select()
+        .from(userPolicies)
+        .where(eq(userPolicies.resourcePolicyId, policyId));
+
+    for (const username of ssoUsers) {
+        const [user] = await trx
+            .select()
+            .from(users)
+            .innerJoin(userOrgs, eq(users.userId, userOrgs.userId))
+            .where(
+                and(
+                    or(eq(users.username, username), eq(users.email, username)),
+                    eq(userOrgs.orgId, orgId)
+                )
+            )
+            .limit(1);
+
+        if (!user) {
+            logger.warn(
+                `User '${username}' not found in org '${orgId}', skipping`
+            );
+            continue;
+        }
+
+        const alreadyExists = existingUserPolicies.some(
+            (up) => up.userId === user.user.userId
+        );
+
+        if (!alreadyExists) {
+            await trx.insert(userPolicies).values({
+                userId: user.user.userId,
+                resourcePolicyId: policyId
+            });
+        }
+    }
+
+    // Remove users no longer in the list
+    for (const existingUserPolicy of existingUserPolicies) {
+        const [user] = await trx
+            .select()
+            .from(users)
+            .innerJoin(userOrgs, eq(users.userId, userOrgs.userId))
+            .where(
+                and(
+                    eq(users.userId, existingUserPolicy.userId),
+                    eq(userOrgs.orgId, orgId)
+                )
+            )
+            .limit(1);
+
+        if (
+            user &&
+            user.user.username &&
+            !ssoUsers.includes(user.user.username) &&
+            !ssoUsers.includes(user.user.email ?? "")
+        ) {
+            await trx
+                .delete(userPolicies)
+                .where(
+                    and(
+                        eq(userPolicies.resourcePolicyId, policyId),
+                        eq(userPolicies.userId, existingUserPolicy.userId)
+                    )
+                );
+        }
+    }
+}
+
+async function addUserPolicies(
+    policyId: number,
+    ssoUsers: string[],
+    orgId: string,
+    trx: Transaction
+) {
+    for (const username of ssoUsers) {
+        const [user] = await trx
+            .select()
+            .from(users)
+            .innerJoin(userOrgs, eq(users.userId, userOrgs.userId))
+            .where(
+                and(
+                    or(eq(users.username, username), eq(users.email, username)),
+                    eq(userOrgs.orgId, orgId)
+                )
+            )
+            .limit(1);
+
+        if (!user) {
+            logger.warn(
+                `User '${username}' not found in org '${orgId}', skipping`
+            );
+            continue;
+        }
+
+        await trx.insert(userPolicies).values({
+            userId: user.user.userId,
+            resourcePolicyId: policyId
+        });
+    }
+}
+
+async function syncWhitelistPolicyUsers(
+    policyId: number,
+    whitelistUsers: string[],
+    trx: Transaction
+) {
+    const existingWhitelist = await trx
+        .select()
+        .from(resourcePolicyWhiteList)
+        .where(eq(resourcePolicyWhiteList.resourcePolicyId, policyId));
+
+    for (const email of whitelistUsers) {
+        const alreadyExists = existingWhitelist.some((w) => w.email === email);
+
+        if (!alreadyExists) {
+            await trx.insert(resourcePolicyWhiteList).values({
+                email,
+                resourcePolicyId: policyId
+            });
+        }
+    }
+
+    for (const existingEntry of existingWhitelist) {
+        if (!whitelistUsers.includes(existingEntry.email)) {
+            await trx
+                .delete(resourcePolicyWhiteList)
+                .where(
+                    and(
+                        eq(resourcePolicyWhiteList.resourcePolicyId, policyId),
+                        eq(resourcePolicyWhiteList.email, existingEntry.email)
+                    )
+                );
+        }
+    }
+}
+
+async function syncPolicyRules(
+    policyId: number,
+    rules: ResourcePolicyData["rules"],
+    trx: Transaction
+) {
+    const existingRules = await trx
+        .select()
+        .from(resourcePolicyRules)
+        .where(eq(resourcePolicyRules.resourcePolicyId, policyId))
+        .orderBy(resourcePolicyRules.priority);
+
+    for (const [index, rule] of rules.entries()) {
+        const intendedPriority = rule.priority ?? index + 1;
+        const existingRule = existingRules[index];
+
+        if (existingRule) {
+            await trx
+                .update(resourcePolicyRules)
+                .set({
+                    action: getRuleAction(rule.action),
+                    match: getRuleMatch(rule.match),
+                    value: rule.value,
+                    priority: intendedPriority,
+                    enabled: rule.enabled ?? true
+                })
+                .where(eq(resourcePolicyRules.ruleId, existingRule.ruleId));
+        } else {
+            await trx.insert(resourcePolicyRules).values({
+                resourcePolicyId: policyId,
+                action: getRuleAction(rule.action),
+                match: getRuleMatch(rule.match),
+                value: rule.value,
+                priority: intendedPriority,
+                enabled: rule.enabled ?? true
+            });
+        }
+    }
+
+    // Remove extra rules
+    if (existingRules.length > rules.length) {
+        const rulesToDelete = existingRules.slice(rules.length);
+        for (const rule of rulesToDelete) {
+            await trx
+                .delete(resourcePolicyRules)
+                .where(eq(resourcePolicyRules.ruleId, rule.ruleId));
+        }
+    }
+}

server/lib/blueprints/types.ts

@@ -1,8 +1,23 @@
 import { z } from "zod";
+import { existsSync } from "node:fs";
 import { portRangeStringSchema } from "@server/lib/ip";
 import { MaintenanceSchema } from "#dynamic/lib/blueprints/MaintenanceSchema";
 import { isValidRegionId } from "@server/db/regions";
 import { wildcardSubdomainSchema } from "@server/lib/schemas";
+import config from "@server/lib/config";
+
+const maxmindDbPath = config.getRawConfig().server.maxmind_db_path;
+const maxmindAsnPath = config.getRawConfig().server.maxmind_asn_path;
+
+const hasMaxmindCountryDb =
+    typeof maxmindDbPath === "string" &&
+    maxmindDbPath.length > 0 &&
+    existsSync(maxmindDbPath);
+
+const hasMaxmindAsnDb =
+    typeof maxmindAsnPath === "string" &&
+    maxmindAsnPath.length > 0 &&
+    existsSync(maxmindAsnPath);
 
 export const SiteSchema = z.object({
     name: z.string().min(1).max(100),
@@ -83,7 +98,8 @@ export const RuleSchema = z
         action: z.enum(["allow", "deny", "pass"]),
         match: z.enum(["cidr", "path", "ip", "country", "asn", "region"]),
         value: z.coerce.string(),
-        priority: z.int().optional()
+        priority: z.int().optional(),
+        enabled: z.boolean().optional().default(true)
     })
     .refine(
         (rule) => {
@@ -116,6 +132,9 @@ export const RuleSchema = z
     .refine(
         (rule) => {
             if (rule.match === "country") {
+                if (!hasMaxmindCountryDb) {
+                    return false;
+                }
                 // Check if it's a valid 2-letter country code or "ALL"
                 return /^[A-Z]{2}$/.test(rule.value) || rule.value === "ALL";
             }
@@ -124,12 +143,15 @@ export const RuleSchema = z
         {
             path: ["value"],
             message:
-                "Value must be a 2-letter country code or 'ALL' when match is 'country'"
+                "Country rules require a valid existing server.maxmind_db_path and value must be a 2-letter country code or 'ALL'"
         }
     )
     .refine(
         (rule) => {
             if (rule.match === "asn") {
+                if (!hasMaxmindCountryDb || !hasMaxmindAsnDb) {
+                    return false;
+                }
                 // Check if it's either AS<number> format or "ALL"
                 const asNumberPattern = /^AS\d+$/i;
                 return asNumberPattern.test(rule.value) || rule.value === "ALL";
@@ -139,7 +161,7 @@ export const RuleSchema = z
         {
             path: ["value"],
             message:
-                "Value must be 'AS<number>' format or 'ALL' when match is 'asn'"
+                "ASN rules require valid existing server.maxmind_db_path and server.maxmind_asn_path, and value must be 'AS<number>' format or 'ALL'"
         }
     )
     .refine(
@@ -267,8 +289,37 @@ export const PublicResourceSchema = z
                 return true;
             }
 
-            // If protocol/mode is http, it must have a full-domain
-            if ((resource.mode ?? resource.protocol) === "http") {
+            const effectiveProtocol = resource.mode ?? resource.protocol;
+            if (effectiveProtocol !== "ssh") {
+                return true;
+            }
+
+            const authDaemonMode = resource["auth-daemon"]?.mode;
+            if (authDaemonMode !== "native" && authDaemonMode !== "site") {
+                return true;
+            }
+
+            return (
+                resource.targets.filter((target) => target != null).length <= 1
+            );
+        },
+        {
+            path: ["targets"],
+            error: "When protocol is 'ssh' and auth-daemon mode is 'native' or 'site', only one target/site is allowed"
+        }
+    )
+    .refine(
+        (resource) => {
+            if (isTargetsOnlyResource(resource)) {
+                return true;
+            }
+
+            // If protocol/mode is http, ssh, rdp, or vnc, it must have a full-domain
+            const effectiveProtocol = resource.mode ?? resource.protocol;
+            if (
+                effectiveProtocol !== undefined &&
+                ["http", "ssh", "rdp", "vnc"].includes(effectiveProtocol)
+            ) {
                 return (
                     resource["full-domain"] !== undefined &&
                     resource["full-domain"].length > 0
@@ -278,7 +329,7 @@ export const PublicResourceSchema = z
         },
         {
             path: ["full-domain"],
-            error: "When protocol is 'http', a 'full-domain' must be provided"
+            error: "When protocol is 'http', 'ssh', 'rdp', or 'vnc', a 'full-domain' must be provided"
         }
     )
     .refine(
@@ -419,7 +470,7 @@ export const PrivateResourceSchema = z
         // proxyPort: z.int().positive().optional(),
         "destination-port": z.int().positive().optional(),
         destination: z.string().min(1).optional(),
-        // enabled: z.boolean().default(true),
+        enabled: z.boolean().default(true),
         "tcp-ports": portRangeStringSchema.optional().default("*"),
         "udp-ports": portRangeStringSchema.optional().default("*"),
         "disable-icmp": z.boolean().optional().default(false),
@@ -505,7 +556,90 @@ export const PrivateResourceSchema = z
         {
             message: "Destination must be a valid CIDR notation for cidr mode"
         }
-    );
+    )
+    .refine(
+        (data) => {
+            if (data.mode !== "ssh") {
+                return true;
+            }
+
+            const authDaemonMode = data["auth-daemon"]?.mode;
+            if (authDaemonMode !== "native" && authDaemonMode !== "site") {
+                return true;
+            }
+
+            const uniqueSites = new Set<string>();
+            if (data.site) {
+                uniqueSites.add(data.site);
+            }
+            for (const site of data.sites) {
+                uniqueSites.add(site);
+            }
+
+            return uniqueSites.size <= 1;
+        },
+        {
+            path: ["sites"],
+            message:
+                "When mode is 'ssh' and auth-daemon mode is 'native' or 'site', only one site/target is allowed"
+        }
+    )
+    .transform((data) => {
+        if (
+            data.mode === "ssh" &&
+            data.destination !== undefined &&
+            data["destination-port"] === undefined
+        ) {
+            data["destination-port"] = 22;
+        }
+        return data;
+    });
+
+export const ResourcePolicyRuleSchema = RuleSchema;
+
+export const ResourcePolicySchema = z.object({
+    name: z.string().min(1).max(255),
+    sso: z.boolean().optional().default(true),
+    "auto-login-idp": z.int().positive().optional().nullable(),
+    "sso-roles": z
+        .array(z.string())
+        .optional()
+        .default([])
+        .refine((roles) => !roles.includes("Admin"), {
+            error: "Admin role cannot be included in sso-roles"
+        }),
+    "sso-users": z.array(z.string()).optional().default([]),
+    password: z.string().min(4).max(100).optional().nullable(),
+    pincode: z
+        .string()
+        .regex(/^\d{6}$/)
+        .optional()
+        .nullable(),
+    "basic-auth": z
+        .object({
+            user: z.string().min(4).max(100),
+            password: z.string().min(4).max(100),
+            "extended-compatibility": z.boolean().default(true)
+        })
+        .optional()
+        .nullable(),
+    "email-whitelist-enabled": z.boolean().optional().default(false),
+    "whitelist-users": z
+        .array(
+            z.email().or(
+                z.string().regex(/^\*@[\w.-]+\.[a-zA-Z]{2,}$/, {
+                    error: "Invalid email address. Wildcard (*) must be the entire local part."
+                })
+            )
+        )
+        .max(50)
+        .transform((v) => v.map((e) => e.toLowerCase()))
+        .optional()
+        .default([]),
+    "apply-rules": z.boolean().optional().default(false),
+    rules: z.array(ResourcePolicyRuleSchema).optional().default([])
+});
+export type ResourcePolicyData = z.infer<typeof ResourcePolicySchema>;
 
 // Schema for the entire configuration object
 export const ConfigSchema = z
@@ -526,6 +660,10 @@ export const ConfigSchema = z
             .record(z.string(), PrivateResourceSchema)
             .optional()
             .prefault({}),
+        "public-policies": z
+            .record(z.string(), ResourcePolicySchema)
+            .optional()
+            .prefault({}),
         sites: z.record(z.string(), SiteSchema).optional().prefault({})
     })
     .transform((data) => {
@@ -556,6 +694,10 @@ export const ConfigSchema = z
                 string,
                 z.infer<typeof PrivateResourceSchema>
             >;
+            "public-policies": Record<
+                string,
+                z.infer<typeof ResourcePolicySchema>
+            >;
             sites: Record<string, z.infer<typeof SiteSchema>>;
         };
     })
@@ -695,3 +837,4 @@ export type Site = z.infer<typeof SiteSchema>;
 export type Target = z.infer<typeof TargetSchema>;
 export type Resource = z.infer<typeof PublicResourceSchema>;
 export type Config = z.infer<typeof ConfigSchema>;
+export type BlueprintResourcePolicy = z.infer<typeof ResourcePolicySchema>;

server/lib/calculateUserClientsForOrgs.ts

@@ -6,6 +6,7 @@ import {
     db,
     olms,
     orgs,
+    primaryDb,
     roleClients,
     roles,
     Transaction,
@@ -23,415 +24,427 @@ import { rebuildClientAssociationsFromClient } from "./rebuildClientAssociations
 import { OlmErrorCodes } from "@server/routers/olm/error";
 import { tierMatrix } from "./billing/tierMatrix";
 
-export async function calculateUserClientsForOrgs(
+type ClientRow = typeof clients.$inferSelect;
+
+function runQueuedClientAssociationRebuilds(
     userId: string,
-    trx: Transaction | typeof db = db
-): Promise<void> {
-    const execute = async (transaction: Transaction | typeof db) => {
-        const orgCache = new Map<string, typeof orgs.$inferSelect | null>();
-        const adminRoleCache = new Map<
-            string,
-            typeof roles.$inferSelect | null
-        >();
-        const exitNodesCache = new Map<
-            string,
-            Awaited<ReturnType<typeof listExitNodes>>
-        >();
-        const isOrgLicensedCache = new Map<string, boolean>();
-        const existingClientCache = new Map<
-            string,
-            typeof clients.$inferSelect | null
-        >();
-        const roleClientAccessCache = new Map<string, boolean>();
-        const userClientAccessCache = new Map<string, boolean>();
+    queuedClients: ClientRow[]
+) {
+    if (queuedClients.length === 0) {
+        return;
+    }
 
-        const getOrgOlmKey = (orgId: string, olmId: string) =>
-            `${orgId}:${olmId}`;
-        const getRoleClientKey = (roleId: number, clientId: number) =>
-            `${roleId}:${clientId}`;
-        const getUserClientKey = (cachedUserId: string, clientId: number) =>
-            `${cachedUserId}:${clientId}`;
+    const uniqueClientsById = new Map<number, ClientRow>();
+    for (const client of queuedClients) {
+        uniqueClientsById.set(client.clientId, client);
+    }
 
-        const getOrg = async (orgId: string) => {
-            if (orgCache.has(orgId)) {
-                return orgCache.get(orgId) ?? null;
-            }
-
-            const [org] = await transaction
-                .select()
-                .from(orgs)
-                .where(eq(orgs.orgId, orgId));
-            orgCache.set(orgId, org ?? null);
-
-            return org ?? null;
-        };
-
-        const getAdminRole = async (orgId: string) => {
-            if (adminRoleCache.has(orgId)) {
-                return adminRoleCache.get(orgId) ?? null;
-            }
-
-            const [adminRole] = await transaction
-                .select()
-                .from(roles)
-                .where(and(eq(roles.isAdmin, true), eq(roles.orgId, orgId)))
-                .limit(1);
-            adminRoleCache.set(orgId, adminRole ?? null);
-
-            return adminRole ?? null;
-        };
-
-        const getExitNodes = async (orgId: string) => {
-            if (exitNodesCache.has(orgId)) {
-                return exitNodesCache.get(orgId)!;
-            }
-
-            const exitNodes = await listExitNodes(orgId);
-            exitNodesCache.set(orgId, exitNodes);
-
-            return exitNodes;
-        };
-
-        const getIsOrgLicensed = async (orgId: string) => {
-            if (isOrgLicensedCache.has(orgId)) {
-                return isOrgLicensedCache.get(orgId)!;
-            }
-
-            const isOrgLicensed = await isLicensedOrSubscribed(
-                orgId,
-                tierMatrix.deviceApprovals
+    for (const client of uniqueClientsById.values()) {
+        rebuildClientAssociationsFromClient(client).catch((error) => {
+            logger.error(
+                `Error rebuilding client associations for client ${client.clientId} (user ${userId}): ${String(
+                    error
+                )}`
             );
-            isOrgLicensedCache.set(orgId, isOrgLicensed);
-
-            return isOrgLicensed;
-        };
-
-        const getExistingClient = async (orgId: string, olmId: string) => {
-            const key = getOrgOlmKey(orgId, olmId);
-            if (existingClientCache.has(key)) {
-                return existingClientCache.get(key) ?? null;
-            }
-
-            const [existingClient] = await transaction
-                .select()
-                .from(clients)
-                .where(
-                    and(
-                        eq(clients.userId, userId),
-                        eq(clients.orgId, orgId),
-                        eq(clients.olmId, olmId)
-                    )
-                )
-                .limit(1);
-
-            existingClientCache.set(key, existingClient ?? null);
-
-            return existingClient ?? null;
-        };
-
-        const hasRoleClientAccess = async (
-            roleId: number,
-            clientId: number
-        ) => {
-            const key = getRoleClientKey(roleId, clientId);
-            if (roleClientAccessCache.has(key)) {
-                return roleClientAccessCache.get(key)!;
-            }
-
-            const [existingRoleClient] = await transaction
-                .select()
-                .from(roleClients)
-                .where(
-                    and(
-                        eq(roleClients.roleId, roleId),
-                        eq(roleClients.clientId, clientId)
-                    )
-                )
-                .limit(1);
-
-            const hasAccess = Boolean(existingRoleClient);
-            roleClientAccessCache.set(key, hasAccess);
-
-            return hasAccess;
-        };
-
-        const hasUserClientAccess = async (
-            cachedUserId: string,
-            clientId: number
-        ) => {
-            const key = getUserClientKey(cachedUserId, clientId);
-            if (userClientAccessCache.has(key)) {
-                return userClientAccessCache.get(key)!;
-            }
-
-            const [existingUserClient] = await transaction
-                .select()
-                .from(userClients)
-                .where(
-                    and(
-                        eq(userClients.userId, cachedUserId),
-                        eq(userClients.clientId, clientId)
-                    )
-                )
-                .limit(1);
-
-            const hasAccess = Boolean(existingUserClient);
-            userClientAccessCache.set(key, hasAccess);
-
-            return hasAccess;
-        };
-
-        // Get all OLMs for this user
-        const userOlms = await transaction
-            .select()
-            .from(olms)
-            .where(eq(olms.userId, userId));
-
-        if (userOlms.length === 0) {
-            // No OLMs for this user, but we should still clean up any orphaned clients
-            await cleanupOrphanedClients(userId, transaction);
-            return;
-        }
-
-        // Get all user orgs with all roles (for org list and role-based logic)
-        const userOrgRoleRows = await transaction
-            .select()
-            .from(userOrgs)
-            .innerJoin(
-                userOrgRoles,
-                and(
-                    eq(userOrgs.userId, userOrgRoles.userId),
-                    eq(userOrgs.orgId, userOrgRoles.orgId)
-                )
-            )
-            .innerJoin(roles, eq(userOrgRoles.roleId, roles.roleId))
-            .where(eq(userOrgs.userId, userId));
-
-        const userOrgIds = [
-            ...new Set(userOrgRoleRows.map((r) => r.userOrgs.orgId))
-        ];
-        const orgIdToRoleRows = new Map<
-            string,
-            (typeof userOrgRoleRows)[0][]
-        >();
-        for (const r of userOrgRoleRows) {
-            const list = orgIdToRoleRows.get(r.userOrgs.orgId) ?? [];
-            list.push(r);
-            orgIdToRoleRows.set(r.userOrgs.orgId, list);
-        }
-        const orgRequiresDeviceApprovalRole = new Map<string, boolean>();
-        for (const [orgId, roleRowsForOrg] of orgIdToRoleRows.entries()) {
-            orgRequiresDeviceApprovalRole.set(
-                orgId,
-                roleRowsForOrg.some((r) => r.roles.requireDeviceApproval)
-            );
-        }
-
-        // For each OLM, ensure there's a client in each org the user is in
-        for (const olm of userOlms) {
-            for (const orgId of orgIdToRoleRows.keys()) {
-                const roleRowsForOrg = orgIdToRoleRows.get(orgId)!;
-                const userOrg = roleRowsForOrg[0].userOrgs;
-
-                const org = await getOrg(orgId);
-
-                if (!org) {
-                    logger.warn(
-                        `Skipping org ${orgId} for OLM ${olm.olmId} (user ${userId}): org not found`
-                    );
-                    continue;
-                }
-
-                if (!org.subnet) {
-                    logger.warn(
-                        `Skipping org ${orgId} for OLM ${olm.olmId} (user ${userId}): org has no subnet configured`
-                    );
-                    continue;
-                }
-
-                // Get admin role for this org (needed for access grants)
-                const adminRole = await getAdminRole(orgId);
-
-                if (!adminRole) {
-                    logger.warn(
-                        `Skipping org ${orgId} for OLM ${olm.olmId} (user ${userId}): no admin role found`
-                    );
-                    continue;
-                }
-
-                // Check if a client already exists for this OLM+user+org combination
-                const existingClient = await getExistingClient(
-                    orgId,
-                    olm.olmId
-                );
-
-                if (existingClient) {
-                    // Ensure admin role has access to the client
-                    const hasRoleAccess = await hasRoleClientAccess(
-                        adminRole.roleId,
-                        existingClient.clientId
-                    );
-
-                    if (!hasRoleAccess) {
-                        await transaction.insert(roleClients).values({
-                            roleId: adminRole.roleId,
-                            clientId: existingClient.clientId
-                        });
-                        roleClientAccessCache.set(
-                            getRoleClientKey(
-                                adminRole.roleId,
-                                existingClient.clientId
-                            ),
-                            true
-                        );
-                        logger.debug(
-                            `Granted admin role access to existing client ${existingClient.clientId} for OLM ${olm.olmId} in org ${orgId} (user ${userId})`
-                        );
-                    }
-
-                    // Ensure user has access to the client
-                    const hasUserAccess = await hasUserClientAccess(
-                        userId,
-                        existingClient.clientId
-                    );
-
-                    if (!hasUserAccess) {
-                        await transaction.insert(userClients).values({
-                            userId,
-                            clientId: existingClient.clientId
-                        });
-                        userClientAccessCache.set(
-                            getUserClientKey(userId, existingClient.clientId),
-                            true
-                        );
-                        logger.debug(
-                            `Granted user access to existing client ${existingClient.clientId} for OLM ${olm.olmId} in org ${orgId} (user ${userId})`
-                        );
-                    }
-
-                    logger.debug(
-                        `Client already exists for OLM ${olm.olmId} in org ${orgId} (user ${userId}), skipping creation`
-                    );
-                    continue;
-                }
-
-                // Get exit nodes for this org
-                const exitNodesList = await getExitNodes(orgId);
-
-                if (exitNodesList.length === 0) {
-                    logger.warn(
-                        `Skipping org ${orgId} for OLM ${olm.olmId} (user ${userId}): no exit nodes found`
-                    );
-                    continue;
-                }
-
-                const randomExitNode =
-                    exitNodesList[
-                        Math.floor(Math.random() * exitNodesList.length)
-                    ];
-
-                // Get next available subnet
-                const { value: newSubnet, release: releaseSubnetLock } =
-                    await getNextAvailableClientSubnet(orgId, transaction);
-
-                const subnet = newSubnet.split("/")[0];
-                const updatedSubnet = `${subnet}/${org.subnet.split("/")[1]}`;
-
-                const niceId = await getUniqueClientName(orgId);
-
-                const isOrgLicensed = await getIsOrgLicensed(userOrg.orgId);
-                const requireApproval =
-                    build !== "oss" &&
-                    isOrgLicensed &&
-                    orgRequiresDeviceApprovalRole.get(orgId) === true;
-
-                const newClientData: InferInsertModel<typeof clients> = {
-                    userId,
-                    orgId: userOrg.orgId,
-                    exitNodeId: randomExitNode.exitNodeId,
-                    name: olm.name || "User Client",
-                    subnet: updatedSubnet,
-                    olmId: olm.olmId,
-                    type: "olm",
-                    niceId,
-                    approvalState: requireApproval ? "pending" : null
-                };
-
-                // Create the client
-                const [newClient] = await transaction
-                    .insert(clients)
-                    .values(newClientData)
-                    .returning();
-                await releaseSubnetLock();
-                existingClientCache.set(
-                    getOrgOlmKey(orgId, olm.olmId),
-                    newClient
-                );
-
-                // create approval request
-                if (requireApproval) {
-                    await transaction
-                        .insert(approvals)
-                        .values({
-                            timestamp: Math.floor(new Date().getTime() / 1000),
-                            orgId: userOrg.orgId,
-                            clientId: newClient.clientId,
-                            userId,
-                            type: "user_device"
-                        })
-                        .returning();
-                }
-
-                await rebuildClientAssociationsFromClient(
-                    newClient,
-                    transaction
-                );
-
-                // Grant admin role access to the client
-                await transaction.insert(roleClients).values({
-                    roleId: adminRole.roleId,
-                    clientId: newClient.clientId
-                });
-                roleClientAccessCache.set(
-                    getRoleClientKey(adminRole.roleId, newClient.clientId),
-                    true
-                );
-
-                // Grant user access to the client
-                await transaction.insert(userClients).values({
-                    userId,
-                    clientId: newClient.clientId
-                });
-                userClientAccessCache.set(
-                    getUserClientKey(userId, newClient.clientId),
-                    true
-                );
-
-                logger.debug(
-                    `Created client for OLM ${olm.olmId} in org ${orgId} (user ${userId}) with access granted to admin role and user`
-                );
-            }
-        }
-
-        // Clean up clients in orgs the user is no longer in
-        await cleanupOrphanedClients(userId, transaction, userOrgIds);
-    };
-
-    if (trx) {
-        // Use provided transaction
-        await execute(trx);
-    } else {
-        // Create new transaction
-        await db.transaction(async (transaction) => {
-            await execute(transaction);
         });
     }
+
+    logger.debug(
+        `Queued association rebuild completed for ${uniqueClientsById.size} client(s) (user ${userId})`
+    );
+}
+
+export async function calculateUserClientsForOrgs(
+    userId: string
+): Promise<void> {
+    const trx = primaryDb;
+
+    const queuedAssociationRebuilds: ClientRow[] = [];
+    const orgCache = new Map<string, typeof orgs.$inferSelect | null>();
+    const adminRoleCache = new Map<string, typeof roles.$inferSelect | null>();
+    const exitNodesCache = new Map<
+        string,
+        Awaited<ReturnType<typeof listExitNodes>>
+    >();
+    const isOrgLicensedCache = new Map<string, boolean>();
+    const existingClientCache = new Map<
+        string,
+        typeof clients.$inferSelect | null
+    >();
+    const roleClientAccessCache = new Map<string, boolean>();
+    const userClientAccessCache = new Map<string, boolean>();
+
+    const getOrgOlmKey = (orgId: string, olmId: string) => `${orgId}:${olmId}`;
+    const getRoleClientKey = (roleId: number, clientId: number) =>
+        `${roleId}:${clientId}`;
+    const getUserClientKey = (cachedUserId: string, clientId: number) =>
+        `${cachedUserId}:${clientId}`;
+
+    const getOrg = async (orgId: string) => {
+        if (orgCache.has(orgId)) {
+            return orgCache.get(orgId) ?? null;
+        }
+
+        const [org] = await trx
+            .select()
+            .from(orgs)
+            .where(eq(orgs.orgId, orgId));
+        orgCache.set(orgId, org ?? null);
+
+        return org ?? null;
+    };
+
+    const getAdminRole = async (orgId: string) => {
+        if (adminRoleCache.has(orgId)) {
+            return adminRoleCache.get(orgId) ?? null;
+        }
+
+        const [adminRole] = await trx
+            .select()
+            .from(roles)
+            .where(and(eq(roles.isAdmin, true), eq(roles.orgId, orgId)))
+            .limit(1);
+        adminRoleCache.set(orgId, adminRole ?? null);
+
+        return adminRole ?? null;
+    };
+
+    const getExitNodes = async (orgId: string) => {
+        if (exitNodesCache.has(orgId)) {
+            return exitNodesCache.get(orgId)!;
+        }
+
+        const exitNodes = await listExitNodes(orgId);
+        exitNodesCache.set(orgId, exitNodes);
+
+        return exitNodes;
+    };
+
+    const getIsOrgLicensed = async (orgId: string) => {
+        if (isOrgLicensedCache.has(orgId)) {
+            return isOrgLicensedCache.get(orgId)!;
+        }
+
+        const isOrgLicensed = await isLicensedOrSubscribed(
+            orgId,
+            tierMatrix.deviceApprovals
+        );
+        isOrgLicensedCache.set(orgId, isOrgLicensed);
+
+        return isOrgLicensed;
+    };
+
+    const getExistingClient = async (orgId: string, olmId: string) => {
+        const key = getOrgOlmKey(orgId, olmId);
+        if (existingClientCache.has(key)) {
+            return existingClientCache.get(key) ?? null;
+        }
+
+        const [existingClient] = await trx
+            .select()
+            .from(clients)
+            .where(
+                and(
+                    eq(clients.userId, userId),
+                    eq(clients.orgId, orgId),
+                    eq(clients.olmId, olmId)
+                )
+            )
+            .limit(1);
+
+        existingClientCache.set(key, existingClient ?? null);
+
+        return existingClient ?? null;
+    };
+
+    const hasRoleClientAccess = async (roleId: number, clientId: number) => {
+        const key = getRoleClientKey(roleId, clientId);
+        if (roleClientAccessCache.has(key)) {
+            return roleClientAccessCache.get(key)!;
+        }
+
+        const [existingRoleClient] = await trx
+            .select()
+            .from(roleClients)
+            .where(
+                and(
+                    eq(roleClients.roleId, roleId),
+                    eq(roleClients.clientId, clientId)
+                )
+            )
+            .limit(1);
+
+        const hasAccess = Boolean(existingRoleClient);
+        roleClientAccessCache.set(key, hasAccess);
+
+        return hasAccess;
+    };
+
+    const hasUserClientAccess = async (
+        cachedUserId: string,
+        clientId: number
+    ) => {
+        const key = getUserClientKey(cachedUserId, clientId);
+        if (userClientAccessCache.has(key)) {
+            return userClientAccessCache.get(key)!;
+        }
+
+        const [existingUserClient] = await trx
+            .select()
+            .from(userClients)
+            .where(
+                and(
+                    eq(userClients.userId, cachedUserId),
+                    eq(userClients.clientId, clientId)
+                )
+            )
+            .limit(1);
+
+        const hasAccess = Boolean(existingUserClient);
+        userClientAccessCache.set(key, hasAccess);
+
+        return hasAccess;
+    };
+
+    // Get all OLMs for this user
+    const userOlms = await trx
+        .select()
+        .from(olms)
+        .where(eq(olms.userId, userId));
+
+    if (userOlms.length === 0) {
+        // No OLMs for this user, but we should still clean up any orphaned clients
+        await cleanupOrphanedClients(
+            userId,
+            trx,
+            [],
+            queuedAssociationRebuilds
+        );
+        return;
+    }
+
+    // Get all user orgs with all roles (for org list and role-based logic)
+    const userOrgRoleRows = await trx
+        .select()
+        .from(userOrgs)
+        .innerJoin(
+            userOrgRoles,
+            and(
+                eq(userOrgs.userId, userOrgRoles.userId),
+                eq(userOrgs.orgId, userOrgRoles.orgId)
+            )
+        )
+        .innerJoin(roles, eq(userOrgRoles.roleId, roles.roleId))
+        .where(eq(userOrgs.userId, userId));
+
+    const userOrgIds = [
+        ...new Set(userOrgRoleRows.map((r) => r.userOrgs.orgId))
+    ];
+    const orgIdToRoleRows = new Map<string, (typeof userOrgRoleRows)[0][]>();
+    for (const r of userOrgRoleRows) {
+        const list = orgIdToRoleRows.get(r.userOrgs.orgId) ?? [];
+        list.push(r);
+        orgIdToRoleRows.set(r.userOrgs.orgId, list);
+    }
+    const orgRequiresDeviceApprovalRole = new Map<string, boolean>();
+    for (const [orgId, roleRowsForOrg] of orgIdToRoleRows.entries()) {
+        orgRequiresDeviceApprovalRole.set(
+            orgId,
+            roleRowsForOrg.some((r) => r.roles.requireDeviceApproval)
+        );
+    }
+
+    // For each OLM, ensure there's a client in each org the user is in
+    for (const olm of userOlms) {
+        for (const orgId of orgIdToRoleRows.keys()) {
+            const roleRowsForOrg = orgIdToRoleRows.get(orgId)!;
+            const userOrg = roleRowsForOrg[0].userOrgs;
+
+            const org = await getOrg(orgId);
+
+            if (!org) {
+                logger.warn(
+                    `Skipping org ${orgId} for OLM ${olm.olmId} (user ${userId}): org not found`
+                );
+                continue;
+            }
+
+            if (!org.subnet) {
+                logger.warn(
+                    `Skipping org ${orgId} for OLM ${olm.olmId} (user ${userId}): org has no subnet configured`
+                );
+                continue;
+            }
+
+            // Get admin role for this org (needed for access grants)
+            const adminRole = await getAdminRole(orgId);
+
+            if (!adminRole) {
+                logger.warn(
+                    `Skipping org ${orgId} for OLM ${olm.olmId} (user ${userId}): no admin role found`
+                );
+                continue;
+            }
+
+            // Check if a client already exists for this OLM+user+org combination
+            const existingClient = await getExistingClient(orgId, olm.olmId);
+
+            if (existingClient) {
+                // Ensure admin role has access to the client
+                const hasRoleAccess = await hasRoleClientAccess(
+                    adminRole.roleId,
+                    existingClient.clientId
+                );
+
+                if (!hasRoleAccess) {
+                    await trx.insert(roleClients).values({
+                        roleId: adminRole.roleId,
+                        clientId: existingClient.clientId
+                    });
+                    roleClientAccessCache.set(
+                        getRoleClientKey(
+                            adminRole.roleId,
+                            existingClient.clientId
+                        ),
+                        true
+                    );
+                    logger.debug(
+                        `Granted admin role access to existing client ${existingClient.clientId} for OLM ${olm.olmId} in org ${orgId} (user ${userId})`
+                    );
+                }
+
+                // Ensure user has access to the client
+                const hasUserAccess = await hasUserClientAccess(
+                    userId,
+                    existingClient.clientId
+                );
+
+                if (!hasUserAccess) {
+                    await trx.insert(userClients).values({
+                        userId,
+                        clientId: existingClient.clientId
+                    });
+                    userClientAccessCache.set(
+                        getUserClientKey(userId, existingClient.clientId),
+                        true
+                    );
+                    logger.debug(
+                        `Granted user access to existing client ${existingClient.clientId} for OLM ${olm.olmId} in org ${orgId} (user ${userId})`
+                    );
+                }
+
+                logger.debug(
+                    `Client already exists for OLM ${olm.olmId} in org ${orgId} (user ${userId}), skipping creation`
+                );
+                continue;
+            }
+
+            // Get exit nodes for this org
+            const exitNodesList = await getExitNodes(orgId);
+
+            if (exitNodesList.length === 0) {
+                logger.warn(
+                    `Skipping org ${orgId} for OLM ${olm.olmId} (user ${userId}): no exit nodes found`
+                );
+                continue;
+            }
+
+            const randomExitNode =
+                exitNodesList[Math.floor(Math.random() * exitNodesList.length)];
+
+            // Get next available subnet
+            const { value: newSubnet, release: releaseSubnetLock } =
+                await getNextAvailableClientSubnet(orgId, trx);
+
+            const subnet = newSubnet.split("/")[0];
+            const updatedSubnet = `${subnet}/${org.subnet.split("/")[1]}`;
+
+            const niceId = await getUniqueClientName(orgId);
+
+            const isOrgLicensed = await getIsOrgLicensed(userOrg.orgId);
+            const requireApproval =
+                build !== "oss" &&
+                isOrgLicensed &&
+                orgRequiresDeviceApprovalRole.get(orgId) === true;
+
+            const newClientData: InferInsertModel<typeof clients> = {
+                userId,
+                orgId: userOrg.orgId,
+                exitNodeId: randomExitNode.exitNodeId,
+                name: olm.name || "User Client",
+                subnet: updatedSubnet,
+                olmId: olm.olmId,
+                type: "olm",
+                niceId,
+                approvalState: requireApproval ? "pending" : null
+            };
+
+            // Create the client
+            const [newClient] = await trx
+                .insert(clients)
+                .values(newClientData)
+                .returning();
+            await releaseSubnetLock();
+            existingClientCache.set(getOrgOlmKey(orgId, olm.olmId), newClient);
+
+            // create approval request
+            if (requireApproval) {
+                await trx
+                    .insert(approvals)
+                    .values({
+                        timestamp: Math.floor(new Date().getTime() / 1000),
+                        orgId: userOrg.orgId,
+                        clientId: newClient.clientId,
+                        userId,
+                        type: "user_device"
+                    })
+                    .returning();
+            }
+
+            queuedAssociationRebuilds.push(newClient);
+
+            // Grant admin role access to the client
+            await trx.insert(roleClients).values({
+                roleId: adminRole.roleId,
+                clientId: newClient.clientId
+            });
+            roleClientAccessCache.set(
+                getRoleClientKey(adminRole.roleId, newClient.clientId),
+                true
+            );
+
+            // Grant user access to the client
+            await trx.insert(userClients).values({
+                userId,
+                clientId: newClient.clientId
+            });
+            userClientAccessCache.set(
+                getUserClientKey(userId, newClient.clientId),
+                true
+            );
+
+            logger.debug(
+                `Created client for OLM ${olm.olmId} in org ${orgId} (user ${userId}) with access granted to admin role and user`
+            );
+        }
+    }
+
+    // Clean up clients in orgs the user is no longer in
+    await cleanupOrphanedClients(
+        userId,
+        trx,
+        userOrgIds,
+        queuedAssociationRebuilds
+    );
+
+    runQueuedClientAssociationRebuilds(userId, queuedAssociationRebuilds);
 }
 
 async function cleanupOrphanedClients(
     userId: string,
     trx: Transaction | typeof db,
-    userOrgIds: string[] = []
+    userOrgIds: string[] = [],
+    queuedAssociationRebuilds: ClientRow[] = []
 ): Promise<void> {
     // Find all OLM clients for this user that should be deleted
     // If userOrgIds is empty, delete all OLM clients (user has no orgs)
@@ -461,9 +474,9 @@ async function cleanupOrphanedClients(
             )
             .returning();
 
-        // Rebuild associations for each deleted client to clean up related data
+        // Queue deleted clients for post-trx association cleanup.
         for (const deletedClient of deletedClients) {
-            await rebuildClientAssociationsFromClient(deletedClient, trx);
+            queuedAssociationRebuilds.push(deletedClient);
 
             if (deletedClient.olmId) {
                 await sendTerminateClient(

server/lib/consts.ts

@@ -2,7 +2,7 @@ import path from "path";
 import { fileURLToPath } from "url";
 
 // This is a placeholder value replaced by the build process
-export const APP_VERSION = "1.19.0";
+export const APP_VERSION = "1.21.0";
 
 export const __FILENAME = fileURLToPath(import.meta.url);
 export const __DIRNAME = path.dirname(__FILENAME);

server/lib/dbRetry.ts

@@ -0,0 +1,83 @@
+import logger from "@server/logger";
+
+const MAX_RETRIES = 5;
+const BASE_DELAY_MS = 50;
+
+/**
+ * Detect transient errors that are safe to retry (connection drops, deadlocks,
+ * serialization failures). PostgreSQL deadlocks (40P01) are always safe to
+ * retry: the database guarantees exactly one winner per deadlock pair, so the
+ * loser just needs to try again.
+ */
+export function isTransientError(error: any): boolean {
+    if (!error) return false;
+
+    const message = (error.message || "").toLowerCase();
+    const causeMessage = (error.cause?.message || "").toLowerCase();
+    const code = error.code || error.cause?.code || "";
+
+    // Connection timeout / terminated
+    if (
+        message.includes("connection timeout") ||
+        message.includes("connection terminated") ||
+        message.includes("timeout exceeded when trying to connect") ||
+        causeMessage.includes("connection terminated unexpectedly") ||
+        causeMessage.includes("connection timeout")
+    ) {
+        return true;
+    }
+
+    // PostgreSQL deadlock detected - always safe to retry (one winner guaranteed)
+    if (code === "40P01" || message.includes("deadlock")) {
+        return true;
+    }
+
+    // PostgreSQL serialization failure
+    if (code === "40001") {
+        return true;
+    }
+
+    // ECONNRESET, ECONNREFUSED, EPIPE, ETIMEDOUT
+    if (
+        code === "ECONNRESET" ||
+        code === "ECONNREFUSED" ||
+        code === "EPIPE" ||
+        code === "ETIMEDOUT"
+    ) {
+        return true;
+    }
+
+    return false;
+}
+
+/**
+ * Simple retry wrapper with exponential backoff for transient errors
+ * (deadlocks, connection timeouts, unexpected disconnects).
+ */
+export async function withRetry<T>(
+    operation: () => Promise<T>,
+    context: string,
+    maxRetries: number = MAX_RETRIES,
+    baseDelayMs: number = BASE_DELAY_MS
+): Promise<T> {
+    let attempt = 0;
+    while (true) {
+        try {
+            return await operation();
+        } catch (error: any) {
+            if (isTransientError(error) && attempt < maxRetries) {
+                attempt++;
+                const baseDelay = Math.pow(2, attempt - 1) * baseDelayMs;
+                const jitter = Math.random() * baseDelay;
+                const delay = baseDelay + jitter;
+                logger.warn(
+                    `Transient DB error in ${context}, retrying attempt ${attempt}/${maxRetries} after ${delay.toFixed(0)}ms`,
+                    { code: error?.code ?? error?.cause?.code }
+                );
+                await new Promise((resolve) => setTimeout(resolve, delay));
+                continue;
+            }
+            throw error;
+        }
+    }
+}

server/lib/deleteOrg.ts

@@ -24,7 +24,7 @@ import { deletePeer } from "@server/routers/gerbil/peers";
 import { OlmErrorCodes } from "@server/routers/olm/error";
 import { sendTerminateClient } from "@server/routers/client/terminate";
 import { usageService } from "./billing/usageService";
-import { FeatureId } from "./billing";
+import { LimitId } from "./billing";
 
 export type DeleteOrgByIdResult = {
     deletedNewtIds: string[];
@@ -140,7 +140,9 @@ export async function deleteOrgById(
                 .select({ count: count() })
                 .from(orgDomains)
                 .where(eq(orgDomains.domainId, domainId));
-            logger.info(`Found ${orgCount.count} orgs using domain ${domainId}`);
+            logger.info(
+                `Found ${orgCount.count} orgs using domain ${domainId}`
+            );
             if (orgCount.count === 1) {
                 domainIdsToDelete.push(domainId);
             }
@@ -152,7 +154,7 @@ export async function deleteOrgById(
                 .where(inArray(domains.domainId, domainIdsToDelete));
         }
 
-        await usageService.add(orgId, FeatureId.ORGINIZATIONS, -1, trx); // here we are decreasing the org count BEFORE deleting the org because we need to still be able to get the org to get the billing org inside of here
+        await usageService.add(orgId, LimitId.ORGANIZATIONS, -1, trx); // here we are decreasing the org count BEFORE deleting the org because we need to still be able to get the org to get the billing org inside of here
 
         await trx.delete(orgs).where(eq(orgs.orgId, orgId));
 
@@ -199,22 +201,22 @@ export async function deleteOrgById(
     if (org.billingOrgId) {
         usageService.updateCount(
             org.billingOrgId,
-            FeatureId.DOMAINS,
+            LimitId.DOMAINS,
             domainCount ?? 0
         );
         usageService.updateCount(
             org.billingOrgId,
-            FeatureId.SITES,
+            LimitId.SITES,
             siteCount ?? 0
         );
         usageService.updateCount(
             org.billingOrgId,
-            FeatureId.USERS,
+            LimitId.USERS,
             userCount ?? 0
         );
         usageService.updateCount(
             org.billingOrgId,
-            FeatureId.REMOTE_EXIT_NODES,
+            LimitId.REMOTE_EXIT_NODES,
             remoteExitNodeCount ?? 0
         );
     }

server/lib/deleteResource.ts

@@ -0,0 +1,142 @@
+import { eq, inArray } from "drizzle-orm";
+import {
+    db,
+    newts,
+    resourcePolicies,
+    resources,
+    sites,
+    targetHealthCheck,
+    targets,
+    type Resource,
+    type Target,
+    type TargetHealthCheck,
+    type Transaction
+} from "@server/db";
+import logger from "@server/logger";
+import { removeTargets } from "@server/routers/newt/targets";
+
+export type DeleteResourceResult = {
+    deletedResource: Resource;
+    targetsToBeRemoved: Target[];
+    healthChecksToBeRemoved: TargetHealthCheck[];
+};
+
+export async function performDeleteResources(
+    resourceIds: number[],
+    trx: Transaction | typeof db = db
+): Promise<DeleteResourceResult[]> {
+    if (resourceIds.length === 0) {
+        return [];
+    }
+
+    const targetsToBeRemoved = await trx
+        .select()
+        .from(targets)
+        .where(inArray(targets.resourceId, resourceIds));
+
+    const targetIds = targetsToBeRemoved.map((t) => t.targetId);
+    const healthChecksToBeRemoved =
+        targetIds.length > 0
+            ? await trx
+                  .select()
+                  .from(targetHealthCheck)
+                  .where(inArray(targetHealthCheck.targetId, targetIds))
+            : [];
+
+    const deletedResources = await trx
+        .delete(resources)
+        .where(inArray(resources.resourceId, resourceIds))
+        .returning();
+
+    const policyIds = deletedResources
+        .map((resource) => resource.defaultResourcePolicyId)
+        .filter((id): id is number => id != null);
+
+    if (policyIds.length > 0) {
+        await trx
+            .delete(resourcePolicies)
+            .where(inArray(resourcePolicies.resourcePolicyId, policyIds));
+    }
+
+    if (deletedResources.length > 0) {
+        logger.debug(`Deleted ${deletedResources.length} resources`);
+    }
+
+    const targetsByResourceId = new Map<number, Target[]>();
+    for (const target of targetsToBeRemoved) {
+        const existing = targetsByResourceId.get(target.resourceId) ?? [];
+        existing.push(target);
+        targetsByResourceId.set(target.resourceId, existing);
+    }
+
+    const targetIdToResourceId = new Map(
+        targetsToBeRemoved.map((target) => [target.targetId, target.resourceId])
+    );
+
+    const healthChecksByResourceId = new Map<number, TargetHealthCheck[]>();
+    for (const healthCheck of healthChecksToBeRemoved) {
+        const resourceId = targetIdToResourceId.get(healthCheck.targetId!);
+        if (resourceId == null) {
+            continue;
+        }
+        const existing = healthChecksByResourceId.get(resourceId) ?? [];
+        existing.push(healthCheck);
+        healthChecksByResourceId.set(resourceId, existing);
+    }
+
+    return deletedResources.map((deletedResource) => ({
+        deletedResource,
+        targetsToBeRemoved:
+            targetsByResourceId.get(deletedResource.resourceId) ?? [],
+        healthChecksToBeRemoved:
+            healthChecksByResourceId.get(deletedResource.resourceId) ?? []
+    }));
+}
+
+export async function performDeleteResource(
+    resourceId: number,
+    trx: Transaction | typeof db = db
+): Promise<DeleteResourceResult | null> {
+    const [result] = await performDeleteResources([resourceId], trx);
+    return result ?? null;
+}
+
+export async function runResourceDeleteSideEffects(
+    result: DeleteResourceResult
+): Promise<void> {
+    const { deletedResource, targetsToBeRemoved, healthChecksToBeRemoved } =
+        result;
+
+    for (const target of targetsToBeRemoved) {
+        const [site] = await db
+            .select()
+            .from(sites)
+            .where(eq(sites.siteId, target.siteId))
+            .limit(1);
+
+        if (!site) {
+            logger.debug(
+                `Site with ID ${target.siteId} not found during resource delete side effects; skipping target removal`
+            );
+            continue;
+        }
+
+        if (site.pubKey && site.type === "newt") {
+            const [newt] = await db
+                .select()
+                .from(newts)
+                .where(eq(newts.siteId, site.siteId))
+                .limit(1);
+
+            if (newt) {
+                await removeTargets(
+                    newt.newtId,
+                    [],
+                    healthChecksToBeRemoved,
+                    deletedResource.mode === "udp" ? "udp" : "tcp",
+                    newt.version
+                );
+            }
+        }
+    }
+}

server/lib/deleteSiteAssociatedResources.ts

@@ -0,0 +1,205 @@
+import { and, eq, inArray, sql } from "drizzle-orm";
+import {
+    db,
+    resources,
+    siteNetworks,
+    siteResources,
+    targets,
+    type SiteResource,
+    type Transaction
+} from "@server/db";
+import {
+    performDeleteResources,
+    runResourceDeleteSideEffects,
+    type DeleteResourceResult
+} from "@server/lib/deleteResource";
+import {
+    performDeleteSiteResources,
+    runSiteResourceDeleteSideEffects
+} from "@server/lib/deleteSiteResource";
+import logger from "@server/logger";
+
+export const MAX_SITE_ASSOCIATED_RESOURCES_FOR_BULK_DELETE = 250;
+
+export type DeleteSiteAssociatedResourcesSideEffects = {
+    resources: DeleteResourceResult[];
+    siteResources: SiteResource[];
+};
+
+export async function getResourceIdsForSite(
+    siteId: number,
+    trx: Transaction | typeof db = db
+): Promise<number[]> {
+    const rows = await trx
+        .selectDistinct({ resourceId: targets.resourceId })
+        .from(targets)
+        .where(eq(targets.siteId, siteId));
+
+    return rows.map((row) => row.resourceId);
+}
+
+export async function getSiteResourceIdsForSite(
+    siteId: number,
+    orgId: string,
+    trx: Transaction | typeof db = db
+): Promise<number[]> {
+    const rows = await trx
+        .selectDistinct({ siteResourceId: siteResources.siteResourceId })
+        .from(siteNetworks)
+        .innerJoin(
+            siteResources,
+            eq(siteResources.networkId, siteNetworks.networkId)
+        )
+        .where(
+            and(eq(siteNetworks.siteId, siteId), eq(siteResources.orgId, orgId))
+        );
+
+    return rows.map((row) => row.siteResourceId);
+}
+
+export async function getAssociatedResourceCountForSite(
+    siteId: number,
+    orgId: string,
+    trx: Transaction | typeof db = db
+): Promise<number> {
+    const [publicCountResult, privateCountResult] = await Promise.all([
+        trx
+            .select({
+                count: sql<number>`count(distinct ${targets.resourceId})`
+            })
+            .from(targets)
+            .where(eq(targets.siteId, siteId)),
+        trx
+            .select({
+                count: sql<number>`count(distinct ${siteResources.siteResourceId})`
+            })
+            .from(siteNetworks)
+            .innerJoin(
+                siteResources,
+                eq(siteResources.networkId, siteNetworks.networkId)
+            )
+            .where(
+                and(
+                    eq(siteNetworks.siteId, siteId),
+                    eq(siteResources.orgId, orgId)
+                )
+            )
+    ]);
+
+    return (
+        Number(publicCountResult[0]?.count ?? 0) +
+        Number(privateCountResult[0]?.count ?? 0)
+    );
+}
+
+export function exceedsSiteAssociatedResourceDeleteLimit(
+    resourceCount: number
+): boolean {
+    return resourceCount > MAX_SITE_ASSOCIATED_RESOURCES_FOR_BULK_DELETE;
+}
+
+export async function getPendingResourceIdsForSite(
+    siteId: number,
+    trx: Transaction | typeof db = db
+): Promise<number[]> {
+    const resourceIds = await getResourceIdsForSite(siteId, trx);
+    if (resourceIds.length === 0) {
+        return [];
+    }
+
+    const rows = await trx
+        .select({ resourceId: resources.resourceId })
+        .from(resources)
+        .where(
+            and(
+                inArray(resources.resourceId, resourceIds),
+                eq(resources.status, "pending")
+            )
+        );
+
+    return rows.map((row) => row.resourceId);
+}
+
+export async function getPendingSiteResourceIdsForSite(
+    siteId: number,
+    orgId: string,
+    trx: Transaction | typeof db = db
+): Promise<number[]> {
+    const siteResourceIds = await getSiteResourceIdsForSite(siteId, orgId, trx);
+    if (siteResourceIds.length === 0) {
+        return [];
+    }
+
+    const rows = await trx
+        .select({ siteResourceId: siteResources.siteResourceId })
+        .from(siteResources)
+        .where(
+            and(
+                inArray(siteResources.siteResourceId, siteResourceIds),
+                eq(siteResources.status, "pending")
+            )
+        );
+
+    return rows.map((row) => row.siteResourceId);
+}
+
+export async function getPendingAssociatedResourceCountForSite(
+    siteId: number,
+    orgId: string,
+    trx: Transaction | typeof db = db
+): Promise<number> {
+    const [resourceIds, siteResourceIds] = await Promise.all([
+        getPendingResourceIdsForSite(siteId, trx),
+        getPendingSiteResourceIdsForSite(siteId, orgId, trx)
+    ]);
+
+    return resourceIds.length + siteResourceIds.length;
+}
+
+export async function deleteAssociatedResourcesForSite(
+    siteId: number,
+    orgId: string,
+    trx: Transaction | typeof db = db
+): Promise<DeleteSiteAssociatedResourcesSideEffects> {
+    const resourceIds = await getResourceIdsForSite(siteId, trx);
+    const siteResourceIds = await getSiteResourceIdsForSite(siteId, orgId, trx);
+
+    const [deletedResources, siteResourcesDeleted] = await Promise.all([
+        performDeleteResources(resourceIds, trx),
+        performDeleteSiteResources(siteResourceIds, trx)
+    ]);
+
+    return { resources: deletedResources, siteResources: siteResourcesDeleted };
+}
+
+export async function deletePendingAssociatedResourcesForSite(
+    siteId: number,
+    orgId: string,
+    trx: Transaction | typeof db = db
+): Promise<DeleteSiteAssociatedResourcesSideEffects> {
+    const resourceIds = await getPendingResourceIdsForSite(siteId, trx);
+    const siteResourceIds = await getPendingSiteResourceIdsForSite(
+        siteId,
+        orgId,
+        trx
+    );
+
+    const [deletedResources, siteResourcesDeleted] = await Promise.all([
+        performDeleteResources(resourceIds, trx),
+        performDeleteSiteResources(siteResourceIds, trx)
+    ]);
+
+    return { resources: deletedResources, siteResources: siteResourcesDeleted };
+}
+
+export async function runDeleteSiteAssociatedResourcesSideEffects(
+    sideEffects: DeleteSiteAssociatedResourcesSideEffects
+): Promise<void> {
+    for (const result of sideEffects.resources) {
+        await runResourceDeleteSideEffects(result);
+    }
+
+    for (const removed of sideEffects.siteResources) {
+        runSiteResourceDeleteSideEffects(removed);
+    }
+}

server/lib/deleteSiteResource.ts

@@ -0,0 +1,53 @@
+import { inArray } from "drizzle-orm";
+import {
+    db,
+    siteResources,
+    type SiteResource,
+    type Transaction
+} from "@server/db";
+import logger from "@server/logger";
+import { rebuildClientAssociationsFromSiteResource } from "@server/lib/rebuildClientAssociations";
+
+export async function performDeleteSiteResources(
+    siteResourceIds: number[],
+    trx: Transaction | typeof db = db
+): Promise<SiteResource[]> {
+    if (siteResourceIds.length === 0) {
+        return [];
+    }
+
+    const removedSiteResources = await trx
+        .delete(siteResources)
+        .where(inArray(siteResources.siteResourceId, siteResourceIds))
+        .returning();
+
+    if (removedSiteResources.length > 0) {
+        logger.debug(`Deleted ${removedSiteResources.length} site resources`);
+    }
+
+    return removedSiteResources;
+}
+
+export async function performDeleteSiteResource(
+    siteResourceId: number,
+    trx: Transaction | typeof db = db
+): Promise<SiteResource | null> {
+    const [removedSiteResource] = await performDeleteSiteResources(
+        [siteResourceId],
+        trx
+    );
+    return removedSiteResource ?? null;
+}
+
+export function runSiteResourceDeleteSideEffects(
+    removedSiteResource: SiteResource
+): void {
+    rebuildClientAssociationsFromSiteResource(removedSiteResource).catch(
+        (err) => {
+            logger.error(
+                `Error rebuilding client associations for site resource ${removedSiteResource.siteResourceId}:`,
+                err
+            );
+        }
+    );
+}

server/lib/exitNodes/exitNodes.ts

@@ -19,7 +19,11 @@ export async function verifyExitNodeOrgAccess(
 export async function listExitNodes(
     orgId: string,
     filterOnline = false,
-    noCloud = false
+    noCloud = false,
+    // Accepted for parity with the enterprise implementation (used there for
+    // site-label filtering of remote exit nodes). The OSS build has no remote
+    // exit nodes, so it is unused here.
+    siteId?: number
 ) {
     // TODO: pick which nodes to send and ping better than just all of them that are not remote
     const allExitNodes = await db

server/lib/exitNodes/subnet.ts

@@ -1,30 +1,55 @@
-import { db, exitNodes } from "@server/db";
+import { db, exitNodes, Transaction } from "@server/db";
 import config from "@server/lib/config";
 import { findNextAvailableCidr } from "@server/lib/ip";
+import { lockManager } from "#dynamic/lib/lock";
 
-export async function getNextAvailableSubnet(): Promise<string> {
-    // Get all existing subnets from routes table
-    const existingAddresses = await db
-        .select({
-            address: exitNodes.address
-        })
-        .from(exitNodes);
-
-    const addresses = existingAddresses.map((a) => a.address);
-    let subnet = findNextAvailableCidr(
-        addresses,
-        config.getRawConfig().gerbil.block_size,
-        config.getRawConfig().gerbil.subnet_group
-    );
-    if (!subnet) {
-        throw new Error("No available subnets remaining in space");
+/**
+ * Reserves the next available exit node subnet.
+ *
+ * Exit node subnets must never overlap with one another - regardless of
+ * which org(s) they belong to - since HA exit nodes can end up routing for
+ * the same org. This acquires a lock that the caller MUST release (via the
+ * returned `release`) only after the chosen address has been durably
+ * persisted (e.g. after the enclosing transaction commits), otherwise
+ * concurrent callers can race and pick the same subnet.
+ */
+export async function getNextAvailableSubnet(
+    trx: Transaction | typeof db = db
+): Promise<{ value: string; release: () => Promise<void> }> {
+    const lockKey = "exit-node-subnet-allocation";
+    const acquired = await lockManager.acquireLockWithRetry(lockKey, 6000);
+    if (!acquired) {
+        throw new Error(`Failed to acquire lock: ${lockKey}`);
     }
+    const release = () => lockManager.releaseLock(lockKey, acquired);
 
-    // replace the last octet with 1
-    subnet =
-        subnet.split(".").slice(0, 3).join(".") +
-        ".1" +
-        "/" +
-        subnet.split("/")[1];
-    return subnet;
+    try {
+        // Get all existing subnets from routes table
+        const existingAddresses = await trx
+            .select({
+                address: exitNodes.address
+            })
+            .from(exitNodes);
+
+        const addresses = existingAddresses.map((a) => a.address);
+        let subnet = findNextAvailableCidr(
+            addresses,
+            config.getRawConfig().gerbil.block_size,
+            config.getRawConfig().gerbil.subnet_group
+        );
+        if (!subnet) {
+            throw new Error("No available subnets remaining in space");
+        }
+
+        // replace the last octet with 1
+        subnet =
+            subnet.split(".").slice(0, 3).join(".") +
+            ".1" +
+            "/" +
+            subnet.split("/")[1];
+        return { value: subnet, release };
+    } catch (e) {
+        await release();
+        throw e;
+    }
 }

server/lib/ip.ts

@@ -333,7 +333,7 @@ export async function getNextAvailableClientSubnet(
     if (!acquired) {
         throw new Error(`Failed to acquire lock: ${lockKey}`);
     }
-    const release = () => lockManager.releaseLock(lockKey);
+    const release = () => lockManager.releaseLock(lockKey, acquired);
 
     try {
         const [org] = await transaction
@@ -395,7 +395,7 @@ export async function getNextAvailableAliasAddress(
     if (!acquired) {
         throw new Error(`Failed to acquire lock: ${lockKey}`);
     }
-    const release = () => lockManager.releaseLock(lockKey);
+    const release = () => lockManager.releaseLock(lockKey, acquired);
 
     try {
         const [org] = await trx
@@ -463,7 +463,7 @@ export async function getNextAvailableOrgSubnet(): Promise<{
     if (!acquired) {
         throw new Error(`Failed to acquire lock: ${lockKey}`);
     }
-    const release = () => lockManager.releaseLock(lockKey);
+    const release = () => lockManager.releaseLock(lockKey, acquired);
 
     try {
         const existingAddresses = await db
@@ -496,6 +496,7 @@ export function generateRemoteSubnets(
 ): string[] {
     const remoteSubnets = allSiteResources
         .filter((sr) => {
+            if (!sr.enabled) return false;
             if (!sr.destination) return false;
 
             if (sr.mode === "cidr") {
@@ -504,7 +505,7 @@ export function generateRemoteSubnets(
                 const parseResult = cidrSchema.safeParse(sr.destination);
                 return parseResult.success;
             }
-            if (sr.mode === "host") {
+            if (sr.mode === "host" || sr.mode === "ssh") {
                 // check if its a valid IP using zod
                 const ipSchema = z.union([z.ipv4(), z.ipv6()]);
                 const parseResult = ipSchema.safeParse(sr.destination);
@@ -514,7 +515,7 @@ export function generateRemoteSubnets(
         })
         .map((sr) => {
             if (sr.mode === "cidr") return sr.destination;
-            if (sr.mode === "host") {
+            if (sr.mode === "host" || sr.mode === "ssh") {
                 return `${sr.destination}/32`;
             }
             return ""; // This should never be reached due to filtering, but satisfies TypeScript
@@ -530,8 +531,9 @@ export function generateAliasConfig(allSiteResources: SiteResource[]): Alias[] {
     return allSiteResources
         .filter(
             (sr) =>
+                sr.enabled &&
                 sr.aliasAddress &&
-                ((sr.alias && sr.mode == "host") ||
+                ((sr.alias && (sr.mode == "host" || sr.mode == "ssh")) ||
                     (sr.fullDomain && sr.mode == "http"))
         )
         .map((sr) => ({
@@ -577,6 +579,10 @@ export function generateSubnetProxyTargets(
             continue;
         }
 
+        if (!siteResource.destination) {
+            continue;
+        }
+
         const clientPrefix = `${clientSite.subnet.split("/")[0]}/32`;
         const portRange = [
             ...parsePortRangeString(siteResource.tcpPortRangeString, "tcp"),
@@ -584,7 +590,7 @@ export function generateSubnetProxyTargets(
         ];
         const disableIcmp = siteResource.disableIcmp ?? false;
 
-        if (siteResource.mode == "host") {
+        if (siteResource.mode == "host" || siteResource.mode == "ssh") {
             let destination = siteResource.destination;
             // check if this is a valid ip
             const ipSchema = z.union([z.ipv4(), z.ipv6()]);
@@ -658,6 +664,13 @@ export async function generateSubnetProxyTargetV2(
         subnet: string | null;
     }[]
 ): Promise<SubnetProxyTargetV2[] | undefined> {
+    if (!siteResource.enabled) {
+        logger.debug(
+            `Site resource ${siteResource.siteResourceId} is disabled, skipping target generation.`
+        );
+        return;
+    }
+
     if (clients.length === 0) {
         logger.debug(
             `No clients have access to site resource ${siteResource.siteResourceId}, skipping target generation.`
@@ -665,7 +678,12 @@ export async function generateSubnetProxyTargetV2(
         return;
     }
 
-    let targets: SubnetProxyTargetV2[] = [];
+    if (!siteResource.destination) {
+        // ssh can have no destination
+        return;
+    }
+
+    const targets: SubnetProxyTargetV2[] = [];
 
     const portRange = [
         ...parsePortRangeString(siteResource.tcpPortRangeString, "tcp"),
@@ -673,7 +691,7 @@ export async function generateSubnetProxyTargetV2(
     ];
     const disableIcmp = siteResource.disableIcmp ?? false;
 
-    if (siteResource.mode == "host") {
+    if (siteResource.mode == "host" || siteResource.mode == "ssh") {
         let destination = siteResource.destination;
         // check if this is a valid ip
         const ipSchema = z.union([z.ipv4(), z.ipv6()]);

server/lib/lock.ts

@@ -1,28 +1,87 @@
+import { randomUUID } from "crypto";
+
+const instanceId = `local-${Math.random().toString(36).slice(2)}-${Date.now()}`;
+
+type LocalLockRecord = {
+    owner: string;
+    expiresAt: number;
+};
+
+const localLocks = new Map<string, LocalLockRecord>();
+
 export class LockManager {
-    /**
-     * Acquire a distributed lock using Redis SET with NX and PX options
-     * @param lockKey - Unique identifier for the lock
-     * @param ttlMs - Time to live in milliseconds
-     * @returns Promise<boolean> - true if lock acquired, false otherwise
-     */
-    async acquireLock(
-        lockKey: string,
-        ttlMs: number = 30000
-    ): Promise<boolean> {
-        return true;
+    private clearExpiredLocalLock(lockKey: string): void {
+        const current = localLocks.get(lockKey);
+        if (current && current.expiresAt <= Date.now()) {
+            localLocks.delete(lockKey);
+        }
     }
 
     /**
-     * Release a lock using Lua script to ensure atomicity
+     * Acquire a local in-process lock using an optimistic Map-based check.
      * @param lockKey - Unique identifier for the lock
+     * @param ttlMs - Time to live in milliseconds
+     * @returns Promise<string | null> - a token identifying this specific acquisition
+     *          (truthy) on success, or null if the lock could not be acquired.
      */
-    async releaseLock(lockKey: string): Promise<void> {}
+    async acquireLock(
+        lockKey: string,
+        ttlMs: number = 30000,
+        maxRetries: number = 3,
+        retryDelayMs: number = 100
+    ): Promise<string | null> {
+        for (let attempt = 0; attempt < maxRetries; attempt++) {
+            this.clearExpiredLocalLock(lockKey);
+
+            const existing = localLocks.get(lockKey);
+            if (!existing) {
+                const token = `${instanceId}:${randomUUID()}`;
+                localLocks.set(lockKey, {
+                    owner: token,
+                    expiresAt: Date.now() + ttlMs
+                });
+                return token;
+            }
+
+            // The lock is currently held -- possibly by a different, unrelated
+            // caller in this same process. We intentionally do NOT treat
+            // same-process holders as automatically reentrant here: two
+            // independent logical operations (e.g. two different API requests)
+            // running concurrently in the same process must not both believe
+            // they hold the lock, or their writes under it can interleave
+            // unguarded. Just retry with backoff like any other contended lock.
+            if (attempt < maxRetries - 1) {
+                const delay = retryDelayMs * Math.pow(2, attempt);
+                await new Promise((resolve) => setTimeout(resolve, delay));
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * Release a lock previously acquired via acquireLock/acquireLockWithRetry.
+     * @param lockKey - Unique identifier for the lock
+     * @param token - the exact token returned by the acquisition being released.
+     *   Required so a caller whose TTL already expired can't delete a
+     *   different, currently-active holder's lock.
+     */
+    async releaseLock(lockKey: string, token: string): Promise<void> {
+        this.clearExpiredLocalLock(lockKey);
+        const existing = localLocks.get(lockKey);
+
+        if (existing && existing.owner === token) {
+            localLocks.delete(lockKey);
+        }
+    }
 
     /**
      * Force release a lock regardless of owner (use with caution)
      * @param lockKey - Unique identifier for the lock
      */
-    async forceReleaseLock(lockKey: string): Promise<void> {}
+    async forceReleaseLock(lockKey: string): Promise<void> {
+        localLocks.delete(lockKey);
+    }
 
     /**
      * Check if a lock exists and get its info
@@ -35,16 +94,44 @@ export class LockManager {
         ttl: number;
         owner?: string;
     }> {
-        return { exists: true, ownedByMe: true, ttl: 0 };
+        this.clearExpiredLocalLock(lockKey);
+        const existing = localLocks.get(lockKey);
+
+        if (!existing) {
+            return { exists: false, ownedByMe: false, ttl: 0 };
+        }
+
+        const ttl = Math.max(0, existing.expiresAt - Date.now());
+        return {
+            exists: true,
+            ownedByMe: existing.owner.startsWith(`${instanceId}:`),
+            ttl,
+            owner: existing.owner.split(":")[0]
+        };
     }
 
     /**
-     * Extend the TTL of an existing lock owned by this worker
+     * Extend the TTL of an existing lock, provided the token matches the
+     * acquisition currently holding it.
      * @param lockKey - Unique identifier for the lock
      * @param ttlMs - New TTL in milliseconds
+     * @param token - the token returned by the acquisition being extended
      * @returns Promise<boolean> - true if extended successfully
      */
-    async extendLock(lockKey: string, ttlMs: number): Promise<boolean> {
+    async extendLock(
+        lockKey: string,
+        ttlMs: number,
+        token: string
+    ): Promise<boolean> {
+        this.clearExpiredLocalLock(lockKey);
+        const existing = localLocks.get(lockKey);
+
+        if (!existing || existing.owner !== token) {
+            return false;
+        }
+
+        existing.expiresAt = Date.now() + ttlMs;
+        localLocks.set(lockKey, existing);
         return true;
     }
 
@@ -54,15 +141,34 @@ export class LockManager {
      * @param ttlMs - Time to live in milliseconds
      * @param maxRetries - Maximum number of retry attempts
      * @param baseDelayMs - Base delay between retries in milliseconds
-     * @returns Promise<boolean> - true if lock acquired
+     * @returns Promise<string | null> - token if acquired, null otherwise
      */
     async acquireLockWithRetry(
         lockKey: string,
         ttlMs: number = 30000,
         maxRetries: number = 5,
         baseDelayMs: number = 100
-    ): Promise<boolean> {
-        return true;
+    ): Promise<string | null> {
+        for (let attempt = 0; attempt <= maxRetries; attempt++) {
+            const acquired = await this.acquireLock(
+                lockKey,
+                ttlMs,
+                1,
+                baseDelayMs
+            );
+
+            if (acquired) {
+                return acquired;
+            }
+
+            if (attempt < maxRetries) {
+                const delay =
+                    baseDelayMs * Math.pow(2, attempt) + Math.random() * 100;
+                await new Promise((resolve) => setTimeout(resolve, delay));
+            }
+        }
+
+        return null;
     }
 
     /**
@@ -77,16 +183,16 @@ export class LockManager {
         fn: () => Promise<T>,
         ttlMs: number = 30000
     ): Promise<T> {
-        const acquired = await this.acquireLock(lockKey, ttlMs);
+        const token = await this.acquireLock(lockKey, ttlMs);
 
-        if (!acquired) {
+        if (!token) {
             throw new Error(`Failed to acquire lock: ${lockKey}`);
         }
 
         try {
             return await fn();
         } finally {
-            await this.releaseLock(lockKey);
+            await this.releaseLock(lockKey, token);
         }
     }
 
@@ -99,7 +205,21 @@ export class LockManager {
         activeLocksCount: number;
         locksOwnedByMe: number;
     }> {
-        return { activeLocksCount: 0, locksOwnedByMe: 0 };
+        const now = Date.now();
+        for (const [key, value] of localLocks.entries()) {
+            if (value.expiresAt <= now) {
+                localLocks.delete(key);
+            }
+        }
+
+        let locksOwnedByMe = 0;
+        for (const value of localLocks.values()) {
+            if (value.owner.startsWith(`${instanceId}:`)) {
+                locksOwnedByMe++;
+            }
+        }
+
+        return { activeLocksCount: localLocks.size, locksOwnedByMe };
     }
 
     /**

server/lib/orgRebuildCounter.ts

@@ -0,0 +1,24 @@
+export const ORG_REBUILD_CONCURRENCY_LIMIT = 10;
+
+const orgActiveRebuilds = new Map<string, number>();
+
+export async function incrementOrgRebuildCount(orgId: string): Promise<void> {
+    orgActiveRebuilds.set(orgId, (orgActiveRebuilds.get(orgId) ?? 0) + 1);
+}
+
+export async function decrementOrgRebuildCount(orgId: string): Promise<void> {
+    const current = orgActiveRebuilds.get(orgId) ?? 0;
+    if (current <= 1) {
+        orgActiveRebuilds.delete(orgId);
+    } else {
+        orgActiveRebuilds.set(orgId, current - 1);
+    }
+}
+
+export async function getOrgActiveRebuildCount(orgId: string): Promise<number> {
+    return orgActiveRebuilds.get(orgId) ?? 0;
+}
+
+export async function checkOrgRebuildRateLimit(orgId: string): Promise<boolean> {
+    return (orgActiveRebuilds.get(orgId) ?? 0) >= ORG_REBUILD_CONCURRENCY_LIMIT;
+}

server/lib/pathMatch.ts

@@ -0,0 +1,74 @@
+const MAX_RECURSION_DEPTH = 100;
+
+const segmentRegexCache = new Map<string, RegExp>();
+
+function getSegmentRegex(patternPart: string): RegExp {
+    let regex = segmentRegexCache.get(patternPart);
+    if (!regex) {
+        const regexPattern = patternPart
+            .replace(/[.+^${}()|[\]\\]/g, "\\$&")
+            .replace(/\*/g, ".*")
+            .replace(/\?/g, ".");
+        regex = new RegExp(`^${regexPattern}$`);
+        segmentRegexCache.set(patternPart, regex);
+    }
+    return regex;
+}
+
+export function isPathAllowed(pattern: string, path: string): boolean {
+    const normalize = (p: string) => p.split("/").filter(Boolean);
+    const patternParts = normalize(pattern);
+    const pathParts = normalize(path);
+
+    function matchSegments(
+        patternIndex: number,
+        pathIndex: number,
+        depth: number = 0
+    ): boolean {
+        if (depth > MAX_RECURSION_DEPTH) {
+            return false;
+        }
+
+        const currentPatternPart = patternParts[patternIndex];
+        const currentPathPart = pathParts[pathIndex];
+
+        if (patternIndex >= patternParts.length) {
+            return pathIndex >= pathParts.length;
+        }
+
+        if (pathIndex >= pathParts.length) {
+            return patternParts.slice(patternIndex).every((p) => p === "*");
+        }
+
+        if (currentPatternPart === "*") {
+            if (matchSegments(patternIndex + 1, pathIndex, depth + 1)) {
+                return true;
+            }
+            if (matchSegments(patternIndex, pathIndex + 1, depth + 1)) {
+                return true;
+            }
+            return false;
+        }
+
+        if (currentPatternPart.includes("*")) {
+            const regex = getSegmentRegex(currentPatternPart);
+
+            if (regex.test(currentPathPart)) {
+                return matchSegments(
+                    patternIndex + 1,
+                    pathIndex + 1,
+                    depth + 1
+                );
+            }
+            return false;
+        }
+
+        if (currentPatternPart !== currentPathPart) {
+            return false;
+        }
+
+        return matchSegments(patternIndex + 1, pathIndex + 1, depth + 1);
+    }
+
+    return matchSegments(0, 0, 0);
+}

server/lib/readConfigFile.ts

@@ -184,7 +184,8 @@ export const configSchema = z
                             .number()
                             .positive()
                             .optional()
-                            .default(5000)
+                            .default(5000),
+                        jit_mode: z.boolean().default(true)
                     })
                     .optional()
                     .prefault({})

server/lib/rebuildQueue.ts

@@ -0,0 +1,148 @@
+import logger from "@server/logger";
+import { isTransientError } from "@server/lib/dbRetry";
+
+export type RebuildJobType = "site-resource" | "client";
+
+export interface RebuildJob {
+    type: RebuildJobType;
+    id: number;
+    // Number of times this job has already been re-queued after a transient
+    // failure. Absent/0 means it has not failed yet.
+    attempt?: number;
+}
+
+export interface RebuildJobHandlers {
+    onSiteResource(siteResourceId: number): Promise<void>;
+    onClient(clientId: number): Promise<void>;
+}
+
+export interface RebuildQueueManager {
+    enqueue(job: RebuildJob): Promise<void>;
+    startProcessing(handlers: RebuildJobHandlers): void;
+    isQueued(job: RebuildJob): Promise<boolean>;
+}
+
+// In-process FIFO used when there is no Redis to back a distributed queue
+// (OSS build, or Redis unavailable). A job that loses the per-resource
+// rebuild lock race lands here instead of being silently dropped, and gets
+// retried shortly after against fresh DB state.
+const POLL_INTERVAL_MS = 500;
+const BATCH_SIZE = 5;
+// A job that fails with a transient DB error gets re-queued with backoff
+// instead of being dropped, up to this many times.
+const MAX_JOB_ATTEMPTS = 5;
+const JOB_RETRY_BASE_DELAY_MS = 1000;
+
+function dedupeKey(job: RebuildJob): string {
+    return `${job.type}:${job.id}`;
+}
+
+class InMemoryRebuildQueue implements RebuildQueueManager {
+    private queue: RebuildJob[] = [];
+    private queuedSet = new Set<string>();
+    private processing = false;
+    private processingStarted = false;
+    private handlers: RebuildJobHandlers | null = null;
+
+    async isQueued(job: RebuildJob): Promise<boolean> {
+        return this.queuedSet.has(dedupeKey(job));
+    }
+
+    async enqueue(job: RebuildJob): Promise<void> {
+        const key = dedupeKey(job);
+        if (this.queuedSet.has(key)) {
+            logger.debug(
+                `Rebuild queue: skipped duplicate queued job ${job.type}:${job.id}`
+            );
+            return;
+        }
+        this.queuedSet.add(key);
+        this.queue.push(job);
+        logger.debug(
+            `Rebuild queue: enqueued ${job.type}:${job.id} (queue position: tail)`
+        );
+    }
+
+    startProcessing(handlers: RebuildJobHandlers): void {
+        if (this.processingStarted) return;
+        this.processingStarted = true;
+        this.handlers = handlers;
+
+        setInterval(() => {
+            this.tryProcessBatch().catch((err) => {
+                logger.error(
+                    "Rebuild queue: unhandled error in process loop:",
+                    err
+                );
+            });
+        }, POLL_INTERVAL_MS);
+
+        logger.info("Rebuild queue processor started (in-memory)");
+    }
+
+    private async tryProcessBatch(): Promise<void> {
+        if (this.processing || !this.handlers || this.queue.length === 0) {
+            return;
+        }
+
+        this.processing = true;
+        try {
+            for (let i = 0; i < BATCH_SIZE; i++) {
+                const job = this.queue.shift();
+                if (!job) break; // queue drained
+
+                // Remove from the dedupe set once dequeued so the same job
+                // can be re-queued while this one is in progress.
+                this.queuedSet.delete(dedupeKey(job));
+
+                logger.debug(
+                    `Rebuild queue: processing ${job.type}:${job.id}`
+                );
+
+                try {
+                    if (job.type === "site-resource") {
+                        await this.handlers.onSiteResource(job.id);
+                    } else if (job.type === "client") {
+                        await this.handlers.onClient(job.id);
+                    } else {
+                        logger.warn(
+                            `Rebuild queue: unknown job type "${(job as any).type}", discarding`
+                        );
+                    }
+
+                    logger.debug(
+                        `Rebuild queue: completed ${job.type}:${job.id}`
+                    );
+                } catch (err) {
+                    const attempt = (job.attempt ?? 0) + 1;
+                    if (isTransientError(err) && attempt <= MAX_JOB_ATTEMPTS) {
+                        const delay =
+                            JOB_RETRY_BASE_DELAY_MS * Math.pow(2, attempt - 1);
+                        logger.warn(
+                            `Rebuild queue: job ${job.type}:${job.id} hit a transient error (attempt ${attempt}/${MAX_JOB_ATTEMPTS}), re-queuing in ${delay}ms:`,
+                            err
+                        );
+                        setTimeout(() => {
+                            this.enqueue({ ...job, attempt }).catch(
+                                (enqueueErr) =>
+                                    logger.error(
+                                        `Rebuild queue: failed to re-queue ${job.type}:${job.id} after transient error:`,
+                                        enqueueErr
+                                    )
+                            );
+                        }, delay);
+                    } else {
+                        logger.error(
+                            `Rebuild queue: job ${job.type}:${job.id} threw an error:`,
+                            err
+                        );
+                    }
+                }
+            }
+        } finally {
+            this.processing = false;
+        }
+    }
+}
+
+export const rebuildQueue: RebuildQueueManager = new InMemoryRebuildQueue();

server/lib/statusHistory.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { db, logsDb, statusHistory } from "@server/db";
-import { and, eq, gte, asc } from "drizzle-orm";
+import { and, eq, gte, lt, asc, desc } from "drizzle-orm";
 import { regionalCache as cache } from "#dynamic/lib/cache";
 
 const STATUS_HISTORY_CACHE_TTL = 60; // seconds
@@ -8,26 +8,42 @@ const STATUS_HISTORY_CACHE_TTL = 60; // seconds
 function statusHistoryCacheKey(
     entityType: string,
     entityId: number,
-    days: number
+    days: number,
+    tzOffsetMinutes: number
 ): string {
-    return `statusHistory:${entityType}:${entityId}:${days}`;
+    return `statusHistory:${entityType}:${entityId}:${days}:${tzOffsetMinutes}`;
+}
+
+// Returns the epoch seconds of the most recent local-calendar-day midnight,
+// where "local" is defined by tzOffsetMinutes (minutes to ADD to UTC to get
+// local time, e.g. Australia/Sydney standard time is 600). Defaults to 0
+// (UTC) so callers that don't pass a timezone keep the original behavior.
+function localMidnightSec(tzOffsetMinutes: number): number {
+    const localNow = new Date(Date.now() + tzOffsetMinutes * 60_000);
+    localNow.setUTCHours(0, 0, 0, 0);
+    return Math.floor(localNow.getTime() / 1000) - tzOffsetMinutes * 60;
 }
 
 export async function getCachedStatusHistory(
     entityType: string,
     entityId: number,
-    days: number
+    days: number,
+    tzOffsetMinutes: number = 0
 ): Promise<StatusHistoryResponse> {
-    const cacheKey = statusHistoryCacheKey(entityType, entityId, days);
+    const cacheKey = statusHistoryCacheKey(
+        entityType,
+        entityId,
+        days,
+        tzOffsetMinutes
+    );
     const cached = await cache.get<StatusHistoryResponse>(cacheKey);
     if (cached !== undefined) {
         return cached;
     }
 
-    // Anchor to UTC midnight so the query window aligns with stable calendar days
-    const utcToday = new Date();
-    utcToday.setUTCHours(0, 0, 0, 0);
-    const todayMidnightSec = Math.floor(utcToday.getTime() / 1000);
+    // Anchor to local midnight (UTC when tzOffsetMinutes is 0) so the query
+    // window aligns with stable calendar days for the requesting client
+    const todayMidnightSec = localMidnightSec(tzOffsetMinutes);
     const startSec = todayMidnightSec - days * 86400;
 
     const events = await logsDb
@@ -42,7 +58,30 @@ export async function getCachedStatusHistory(
         )
         .orderBy(asc(statusHistory.timestamp));
 
-    const { buckets, totalDowntime } = computeBuckets(events, days);
+    // Fetch the last known state before the window so that entities that
+    // haven't changed status recently still show the correct status rather
+    // than appearing as "no_data".
+    const [lastKnownEvent] = await logsDb
+        .select()
+        .from(statusHistory)
+        .where(
+            and(
+                eq(statusHistory.entityType, entityType),
+                eq(statusHistory.entityId, entityId),
+                lt(statusHistory.timestamp, startSec)
+            )
+        )
+        .orderBy(desc(statusHistory.timestamp))
+        .limit(1);
+
+    const priorStatus = lastKnownEvent?.status ?? null;
+
+    const { buckets, totalDowntime } = computeBuckets(
+        events,
+        days,
+        priorStatus,
+        tzOffsetMinutes
+    );
     const totalWindow = days * 86400;
     const overallUptime =
         totalWindow > 0
@@ -77,11 +116,19 @@ export const statusHistoryQuerySchema = z
         days: z
             .string()
             .optional()
-            .transform((v) => (v ? parseInt(v, 10) : 90))
+            .transform((v) => (v ? parseInt(v, 10) : 90)),
+        // Minutes to add to UTC to get the requesting client's local time
+        // (e.g. Australia/Sydney standard time is 600). Optional and
+        // defaults to 0 (UTC) so older clients keep the prior behavior.
+        tzOffsetMinutes: z
+            .string()
+            .optional()
+            .transform((v) => (v ? parseInt(v, 10) : 0))
     })
     .pipe(
         z.object({
-            days: z.number().int().min(1).max(365)
+            days: z.number().int().min(1).max(365),
+            tzOffsetMinutes: z.number().int().min(-720).max(840)
         })
     );
 
@@ -110,15 +157,16 @@ export function computeBuckets(
         timestamp: number;
         id: number;
     }[],
-    days: number
+    days: number,
+    priorStatus: string | null = null,
+    tzOffsetMinutes: number = 0
 ): { buckets: StatusHistoryDayBucket[]; totalDowntime: number } {
     const nowSec = Math.floor(Date.now() / 1000);
 
-    // Anchor bucket boundaries to UTC midnight so dates are stable calendar days
-    // and don't drift as the cache expires and is recomputed
-    const utcToday = new Date();
-    utcToday.setUTCHours(0, 0, 0, 0);
-    const todayMidnightSec = Math.floor(utcToday.getTime() / 1000);
+    // Anchor bucket boundaries to local midnight (UTC when tzOffsetMinutes is
+    // 0) so dates are stable calendar days for the requesting client and
+    // don't drift as the cache expires and is recomputed
+    const todayMidnightSec = localMidnightSec(tzOffsetMinutes);
 
     const buckets: StatusHistoryDayBucket[] = [];
     let totalDowntime = 0;
@@ -136,7 +184,10 @@ export function computeBuckets(
             .filter((e) => e.timestamp < dayStartSec)
             .at(-1);
 
-        const currentStatus = lastBeforeDay?.status ?? null;
+        // Fall back to the last known state before the entire query window
+        // so that entities that haven't generated events recently still show
+        // as their actual status rather than "no_data".
+        const currentStatus = lastBeforeDay?.status ?? priorStatus ?? null;
 
         const windows: { start: number; end: number | null; status: string }[] =
             [];
@@ -211,7 +262,13 @@ export function computeBuckets(
                   )
                 : 100;
 
-        const dateStr = new Date(dayStartSec * 1000).toISOString().slice(0, 10);
+        // Shift by the client's offset before formatting so the label reflects
+        // their local calendar date rather than the UTC date of dayStartSec
+        const dateStr = new Date(
+            (dayStartSec + tzOffsetMinutes * 60) * 1000
+        )
+            .toISOString()
+            .slice(0, 10);
 
         const hasAnyData = currentStatus !== null || dayEvents.length > 0;
 

server/lib/telemetry.ts

@@ -181,6 +181,7 @@ class TelemetryClient {
             let numPrivResourceHosts = 0;
             let numPrivResourceCidr = 0;
             let numPrivResourceHttp = 0;
+            let numPrivResourceSsh = 0;
             for (const res of allPrivateResources) {
                 if (res.mode === "host") {
                     numPrivResourceHosts += 1;
@@ -188,6 +189,8 @@ class TelemetryClient {
                     numPrivResourceCidr += 1;
                 } else if (res.mode === "http") {
                     numPrivResourceHttp += 1;
+                } else if (res.mode === "ssh") {
+                    numPrivResourceSsh += 1;
                 }
 
                 if (res.alias) {
@@ -207,6 +210,7 @@ class TelemetryClient {
                 numPrivateResourceHosts: numPrivResourceHosts,
                 numPrivateResourceCidr: numPrivResourceCidr,
                 numPrivateResourceHttp: numPrivResourceHttp,
+                numPrivateResourceSsh: numPrivResourceSsh,
                 numAlertRules: numAlertRules.count,
                 numUserDevices: userDevicesCount.count,
                 numMachineClients: machineClients.count,

server/lib/traefik/TraefikConfigManager.ts

@@ -511,6 +511,12 @@ export class TraefikConfigManager {
         let traefikConfig;
         try {
             const currentExitNode = await getCurrentExitNodeId();
+
+            const maintenancePort = config.getRawConfig().server.next_port;
+            const maintenanceHost =
+                config.getRawConfig().server.internal_hostname;
+            const pangolinUIUrl = `http://${maintenanceHost}:${maintenancePort}`;
+
             // logger.debug(`Fetching traefik config for exit node: ${currentExitNode}`);
             traefikConfig = await getTraefikConfig(
                 // this is called by the local exit node to get its own config
@@ -521,7 +527,8 @@ export class TraefikConfigManager {
                 build == "saas"
                     ? false
                     : config.getRawConfig().traefik.allow_raw_resources, // dont allow raw resources on saas otherwise use config
-                build != "oss" // generate browser gateway targets on cloud and enterprise
+                pangolinUIUrl, // generate maintenance pages on cloud and hybrid
+                pangolinUIUrl // generate browser gateway targets on cloud and hybrid
             );
 
             const domains = new Set<string>();

server/lib/traefik/getTraefikConfig.ts

@@ -44,7 +44,8 @@ export async function getTraefikConfig(
     filterOutNamespaceDomains = false, // UNUSED BUT USED IN PRIVATE
     generateLoginPageRouters = false, // UNUSED BUT USED IN PRIVATE
     allowRawResources = true,
-    allowMaintenancePage = true // UNUSED BUT USED IN PRIVATE
+    maintenancePageUiUrl: string | null = null, // UNUSED BUT USED IN PRIVATE
+    browserGatewayUiUrl: string | null = null // UNUSED BUT USED IN PRIVATE
 ): Promise<any> {
     // Get resources with their targets and sites in a single optimized query
     // Start from sites on this exit node, then join to targets and resources
@@ -240,7 +241,7 @@ export async function getTraefikConfig(
             continue;
         }
 
-        if (resource.http) {
+        if (resource.mode === "http") {
             if (!resource.domainId || !resource.fullDomain) {
                 continue;
             }
@@ -572,7 +573,7 @@ export async function getTraefikConfig(
                     serviceName
                 ].loadBalancer.serversTransport = transportName;
             }
-        } else {
+        } else if (resource.mode === "tcp" || resource.mode === "udp") {
             // Non-HTTP (TCP/UDP) configuration
             if (!resource.enableProxy || !resource.proxyPort) {
                 continue;

server/lib/userOrg.ts

@@ -2,6 +2,7 @@ import {
     db,
     Org,
     orgs,
+    resourceAccessToken,
     resources,
     siteResources,
     sites,
@@ -14,7 +15,7 @@ import {
 } from "@server/db";
 import { eq, and, inArray, ne, exists } from "drizzle-orm";
 import { usageService } from "@server/lib/billing/usageService";
-import { FeatureId } from "@server/lib/billing";
+import { LimitId } from "@server/lib/billing";
 
 export async function assignUserToOrg(
     org: Org,
@@ -61,7 +62,7 @@ export async function assignUserToOrg(
             );
 
         if (orgsInBillingDomainThatTheUserIsStillIn.length === 0) {
-            await usageService.add(org.orgId, FeatureId.USERS, 1, trx);
+            await usageService.add(org.orgId, LimitId.USERS, 1, trx);
         }
     }
 }
@@ -83,6 +84,15 @@ export async function removeUserFromOrg(
         .delete(userOrgs)
         .where(and(eq(userOrgs.userId, userId), eq(userOrgs.orgId, org.orgId)));
 
+    await trx
+        .delete(resourceAccessToken)
+        .where(
+            and(
+                eq(resourceAccessToken.userId, userId),
+                eq(resourceAccessToken.orgId, org.orgId)
+            )
+        );
+
     await trx.delete(userResources).where(
         and(
             eq(userResources.userId, userId),
@@ -157,7 +167,7 @@ export async function removeUserFromOrg(
             );
 
         if (orgsInBillingDomainThatTheUserIsStillIn.length === 0) {
-            await usageService.add(org.orgId, FeatureId.USERS, -1, trx);
+            await usageService.add(org.orgId, LimitId.USERS, -1, trx);
         }
     }
 }

server/lib/validators.test.ts

@@ -1,4 +1,7 @@
-import { isValidUrlGlobPattern } from "./validators";
+import {
+    getResourceRuleValueValidationError,
+    isValidUrlGlobPattern
+} from "./validators";
 import { assertEquals } from "@test/assert";
 
 function runTests() {
@@ -236,6 +239,43 @@ function runTests() {
         "Path with isolated percent sign should be invalid"
     );
 
+    // ASN validation tests
+    assertEquals(
+        getResourceRuleValueValidationError("ASN", "AS15169"),
+        null,
+        "Standard ASN should be valid"
+    );
+    assertEquals(
+        getResourceRuleValueValidationError("ASN", "  As15169  "),
+        null,
+        "Standard ASN should be valid with mixed case and whitespace"
+    );
+    assertEquals(
+        getResourceRuleValueValidationError("ASN", "ALL"),
+        null,
+        "ALL ASN selector should be valid"
+    );
+    assertEquals(
+        getResourceRuleValueValidationError("ASN", " all "),
+        null,
+        "ALL ASN selector should be valid with mixed case and whitespace"
+    );
+    assertEquals(
+        getResourceRuleValueValidationError("ASN", "AS0"),
+        null,
+        "AS0 alias should be valid"
+    );
+    assertEquals(
+        getResourceRuleValueValidationError("ASN", " as0 "),
+        null,
+        "AS0 alias should be valid with mixed case and whitespace"
+    );
+    assertEquals(
+        getResourceRuleValueValidationError("ASN", "not-an-asn"),
+        "Invalid ASN provided",
+        "Invalid ASN should return an error"
+    );
+
     console.log("All tests passed!");
 }
 

server/lib/validators.ts

@@ -1,5 +1,7 @@
 import z from "zod";
 import ipaddr from "ipaddr.js";
+import { COUNTRIES } from "@server/db/countries";
+import { isValidRegionId } from "@server/db/regions";
 
 export function isValidCIDR(cidr: string): boolean {
     return (
@@ -67,6 +69,50 @@ export function isValidUrlGlobPattern(pattern: string): boolean {
     return true;
 }
 
+export const RESOURCE_RULE_MATCH_TYPES = [
+    "CIDR",
+    "IP",
+    "PATH",
+    "COUNTRY",
+    "COUNTRY_IS_NOT",
+    "ASN",
+    "REGION"
+] as const;
+
+export type ResourceRuleMatchType = (typeof RESOURCE_RULE_MATCH_TYPES)[number];
+
+export function getResourceRuleValueValidationError(
+    match: ResourceRuleMatchType,
+    value: string
+): string | null {
+    switch (match) {
+        case "CIDR":
+            return isValidCIDR(value) ? null : "Invalid CIDR provided";
+        case "IP":
+            return isValidIP(value) ? null : "Invalid IP provided";
+        case "PATH":
+            return isValidUrlGlobPattern(value)
+                ? null
+                : "Invalid URL glob pattern provided";
+        case "REGION":
+            return isValidRegionId(value) ? null : "Invalid region ID provided";
+        case "COUNTRY":
+        case "COUNTRY_IS_NOT":
+            return COUNTRIES.some((country) => country.code === value)
+                ? null
+                : "Invalid country code provided";
+        case "ASN":
+            const normalizedValue = value.trim().toUpperCase();
+            return /^AS\d+$/.test(normalizedValue) ||
+                normalizedValue === "ALL" ||
+                normalizedValue === "AS0"
+                ? null
+                : "Invalid ASN provided";
+        default:
+            return "Invalid rule match type provided";
+    }
+}
+
 export function isUrlValid(url: string | undefined) {
     if (!url) return true; // the link is optional in the schema so if it's empty it's valid
     var pattern = new RegExp(

server/middlewares/integration/index.ts

@@ -17,3 +17,4 @@ export * from "./verifyApiKeySiteResourceAccess";
 export * from "./verifyApiKeyIdpAccess";
 export * from "./verifyApiKeyDomainAccess";
 export * from "./verifyApiKeyResourcePolicyAccess";
+export * from "./verifyApiKeySiteProvisioningKeyAccess";

server/middlewares/integration/verifyApiKeySiteProvisioningKeyAccess.ts

@@ -0,0 +1,111 @@
+import { Request, Response, NextFunction } from "express";
+import {
+    db,
+    siteProvisioningKeys,
+    siteProvisioningKeyOrg,
+    apiKeyOrg
+} from "@server/db";
+import { and, eq } from "drizzle-orm";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+import { getFirstString } from "@server/lib/requestParams";
+
+export async function verifyApiKeySiteProvisioningKeyAccess(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const apiKey = req.apiKey;
+        const siteProvisioningKeyId =
+            getFirstString(req.params.siteProvisioningKeyId) ||
+            getFirstString(req.body.siteProvisioningKeyId) ||
+            getFirstString(req.query.siteProvisioningKeyId);
+        const orgId = getFirstString(req.params.orgId);
+
+        if (!apiKey) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
+            );
+        }
+
+        if (!orgId) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
+            );
+        }
+
+        if (!siteProvisioningKeyId) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid key ID")
+            );
+        }
+
+        if (apiKey.isRoot) {
+            // Root keys can access any site provisioning key in any org
+            return next();
+        }
+
+        const [row] = await db
+            .select()
+            .from(siteProvisioningKeys)
+            .innerJoin(
+                siteProvisioningKeyOrg,
+                and(
+                    eq(
+                        siteProvisioningKeys.siteProvisioningKeyId,
+                        siteProvisioningKeyOrg.siteProvisioningKeyId
+                    ),
+                    eq(siteProvisioningKeyOrg.orgId, orgId)
+                )
+            )
+            .where(
+                eq(
+                    siteProvisioningKeys.siteProvisioningKeyId,
+                    siteProvisioningKeyId
+                )
+            )
+            .limit(1);
+
+        if (!row?.siteProvisioningKeys || !row.siteProvisioningKeyOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Site provisioning key with ID ${siteProvisioningKeyId} not found for organization ${orgId}`
+                )
+            );
+        }
+
+        if (!req.apiKeyOrg) {
+            const apiKeyOrgRes = await db
+                .select()
+                .from(apiKeyOrg)
+                .where(
+                    and(
+                        eq(apiKeyOrg.apiKeyId, apiKey.apiKeyId),
+                        eq(apiKeyOrg.orgId, row.siteProvisioningKeyOrg.orgId)
+                    )
+                )
+                .limit(1);
+            req.apiKeyOrg = apiKeyOrgRes[0];
+        }
+
+        if (!req.apiKeyOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Key does not have access to this organization"
+                )
+            );
+        }
+
+        return next();
+    } catch (error) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error verifying site provisioning key access"
+            )
+        );
+    }
+}

server/middlewares/verifyAccessTokenAccess.ts

@@ -119,8 +119,7 @@ export async function verifyAccessTokenAccess(
                 return next(
                     createHttpError(
                         HttpCode.FORBIDDEN,
-                        "Failed organization access policy check: " +
-                            (policyCheck.error || "Unknown error")
+                        "" + (policyCheck.error || "Unknown error")
                     )
                 );
             }

server/middlewares/verifyAdmin.ts

@@ -56,8 +56,7 @@ export async function verifyAdmin(
             return next(
                 createHttpError(
                     HttpCode.FORBIDDEN,
-                    "Failed organization access policy check: " +
-                        (policyCheck.error || "Unknown error")
+                    "" + (policyCheck.error || "Unknown error")
                 )
             );
         }

server/middlewares/verifyApiKeyAccess.ts

@@ -113,8 +113,7 @@ export async function verifyApiKeyAccess(
                 return next(
                     createHttpError(
                         HttpCode.FORBIDDEN,
-                        "Failed organization access policy check: " +
-                            (policyCheck.error || "Unknown error")
+                        "" + (policyCheck.error || "Unknown error")
                     )
                 );
             }

server/middlewares/verifyClientAccess.ts

@@ -107,8 +107,7 @@ export async function verifyClientAccess(
                 return next(
                     createHttpError(
                         HttpCode.FORBIDDEN,
-                        "Failed organization access policy check: " +
-                            (policyCheck.error || "Unknown error")
+                        "" + (policyCheck.error || "Unknown error")
                     )
                 );
             }
@@ -129,10 +128,7 @@ export async function verifyClientAccess(
                       .where(
                           and(
                               eq(roleClients.clientId, client.clientId),
-                              inArray(
-                                  roleClients.roleId,
-                                  req.userOrgRoleIds!
-                              )
+                              inArray(roleClients.roleId, req.userOrgRoleIds!)
                           )
                       )
                       .limit(1)