Bump the prod-patch-updates group across 1 directory with 10 updates

Bumps the prod-patch-updates group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@headlessui/react](https://github.com/tailwindlabs/headlessui/tree/HEAD/packages/@headlessui-react) | `2.2.9` | `2.2.10` | | [@react-email/components](https://github.com/resend/react-email/tree/HEAD/packages/components) | `1.0.8` | `1.0.12` | | [@react-email/render](https://github.com/resend/react-email/tree/HEAD/packages/render) | `2.0.4` | `2.0.8` | | [@react-email/tailwind](https://github.com/resend/react-email/tree/HEAD/packages/tailwind) | `2.0.5` | `2.0.7` | | [ioredis](https://github.com/luin/ioredis) | `5.10.0` | `5.10.1` | | [maxmind](https://github.com/runk/node-maxmind) | `5.0.5` | `5.0.6` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `8.0.5` | `8.0.7` | | [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.4` | `19.2.6` | | [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.4` | `19.2.6` | | [use-debounce](https://github.com/xnimorz/use-debounce) | `10.1.0` | `10.1.1` | Updates `@headlessui/react` from 2.2.9 to 2.2.10 - [Release notes](https://github.com/tailwindlabs/headlessui/releases) - [Changelog](https://github.com/tailwindlabs/headlessui/blob/main/packages/@headlessui-react/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/headlessui/commits/@headlessui/react@v2.2.10/packages/@headlessui-react) Updates `@react-email/components` from 1.0.8 to 1.0.12 - [Release notes](https://github.com/resend/react-email/releases) - [Changelog](https://github.com/resend/react-email/blob/@react-email/components@1.0.12/packages/components/CHANGELOG.md) - [Commits](https://github.com/resend/react-email/commits/@react-email/components@1.0.12/packages/components) Updates `@react-email/render` from 2.0.4 to 2.0.8 - [Release notes](https://github.com/resend/react-email/releases) - [Changelog](https://github.com/resend/react-email/blob/canary/packages/render/CHANGELOG.md) - [Commits](https://github.com/resend/react-email/commits/@react-email/render@2.0.8/packages/render) Updates `@react-email/tailwind` from 2.0.5 to 2.0.7 - [Release notes](https://github.com/resend/react-email/releases) - [Changelog](https://github.com/resend/react-email/blob/@react-email/tailwind@2.0.7/packages/tailwind/CHANGELOG.md) - [Commits](https://github.com/resend/react-email/commits/@react-email/tailwind@2.0.7/packages/tailwind) Updates `ioredis` from 5.10.0 to 5.10.1 - [Release notes](https://github.com/luin/ioredis/releases) - [Changelog](https://github.com/redis/ioredis/blob/main/CHANGELOG.md) - [Commits](https://github.com/luin/ioredis/compare/v5.10.0...v5.10.1) Updates `maxmind` from 5.0.5 to 5.0.6 - [Release notes](https://github.com/runk/node-maxmind/releases) - [Commits](https://github.com/runk/node-maxmind/compare/v5.0.5...v5.0.6) Updates `nodemailer` from 8.0.5 to 8.0.7 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodemailer/nodemailer/compare/v8.0.5...v8.0.7) Updates `react` from 19.2.4 to 19.2.6 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react) Updates `react-dom` from 19.2.4 to 19.2.6 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react-dom) Updates `use-debounce` from 10.1.0 to 10.1.1 - [Release notes](https://github.com/xnimorz/use-debounce/releases) - [Changelog](https://github.com/xnimorz/use-debounce/blob/master/CHANGELOG.md) - [Commits](https://github.com/xnimorz/use-debounce/commits) --- updated-dependencies: - dependency-name: "@headlessui/react" dependency-version: 2.2.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: "@react-email/components" dependency-version: 1.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: "@react-email/render" dependency-version: 2.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: "@react-email/tailwind" dependency-version: 2.0.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: ioredis dependency-version: 5.10.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: maxmind dependency-version: 5.0.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: nodemailer dependency-version: 8.0.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: react dependency-version: 19.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: react-dom dependency-version: 19.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: use-debounce dependency-version: 10.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com>
2026-09-11 21:41:41 +02:00 · 2026-05-18 02:01:07 +00:00
1162 changed files with 36022 additions and 152680 deletions
@@ -1,31 +0,0 @@
 ---
 name: crud-endpoints
 description: Use whenever asked to add, create, or scaffold a CRUD endpoint, router, or entity in this repo's server (create/list/get/update/delete handlers, new `server/routers/<entity>/` or `server/private/routers/<entity>/` folder). Points to the established file layout, middleware, ActionsEnum, and route-registration conventions before writing any code.
 ---
 Before writing any router/handler/middleware code for a new entity, read
 `docs/crud-endpoints.md` in full. It documents, with real examples from
 `server/routers/aiProvider/` (public) and `server/private/routers/alertRule/`
 (enterprise-only), how this repo structures CRUD endpoints:
 - Directory/file layout per entity (`index.ts`, `types.ts`, `validation.ts`,
  one file per operation).
 - The standard handler anatomy (zod parsing, OpenAPI registry, response
  envelope, error handling).
 - Where access-control middleware (`verify<Entity>Access`) lives and when
  it's needed vs. plain `verifyOrgAccess`.
 - How to wire up `ActionsEnum` entries, `verifyUserHasAction`, and
  `logActionAudit`.
 - Which of the four router files (`server/routers/external.ts`,
  `server/routers/internal.ts`, `server/private/routers/external.ts`,
  `server/private/routers/internal.ts`) to register routes in, and the
  middleware chain template per HTTP verb.
 - The repo's non-standard verb convention: **`PUT` = create, `POST` =
  update** (backwards from typical REST) — don't "fix" this to standard
  REST verbs, match the existing convention.
 - The `#dynamic` import alias, for the rare case of a hook needing different
  implementations in OSS vs. enterprise builds.
 Follow that doc's checklist (§8) step by step rather than improvising a
 structure. If the doc and the actual code in `aiProvider`/`alertRule` ever
 disagree, trust the code and flag the doc as stale.
@@ -1,5 +0,0 @@
 ---
 alwaysApply: true
 ---
 When adding submit buttons, don't change the text of the button during the loading state. Text should stay static and you should use the loading prop on the button.
@@ -1,5 +0,0 @@
 ---
 alwaysApply: true
 ---
 When creating UI for popup dialogs or modals, use the Credenza componennt. This component is mobile responsive and works on desktop and wraps the dialog component and sheet into one.
@@ -1,5 +0,0 @@
 ---
 alwaysApply: true
 ---
 Don't write or edit migrations in `server/setup` unless specificall instructed to do so.
@@ -1,7 +0,0 @@
 ---
 alwaysApply: true
 ---
 When writing TypeScript:
 Prefer to use types instead of interfaces.
@@ -1,5 +0,0 @@
 ---
 alwaysApply: true
 ---
 When creating forms, use React form for validation and use Zod schemas.
@@ -34,5 +34,3 @@ build.ts
 tsconfig.json
 Dockerfile*
 drizzle.config.ts
 allowedDevOrigins.json
 scratch/
@@ -14,13 +14,12 @@ body:
          label: Environment
          description: Please fill out the relevant details below for your environment.
          value: |
-              - OS Type & Version:
+              - OS Type & Version: (e.g., Ubuntu 22.04)
              - Pangolin Version:
              - Edition (Community or Enterprise):
              - Gerbil Version:
              - Traefik Version:
              - Newt Version:
-              - Client Version:
+              - Olm Version: (if applicable)
      validations:
          required: true
@@ -34,14 +33,6 @@ body:
      validations:
          required: true
    - type: textarea
      attributes:
          label: AI Disclosure
          description: |
              If you used AI to help write this issue, please disclose it here. This is important for transparency and helps maintain the integrity of the issue tracking process.
      validations:
          required: true
    - type: textarea
      attributes:
          label: Expected Behavior
@@ -4,10 +4,6 @@ perpetual license to use, modify, and redistribute these contributions under any
 choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
 represent that I have the right to grant this license for all contributed content.
 ## AI Disclosure
 > Please disclose how AI was used in this pull request. The use of AI does not preclude this from being merged but is an important factor in how we review your request.
 ## Description
@@ -1,42 +1,52 @@
 version: 2
 updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "daily"
    open-pull-requests-limit: 1
    groups:
-      npm-dependencies:
+      dev-patch-updates:
-        patterns:
+        dependency-type: "development"
-          - "*"
+        update-types:
          - "patch"
      dev-minor-updates:
        dependency-type: "development"
        update-types:
          - "minor"
      prod-patch-updates:
        dependency-type: "production"
        update-types:
          - "patch"
      prod-minor-updates:
        dependency-type: "production"
        update-types:
          - "minor"
  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "daily"
    open-pull-requests-limit: 1
    groups:
-      docker-dependencies:
+      patch-updates:
-        patterns:
+        update-types:
-          - "*"
+          - "patch"
      minor-updates:
        update-types:
          - "minor"
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 1
    groups:
      github-actions-dependencies:
        patterns:
          - "*"
  - package-ecosystem: "gomod"
    directory: "/install"
    schedule:
      interval: "daily"
    open-pull-requests-limit: 1
    groups:
-      go-install-dependencies:
+      patch-updates:
-        patterns:
+        update-types:
-          - "*"
+          - "patch"
      minor-updates:
        update-types:
          - "minor"
@@ -62,7 +62,7 @@ jobs:
        steps:
            - name: Checkout code
-              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
            - name: Monitor storage space
              run: |
@@ -77,7 +77,7 @@ jobs:
                  fi
            - name: Log in to Docker Hub
-              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
              with:
                  registry: docker.io
                  username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -134,7 +134,7 @@ jobs:
        steps:
            - name: Checkout code
-              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
            - name: Monitor storage space
              run: |
@@ -149,7 +149,7 @@ jobs:
                  fi
            - name: Log in to Docker Hub
-              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
              with:
                  registry: docker.io
                  username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -201,10 +201,10 @@ jobs:
        timeout-minutes: 30
        steps:
            - name: Checkout code
-              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
            - name: Log in to Docker Hub
-              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
              with:
                  registry: docker.io
                  username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -256,7 +256,7 @@ jobs:
        steps:
            - name: Checkout code
-              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
            - name: Extract tag name
              id: get-tag
@@ -264,7 +264,7 @@ jobs:
              shell: bash
            - name: Install Go
-              uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+              uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
              with:
                  go-version: 1.25
@@ -407,7 +407,7 @@ jobs:
              shell: bash
            - name: Login to GitHub Container Registry (for cosign)
-              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
              with:
                registry: ghcr.io
                username: ${{ github.actor }}
@@ -21,10 +21,10 @@ jobs:
        runs-on: ubuntu-latest
        steps:
            - name: Checkout code
-              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
            - name: Set up Node.js
-              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+              uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
              with:
                node-version: '24'
@@ -23,7 +23,7 @@ jobs:
          skopeo --version
      - name: Install cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
      - name: Input check
        run: |
@@ -14,7 +14,7 @@ jobs:
  stale:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
+      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
        with:
          days-before-stale: 14
          days-before-close: 14
@@ -14,10 +14,10 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Install Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: '24'
@@ -62,7 +62,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Build Docker image sqlite
        run: make dev-build-sqlite
@@ -71,7 +71,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Build Docker image pg
        run: make dev-build-pg
@@ -17,9 +17,9 @@ yarn-error.log*
 *.tsbuildinfo
 next-env.d.ts
 *.db
-*.sqlite*
+*.sqlite
 !Dockerfile.sqlite
-*.sqlite3*
+*.sqlite3
 *.log
 .machinelogs*.json
 *-audit.json
@@ -46,6 +46,7 @@ public/branding
 server/db/index.ts
 server/build.ts
 postgres/
 dynamic/
 *.mmdb
 scratch/
 tsconfig.json
@@ -53,5 +54,3 @@ hydrateSaas.ts
 CLAUDE.md
 drizzle.config.ts
 server/setup/migrations.ts
 solo.yml
 allowedDevOrigins.json
@@ -18,8 +18,5 @@
    "[json]": {
        "editor.defaultFormatter": "esbenp.prettier-vscode"
    },
-    "editor.formatOnSave": true,
+    "editor.formatOnSave": true
    "cSpell.words": [
        "nessicary"
    ]
 }
@@ -1,5 +1,5 @@
-# FROM node:24.18.1-slim AS base
+# FROM node:24-slim AS base
-FROM public.ecr.aws/docker/library/node:24.18.1-slim AS base
+FROM public.ecr.aws/docker/library/node:24-slim AS base
 WORKDIR /app
@@ -32,8 +32,8 @@ FROM base AS builder
 RUN npm ci --omit=dev
-# FROM node:24.18.1-slim AS runner
+# FROM node:24-slim AS runner
-FROM public.ecr.aws/docker/library/node:24.18.1-slim AS runner
+FROM public.ecr.aws/docker/library/node:24-slim AS runner
 WORKDIR /app
@@ -1,4 +1,4 @@
-FROM node:24.18.1-alpine
+FROM node:24-alpine
 WORKDIR /app
@@ -37,22 +37,11 @@
 <p align="center">
    <strong>
-        Get started with Pangolin Cloud at <a href="https://app.pangolin.net/auth/signup">app.pangolin.net</a>
+        Get started with Pangolin at <a href="https://app.pangolin.net/auth/signup">app.pangolin.net</a>
    </strong>
 </p>
-Pangolin is an open-source SASE platform, built on WireGuard®, with a simple mission: connect and protect your users, wherever they are. It brings networking and security together as one system including a zero-trust VPN, zero-trust reverse proxy, privileged access management, and an identity-aware AI gateway, all sharing one identity and policy model. It's the same idea behind platforms like Cloudflare One, Zscaler, and Prisma but open, self-hostable, and built to stay light and easy to deploy.
+Pangolin is an open-source, identity-based remote access platform built on WireGuard® that enables secure, seamless connectivity to private and public resources. Pangolin combines reverse proxy and VPN capabilities into one platform, providing browser-based access to web applications and client-based access to any private resources with NAT traversal, all with granular access controls.
 ### Networking and security that's unified, open, and simple
 Legacy SASE platforms got the idea right: connectivity and security belong together. But they delivered it as a heavyweight, closed, cloud-locked stack assembled from years of patchwork. Pangolin exists to do that unification differently, in the open, self-hostable, and simple enough that administrators actually enjoy running it.
 * **Open source, not a black box**: the code is open and auditable, so you can see exactly how your traffic is handled and how access decisions get made, instead of trusting a closed cloud control plane.
 * **Networking and security as one platform**: sites, reverse proxy, client access, RBAC, and the AI gateway share one identity and policy model, so protecting users and connecting them are executed together.
 * **Lightweight by design**: the whole platform is built to stay small and fast: easy to self-host on a small server, with a lightweight, user-space connector that goes in your private networks.
 * **Enjoyable to use**: a clean, modern interface and a setup flow that gets out of your way, so managing access feels simple instead of like fighting a legacy admin console.
 * **Zero trust from day one**: access is granted per resource, not per network, with identity provider integration, role-based access control, and full audit logging.
 * **Run it your way**: self-host the Community Edition for free, step up to the Enterprise Edition for advanced features, or use Pangolin Cloud if you'd rather not manage infrastructure at all.
 ## Installation
@@ -64,9 +53,9 @@ Legacy SASE platforms got the idea right: connectivity and security belong toget
 ## Deployment Options
- **Pangolin Cloud** - Fully managed service with no infrastructure required.
+- **Pangolin Cloud** - Fully managed service - no infrastructure required.
- **Self-Host: Community Edition** - Free, open-source, and licensed under AGPL-3.
+- **Self-Host: Community Edition** - Free, open source, and licensed under AGPL-3.
- **Self-Host: Enterprise Edition** - Open-core, and licensed under Fossorial Commercial License. Free for personal and hobbyist use, and for businesses making less than \$100K USD gross annual revenue.
+- **Self-Host: Enterprise Edition** - Licensed under Fossorial Commercial License. Free for personal and hobbyist use, and for businesses making less than \$100K USD gross annual revenue.
 ## Key Features
@@ -74,26 +63,11 @@ Legacy SASE platforms got the idea right: connectivity and security belong toget
 Pangolin's site connectors provide gateways into networks so you can access any networked resources. Sites use outbound tunnels and intelligent NAT traversal to make networks behind restrictive firewalls available for authorized access without public IPs or open ports. Easily deploy a site as a binary or container on any platform.
 * Lightweight user-space connector runs anywhere
 * Punches through any firewall
 * Doesn't require open ports or a public IP
 * Strict network segmentation
 * WireGuard-based
 * Get alerts when a device or network resource goes down
 <img src="public/screenshots/sites.png" alt="Sites" width="100%" />
 ### Browser-based reverse proxy access
-Expose HTTPS web applications and connect to VNC, RDP, and SSH entirely in the browser through identity and context-aware tunneled reverse proxies. Users access resources with authentication and granular access control without installing a client. Pangolin handles routing, load balancing, health checking, and automatic SSL certificates without exposing your network directly to the internet.
+Expose web applications through identity and context-aware tunneled reverse proxies. Users access applications through any web browser with authentication and granular access control without installing a client. Pangolin handles routing, load balancing, health checking, and automatic SSL certificates without exposing your network directly to the internet.
 * Expose a web panel anywhere
 * Access via any web browser
 * Single sign-on across all resources
 * HTTPS resources
 * Remote desktop in the browser with VNC and RDP
 * In-browser SSH terminal with privileged access management (PAM)
 * PIN codes, passcodes, email OTP, geoblocking, allow-lists, and more
 <img src="public/clip.gif" alt="Reverse proxy access" width="100%" />
@@ -101,48 +75,14 @@ Expose HTTPS web applications and connect to VNC, RDP, and SSH entirely in the b
 Access private resources like SSH servers, databases, RDP, and entire network ranges through Pangolin clients. Intelligent NAT traversal enables connections even through restrictive firewalls, while DNS aliases provide friendly names and fast connections to resources across all your sites. Add redundancy by routing traffic through multiple connectors in your network.
 * Peer-to-peer with intelligent NAT traversal
 * Hosts/IPs and port ranges
 * Network ranges/CIDRs
 * Friendly DNS aliases for network addresses
 * Privileged access management (PAM) with SSH resources
 * Private HTTPS resources only accessible on the private network
 <img src="public/screenshots/private-resources.png" alt="Private resources" width="100%" />
 ### Identity-aware AI gateway
 Put an identity-aware proxy in front of public cloud (OpenAI, Anthropic, Gemini, etc.) and self-hosted model servers (Ollama, vLLM, Mistral, etc.) so coding agents and AI clients call a single Pangolin URL. Publish it as a public resource with personal API keys, or keep it private on a client tunnel where the connected client is the credential for keyless access. Budgets, session history, and usage analytics sit in front of every call.
 * Access self-hosted models (vLLM, Ollama, etc) alongside cloud models (OpenAI, Anthropic, etc) in one place
 * Keyless access by authenticating users with the Pangolin desktop client
 * Or, provide users with personal API keys
 * Control costs and token usage by setting budgets
 * Audit with detailed session history and analytics
 * Integrate AI clients and coding agents (Claude Code, Codex, OpenCode, etc)
 <img src="public/screenshots/expanded-session-logs.png" alt="AI Session Logs" width="100%" />
 ### Give users and roles access to resources
-Use Pangolin's built-in users or bring your own identity provider and set up role-based access control (RBAC). Grant users access to specific resources, not entire networks. Unlike traditional VPNs that expose full network access, Pangolin's zero-trust model ensures users can only reach the applications, services, and routes you explicitly define.
+Use Pangolin's built in users or bring your own identity provider and set up role based access control (RBAC). Grant users access to specific resources, not entire networks. Unlike traditional VPNs that expose full network access, Pangolin's zero-trust model ensures users can only reach the applications, services, and routes you explicitly define.
 * Bring your existing identity provider (IdP) or use Pangolin identities
 * Sync users and roles from your IdP
 * User- and role-based access control
 * Full network audit and access logs
 <img src="public/screenshots/users.png" alt="Users from identity provider with roles" width="100%" />
 ### Find and launch resources from a personalized home page
 Give users a landing page to quickly find and open the resources they can access. Resources are grouped by site or label, searchable, and filterable, with grid or list views. Saved views capture filters, grouping, and layout as personal or organization-wide defaults.
 * Single place for admins and non-admins to see accessible resources
 * Create reusable views for common access patterns
 <img src="public/screenshots/resource-launcher.png" alt="Resource Launcher" width="100%" />
 ## Download Clients
 Download the Pangolin client for your platform:
@@ -167,7 +107,7 @@ the docs to illustrate some basic ideas.
 ## Licensing
-Pangolin is dual licensed under the AGPL-3 and the [Fossorial Commercial License](https://pangolin.net/fcl). For inquiries about commercial licensing, please contact us at [contact@pangolin.net](mailto:contact@pangolin.net).
+Pangolin is dual licensed under the AGPL-3 and the [Fossorial Commercial License](https://pangolin.net/fcl.html). For inquiries about commercial licensing, please contact us at [contact@pangolin.net](mailto:contact@pangolin.net).
 ## Contributions
@@ -5,7 +5,7 @@ import { encrypt } from "@server/lib/crypto";
 import { configFilePath1, configFilePath2 } from "@server/lib/consts";
 import { generateCA } from "@server/lib/sshCA";
 import fs from "fs";
-import * as yaml from "js-yaml";
+import yaml from "js-yaml";
 type GenerateOrgCaKeysArgs = {
    orgId: string;
@@ -1,10 +1,10 @@
 import { CommandModule } from "yargs";
-import { db, idpOidcConfig, licenseKey, certificates, eventStreamingDestinations, alertWebhookActions, aiProviders, virtualApiKeys } from "@server/db";
+import { db, idpOidcConfig, licenseKey, certificates, eventStreamingDestinations, alertWebhookActions } from "@server/db";
 import { encrypt, decrypt } from "@server/lib/crypto";
 import { configFilePath1, configFilePath2 } from "@server/lib/consts";
 import { eq } from "drizzle-orm";
 import fs from "fs";
-import * as yaml from "js-yaml";
+import yaml from "js-yaml";
 type RotateServerSecretArgs = {
    "old-secret": string;
@@ -132,16 +132,12 @@ export const rotateServerSecret: CommandModule<
            const certs = await db.select().from(certificates);
            const streamingDestinations = await db.select().from(eventStreamingDestinations);
            const webhookActions = await db.select().from(alertWebhookActions);
            const providers = await db.select().from(aiProviders);
            const virtualKeys = await db.select().from(virtualApiKeys);
            console.log(`Found ${idpConfigs.length} OIDC IdP configuration(s)`);
            console.log(`Found ${licenseKeys.length} license key(s)`);
            console.log(`Found ${certs.length} certificate(s)`);
            console.log(`Found ${streamingDestinations.length} event streaming destination(s)`);
            console.log(`Found ${webhookActions.length} alert webhook action(s)`);
            console.log(`Found ${providers.length} AI provider(s)`);
            console.log(`Found ${virtualKeys.length} virtual API key(s)`);
            // Prepare all decrypted and re-encrypted values
            console.log("\nDecrypting and re-encrypting values...");
@@ -175,24 +171,11 @@ export const rotateServerSecret: CommandModule<
                encryptedConfig: string;
            };
            type AiProviderUpdate = {
                providerId: number;
                encryptedApiKey: string | null;
                encryptedHeaders: string | null;
            };
            type VirtualApiKeyUpdate = {
                virtualApiKeyId: string;
                encryptedToken: string;
            };
            const idpUpdates: IdpUpdate[] = [];
            const licenseKeyUpdates: LicenseKeyUpdate[] = [];
            const certUpdates: CertUpdate[] = [];
            const streamingDestinationUpdates: StreamingDestinationUpdate[] = [];
            const webhookActionUpdates: WebhookActionUpdate[] = [];
            const aiProviderUpdates: AiProviderUpdate[] = [];
            const virtualApiKeyUpdates: VirtualApiKeyUpdate[] = [];
            // Process idpOidcConfig entries
            for (const idpConfig of idpConfigs) {
@@ -323,60 +306,6 @@ export const rotateServerSecret: CommandModule<
                }
            }
            // Process aiProviders entries (apiKey + headers)
            for (const provider of providers) {
                try {
                    if (!provider.apiKey && !provider.headers) {
                        continue;
                    }
                    const encryptedApiKey = provider.apiKey
                        ? encrypt(decrypt(provider.apiKey, oldSecret), newSecret)
                        : null;
                    const encryptedHeaders = provider.headers
                        ? encrypt(
                              decrypt(provider.headers, oldSecret),
                              newSecret
                          )
                        : null;
                    aiProviderUpdates.push({
                        providerId: provider.providerId,
                        encryptedApiKey,
                        encryptedHeaders
                    });
                } catch (error) {
                    console.error(
                        `Error processing AI provider ${provider.providerId}:`,
                        error
                    );
                    throw error;
                }
            }
            // Process virtualApiKeys entries (token)
            for (const key of virtualKeys) {
                try {
                    if (!key.token) {
                        continue;
                    }
                    virtualApiKeyUpdates.push({
                        virtualApiKeyId: key.virtualApiKeyId,
                        encryptedToken: encrypt(
                            decrypt(key.token, oldSecret),
                            newSecret
                        )
                    });
                } catch (error) {
                    console.error(
                        `Error processing virtual API key ${key.virtualApiKeyId}:`,
                        error
                    );
                    throw error;
                }
            }
            // Perform all database updates in a single transaction
            console.log("\nUpdating database in transaction...");
            await db.transaction(async (trx) => {
@@ -447,32 +376,6 @@ export const rotateServerSecret: CommandModule<
                            )
                        );
                }
                // Update AI provider entries
                for (const update of aiProviderUpdates) {
                    await trx
                        .update(aiProviders)
                        .set({
                            apiKey: update.encryptedApiKey,
                            headers: update.encryptedHeaders
                        })
                        .where(eq(aiProviders.providerId, update.providerId));
                }
                // Update virtual API key entries
                for (const update of virtualApiKeyUpdates) {
                    await trx
                        .update(virtualApiKeys)
                        .set({
                            token: update.encryptedToken
                        })
                        .where(
                            eq(
                                virtualApiKeys.virtualApiKeyId,
                                update.virtualApiKeyId
                            )
                        );
                }
            });
            console.log(`Rotated ${idpUpdates.length} OIDC IdP configuration(s)`);
@@ -480,8 +383,6 @@ export const rotateServerSecret: CommandModule<
            console.log(`Rotated ${certUpdates.length} certificate(s)`);
            console.log(`Rotated ${streamingDestinationUpdates.length} event streaming destination(s)`);
            console.log(`Rotated ${webhookActionUpdates.length} alert webhook action(s)`);
            console.log(`Rotated ${aiProviderUpdates.length} AI provider(s)`);
            console.log(`Rotated ${virtualApiKeyUpdates.length} virtual API key(s)`);
            // Update config file with new secret
            console.log("\nUpdating config file...");
@@ -501,7 +402,6 @@ export const rotateServerSecret: CommandModule<
            console.log(`  - Certificates: ${certUpdates.length}`);
            console.log(`  - Event streaming destinations: ${streamingDestinationUpdates.length}`);
            console.log(`  - Alert webhook actions: ${webhookActionUpdates.length}`);
            console.log(`  - AI providers: ${aiProviderUpdates.length}`);
            console.log(
                `\n  IMPORTANT: Restart the server for the new secret to take effect.`
            );
@@ -1,85 +0,0 @@
 import { CommandModule } from "yargs";
 import { db, users } from "@server/db";
 import { eq } from "drizzle-orm";
 type SetServerAdminArgs = {
    email: string;
    remove: boolean;
 };
 export const setServerAdmin: CommandModule<{}, SetServerAdminArgs> = {
    command: "set-server-admin",
    describe: "Add or remove server admin by email address",
    builder: (yargs) => {
        return yargs
            .option("email", {
                type: "string",
                demandOption: true,
                describe: "User email address"
            })
            .option("remove", {
                type: "boolean",
                default: false,
                describe: "Remove server admin status from the user"
            });
    },
    handler: async (argv: SetServerAdminArgs) => {
        try {
            const email = argv.email.trim().toLowerCase();
            const [user] = await db
                .select()
                .from(users)
                .where(eq(users.email, email))
                .limit(1);
            if (!user) {
                console.error(`User with email '${email}' not found`);
                process.exit(1);
            }
            if (argv.remove) {
                if (!user.serverAdmin) {
                    console.log(`User '${email}' is not a server admin`);
                    process.exit(0);
                }
                const serverAdmins = await db
                    .select()
                    .from(users)
                    .where(eq(users.serverAdmin, true));
                if (serverAdmins.length <= 1) {
                    console.error(
                        "Cannot remove server admin: at least one server admin must exist"
                    );
                    process.exit(1);
                }
                await db
                    .update(users)
                    .set({ serverAdmin: false })
                    .where(eq(users.userId, user.userId));
                console.log(`Server admin status removed from user '${email}'`);
                process.exit(0);
            }
            if (user.serverAdmin) {
                console.log(`User '${email}' is already a server admin`);
                process.exit(0);
            }
            await db
                .update(users)
                .set({ serverAdmin: true })
                .where(eq(users.userId, user.userId));
            console.log(`User '${email}' has been marked as a server admin`);
            process.exit(0);
        } catch (error) {
            console.error("Error:", error);
            process.exit(1);
        }
    }
 };
@@ -11,7 +11,6 @@ import { deleteClient } from "./commands/deleteClient";
 import { generateOrgCaKeys } from "./commands/generateOrgCaKeys";
 import { clearCertificates } from "./commands/clearCertificates";
 import { disableUser2fa } from "./commands/disableUser2fa";
 import { setServerAdmin } from "./commands/setServerAdmin";
 yargs(hideBin(process.argv))
    .scriptName("pangctl")
@@ -24,6 +23,5 @@ yargs(hideBin(process.argv))
    .command(generateOrgCaKeys)
    .command(clearCertificates)
    .command(disableUser2fa)
    .command(setServerAdmin)
    .demandCommand()
    .help().argv;
@@ -1,108 +0,0 @@
 you need 3 instances at a minimum: node1 running pangolin, node 2 running pangolin, and a database server running postgres and redis. the third instance does not need to be a instance - you could deploy pg and redis however you want as long as its accessable to the nodes. the redis that is deployed needs to support pub sub.
 the two pangolin nodes need to have public STATIC ips accessible on the internet <NODE1_EXTERNAL_IP> AND <NODE2_EXTERNAL_IP>
 the two nodes need tp be able to address each other <NODE1_INTERNAL_IP> and <NODE2_INTERNAL_IP>
 update these values in the `docker-compose.yml` file under the gerbil section:
 ```yaml
  gerbil:
    image: docker.io/fosrl/gerbil:latest
    container_name: gerbil
    restart: unless-stopped
    depends_on:
      pangolin:
        condition: service_healthy
    command:
      - --reachableAt=http://<NODE1_INTERNAL_IP>:3004
      - --generateAndSaveKeyTo=/var/config/key
      - --remoteConfig=http://pangolin:3001/api/v1/
      - --trusted-upstreams=<NODE1_EXTERNAL_IP>,<NODE2_EXTERNAL_IP> # All trusted nodes in the cluster
 ```
 open ports should look like this
 **Outbound Rules**
 | Name | IP version | Type | Protocol | Port range | Destination | Description |
 | --- | --- | --- | --- | --- | --- | --- |
 | – | IPv4 | All traffic | All | All | 0.0.0.0/0 | Allow all outbound |
 **Inbound Rules**
 | Name | IP version | Type | Protocol | Port range | Source | Description |
 | --- | --- | --- | --- | --- | --- | --- |
 | – | IPv4 | Custom UDP | UDP | 21820 | 0.0.0.0/0 | WireGuard Relay Port |
 | – | IPv4 | DNS (UDP) | UDP | 53 | 0.0.0.0/0 | DNS |
 | – | IPv4 | HTTP | TCP | 80 | 0.0.0.0/0 | Ping and redirects |
 | – | IPv4 | Custom UDP | UDP | 51820 | 0.0.0.0/0 | WireGuard Port |
 | – | IPv4 | Custom TCP | TCP | 3004 | <self - all other nodes> | Pangolin API |
 | – | IPv4 | HTTPS | TCP | 443 | 0.0.0.0/0 | Resources inbound |
 add your email address for acme into <CONTACT_EMAIL>
 only one of the nodes - in this case node1 - should be configured to run the acme client. the other node should have acme disabled. this is because only one node should be responsible for generating and renewing certificates. the other node will use the same certificates from the database. this is controlled with `acme.enable_acme_client`
 delegating domains:
 you need to create a namesever dns record. this is an a record pointing at the cluster for the DNS nameserver. 
 in the example config, this is ns.example.com. you can replace example.com with your domain or choose a any subdomain. Create an A record pointing at your cluster's load ballencer:
 | Name | Type | Value |
 | --- | --- | --- |
 | ns.example.com | A | <LOAD_BALANCER_IP> |
 if you plan to support cname delegation to the server you will need to add an additional cname record for the cluster. this is an example of a cname record pointing at the cluster for the DNS nameserver.
 | Name | Type | Value |
 | --- | --- | --- |
 | cname.example.com | NS | ns.example.com |
 finally, if you would like to support site-to-cloud networking, you can delegate a domain to be able to resolve site addresses withing a cloud encironement to address them through remote nodes. this looks like the above
 | Name | Type | Value |
 | --- | --- | --- |
 | site.example.com | NS | ns.example.com |
 update all three of these values in the privateConfig dns section: 
 ```yaml
 dns:
  enabled: true
  nameserver_name: "ns.example.com"
  cname_extension: "cname.example.com"
  site_extension: "site.example.com" # Optional
 ```
 --
 when  you start for the first time pick one node to start first. This node will init the database and print out the init token to the logs. Use this token to visit the UI and login to create the first user. Then bring up the other nodes
 notes:
 traefik uses file_mode: true. this is different than the  regular pangolin instrall which scrapes the http api.  the file mode writes the traefik config into the dynamic directory - the routers and certs. This is because traefik will only pull cert config files from a file and not from an api. ensure there is a shared volume beteeen pangolin and traefik 
 be sure to download and keep up to date the maxmind databases for geoip and asn. these are used for geolocation and asn lookups. (reference the geoblocking docs here) and place them into the config directory GeoLite2-ASN.mmdb and GeoLite2-Country.mmdb 
 --
 whats required: 
 a load balancer in front of the nodes. this can be a cloud load balancer or a self hosted one like traefik. the load balancer should be configured to route traffic to both nodes pangolin UI and . the load balancer should also have a health check configured to check the /ping endpoint on both nodes. if a node is unhealthy, the load balancer should stop routing traffic to that node.
 todo: we should put the dynamic config back on both nodes so that all the upstream LB has to do is route to one entrypoint and we deal with the pangolin routing downstream like the websocket and api and stuff
 troubleshooting:
 if you run into loopback issues with the local pangolin instance not being able to address the local gerbil at the IP of the host programmed in reachble at in the docker compose file then you can set the following in the private config file. this will force it to address the docker container instead.
 ```
 gerbil: 
    local_exit_node_reachable_at: "http://gerbil:3004"
 ```
@@ -1,23 +0,0 @@
 services:
  postgres:
    image: postgres:17
    container_name: postgres
    environment:
      POSTGRES_DB: postgres # Default database name
      POSTGRES_USER: postgres # Default user
      POSTGRES_PASSWORD: password # Default password (change for production!)
    volumes:
      - postgres_data:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    restart: always
  redis:
    image: redis:latest
    container_name: redis
    ports:
      - "6379:6379"
    restart: always
 volumes:
  postgres_data:
@@ -1,38 +0,0 @@
 # To see all available options, please visit the docs:
 # https://docs.pangolin.net/
 gerbil:
    start_port: 51820
    base_endpoint: "<THIS_NODE_EXTERNAL_IP>"
    exit_node_name: "node1"
 app:
    dashboard_url: "https://pangolin.example.com"
    log_level: "info"
 postgres:
    connection_string: postgresql://<POSTGRES_USERNAME>:<POSTGRES_PASSWORD>@<POSTGRES_INTERNAL_HOST>:5432/postgres
 traefik:
    site_types: ["newt"] # Wireguard and local sites are not support in clustering
    file_mode: true # Pangolin will generate and save yaml files in a shared volume
 server:
    secret: "<SECRET>"
    cors:
        origins: ["https://pangolin.example.com"]
        methods: ["GET", "POST", "PUT", "DELETE", "PATCH"]
        allowed_headers: ["X-CSRF-Token", "Content-Type"]
        credentials: false
    maxmind_db_path: "./config/GeoLite2-Country.mmdb" # Make sure to download and place into the config dir
    maxmind_asn_path: "./config/GeoLite2-ASN.mmdb"
 flags:
    require_email_verification: false
    disable_signup_without_invite: true
    disable_user_create_org: false
    allow_raw_resources: false
    enable_acme_cert_sync: false
    disable_local_sites: true
    disable_basic_wireguard_sites: true
    disable_config_managed_domains: true
@@ -1,67 +0,0 @@
 http:
  middlewares:
    badger:
      plugin:
        badger:
          disableForwardAuth: true
  routers:
    # Next.js router (handles everything except API and WebSocket paths)
    next-router:
      rule: "!PathPrefix(`/api/v1`)"
      service: next-service
      entryPoints:
        - dashboard
      middlewares:
        - badger
    # API router (handles /api/v1 paths)
    api-router:
      rule: "PathPrefix(`/api/v1`)"
      service: api-service
      entryPoints:
        - dashboard
      middlewares:
        - badger
    # WebSocket router
    ws-router:
      rule: "PathPrefix(`/`)"
      service: api-service
      entryPoints:
        - dashboard
      middlewares:
        - badger
  services:
    next-service:
      loadBalancer:
        servers:
          - url: "http://pangolin:3002"  # Next.js server
    api-service:
      loadBalancer:
        servers:
          - url: "http://pangolin:3000"  # API/WebSocket server
 tcp:
  serversTransports:
    pp-transport-v1:
      proxyProtocol:
        version: 1
    pp-transport-v2:
      proxyProtocol:
        version: 2
 udp:
  routers:
    dns-router:
      entryPoints:
        - dns
      service: dns-service
  services:
    dns-service:
      loadBalancer:
        servers:
          - address: "pangolin:53"
@@ -1,18 +0,0 @@
 app:
  region: "region1"
  identity_provider_mode: "org"
 redis:
  host: "<REDIS_INTERNAL_HOST>"
  port: 6379
 flags:
  enable_redis: true
  use_pangolin_dns: true
 acme:
  cert_mode: "pangolin"
  contact_email: "<CONTACT_EMAIL>"
  enable_acme_client: true
 dns:
  enabled: true
  nameserver_name: "ns.example.com"
  cname_extension: "cname.example.com"
  site_extension: "site.example.com" # Optional
@@ -1,45 +0,0 @@
 providers:
  file:
    directory: "/var/dynamic"
    watch: true
 experimental:
  plugins:
    badger:
      moduleName: "github.com/fosrl/badger"
      version: "v1.7.0"
 log:
  level: "INFO"
  format: "common"
  maxSize: 100
  maxBackups: 3
  maxAge: 3
  compress: true
 entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"
    proxyProtocol: # Just accept everything for now!
      trustedIPs:
        - 0.0.0.0/0
        - ::1/128
    transport:
      respondingTimeouts:
        readTimeout: "30m"
    http:
      encodedCharacters:
        allowEncodedSlash: true
        allowEncodedQuestionMark: true
  dashboard:
    address: ":3000"
  dns:
    address: ":53/udp"
 serversTransport:
  insecureSkipVerify: true
 ping:
  entryPoint: "web"
@@ -1,62 +0,0 @@
 name: pangolin
 services:
  pangolin:
    image: docker.io/fosrl/pangolin:ee-latest
    container_name: pangolin
    restart: unless-stopped
    volumes:
      - ./config:/app/config
      - ./config/certificates:/var/certificates
      - ./config/dynamic:/var/dynamic
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"]
      interval: "10s"
      timeout: "10s"
      retries: 15
  gerbil:
    image: docker.io/fosrl/gerbil:latest
    container_name: gerbil
    restart: unless-stopped
    depends_on:
      pangolin:
        condition: service_healthy
    command:
      - --reachableAt=http://<NODE1_INTERNAL_IP>:3004
      - --generateAndSaveKeyTo=/var/config/key
      - --remoteConfig=http://pangolin:3001/api/v1/
      - --trusted-upstreams=<NODE1_EXTERNAL_IP>,<NODE2_EXTERNAL_IP>
    volumes:
      - ./config/:/var/config
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    ports:
      - 51820:51820/udp # wireguard
      - 21820:21820/udp # relay
      - 53:53/udp # DNS
      - 443:8443 # resources
      - 80:80 # web
      - 3004:3004 # gerbil api
      - 3000:3000 # Pangolin UI
  traefik:
    image: docker.io/traefik:v3.7.11
    container_name: traefik
    restart: unless-stopped
    network_mode: service:gerbil # Ports appear on the gerbil service
    depends_on:
      pangolin:
        condition: service_healthy
    command:
      - --configFile=/etc/traefik/traefik_config.yml
    volumes:
      - ./config/traefik:/etc/traefik:ro
      - ./config/traefik/logs:/var/log/traefik
      - ./config/certificates:/var/certificates:ro
      - ./config/dynamic:/var/dynamic:ro
 networks:
  default:
    driver: bridge
    name: pangolin
@@ -1,38 +0,0 @@
 # To see all available options, please visit the docs:
 # https://docs.pangolin.net/
 gerbil:
    start_port: 51820
    base_endpoint: "<THIS_NODE_EXTERNAL_IP>"
    exit_node_name: "node2"
 app:
    dashboard_url: "https://pangolin.example.com"
    log_level: "info"
 postgres:
    connection_string: postgresql://<POSTGRES_USERNAME>:<POSTGRES_PASSWORD>@<POSTGRES_INTERNAL_HOST>:5432/postgres
 traefik:
    site_types: ["newt"] # Wireguard and local sites are not support in clustering
    file_mode: true # Pangolin will generate and save yaml files in a shared volume
 server:
    secret: "<SECRET>"
    cors:
        origins: ["https://pangolin.example.com"]
        methods: ["GET", "POST", "PUT", "DELETE", "PATCH"]
        allowed_headers: ["X-CSRF-Token", "Content-Type"]
        credentials: false
    maxmind_db_path: "./config/GeoLite2-Country.mmdb" # Make sure to download and place into the config dir
    maxmind_asn_path: "./config/GeoLite2-ASN.mmdb"
 flags:
    require_email_verification: false
    disable_signup_without_invite: true
    disable_user_create_org: false
    allow_raw_resources: false
    enable_acme_cert_sync: false
    disable_local_sites: true 
    disable_basic_wireguard_sites: true
    disable_config_managed_domains: true
@@ -1,67 +0,0 @@
 http:
  middlewares:
    badger:
      plugin:
        badger:
          disableForwardAuth: true
  routers:
    # Next.js router (handles everything except API and WebSocket paths)
    next-router:
      rule: "!PathPrefix(`/api/v1`)"
      service: next-service
      entryPoints:
        - dashboard
      middlewares:
        - badger
    # API router (handles /api/v1 paths)
    api-router:
      rule: "PathPrefix(`/api/v1`)"
      service: api-service
      entryPoints:
        - dashboard
      middlewares:
        - badger
    # WebSocket router
    ws-router:
      rule: "PathPrefix(`/`)"
      service: api-service
      entryPoints:
        - dashboard
      middlewares:
        - badger
  services:
    next-service:
      loadBalancer:
        servers:
          - url: "http://pangolin:3002"  # Next.js server
    api-service:
      loadBalancer:
        servers:
          - url: "http://pangolin:3000"  # API/WebSocket server
 tcp:
  serversTransports:
    pp-transport-v1:
      proxyProtocol:
        version: 1
    pp-transport-v2:
      proxyProtocol:
        version: 2
 udp:
  routers:
    dns-router:
      entryPoints:
        - dns
      service: dns-service
  services:
    dns-service:
      loadBalancer:
        servers:
          - address: "pangolin:53"
@@ -1,16 +0,0 @@
 app:
  region: "region1"
  identity_provider_mode: "org"
 redis:
  host: "<REDIS_INTERNAL_HOST>"
  port: 6379
 flags:
  enable_redis: true
  use_pangolin_dns: true
 acme:
  cert_mode: "pangolin"
 dns:
  enabled: true
  nameserver_name: "ns.example.com"
  cname_extension: "cname.example.com"
  site_extension: "site.example.com" # Optional
@@ -1,45 +0,0 @@
 providers:
  file:
    directory: "/var/dynamic"
    watch: true
 experimental:
  plugins:
    badger:
      moduleName: "github.com/fosrl/badger"
      version: "v1.7.0"
 log:
  level: "INFO"
  format: "common"
  maxSize: 100
  maxBackups: 3
  maxAge: 3
  compress: true
 entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"
    proxyProtocol: # Just accept everything for now!
      trustedIPs:
        - 0.0.0.0/0
        - ::1/128
    transport:
      respondingTimeouts:
        readTimeout: "30m"
    http:
      encodedCharacters:
        allowEncodedSlash: true
        allowEncodedQuestionMark: true
  dashboard:
    address: ":3000"
  dns:
    address: ":53/udp"
 serversTransport:
  insecureSkipVerify: true
 ping:
  entryPoint: "web"
@@ -1,62 +0,0 @@
 name: pangolin
 services:
  pangolin:
    image: docker.io/fosrl/pangolin:ee-latest
    container_name: pangolin
    restart: unless-stopped
    volumes:
      - ./config:/app/config
      - ./config/certificates:/var/certificates
      - ./config/dynamic:/var/dynamic
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"]
      interval: "10s"
      timeout: "10s"
      retries: 15
  gerbil:
    image: docker.io/fosrl/gerbil:latest
    container_name: gerbil
    restart: unless-stopped
    depends_on:
      pangolin:
        condition: service_healthy
    command:
      - --reachableAt=http://<NODE1_INTERNAL_IP>:3004
      - --generateAndSaveKeyTo=/var/config/key
      - --remoteConfig=http://pangolin:3001/api/v1/
      - --trusted-upstreams=<NODE1_EXTERNAL_IP>,<NODE2_EXTERNAL_IP>
    volumes:
      - ./config/:/var/config
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    ports:
      - 51820:51820/udp # wireguard
      - 21820:21820/udp # relay
      - 53:53/udp # DNS
      - 443:8443 # resources
      - 80:80 # web
      - 3004:3004 # gerbil api
      - 3000:3000 # Pangolin UI 
  traefik:
    image: docker.io/traefik:v3.7.11
    container_name: traefik
    restart: unless-stopped
    network_mode: service:gerbil # Ports appear on the gerbil service
    depends_on:
      pangolin:
        condition: service_healthy
    command:
      - --configFile=/etc/traefik/traefik_config.yml
    volumes:
      - ./config/traefik:/etc/traefik:ro
      - ./config/traefik/logs:/var/log/traefik
      - ./config/certificates:/var/certificates:ro
      - ./config/dynamic:/var/dynamic:ro
 networks:
  default:
    driver: bridge
    name: pangolin
@@ -1,47 +1,54 @@
 api:
  insecure: true
  dashboard: true
 providers:
  http:
-    endpoint: http://pangolin:3001/api/v1/traefik-config
+    endpoint: "http://pangolin:3001/api/v1/traefik-config"
-    pollInterval: 5s
+    pollInterval: "5s"
  file:
-    filename: /etc/traefik/dynamic_config.yml
+    filename: "/etc/traefik/dynamic_config.yml"
 experimental:
  plugins:
    badger:
-      moduleName: github.com/fosrl/badger
+      moduleName: "github.com/fosrl/badger"
-      version: v1.4.1
+      version: "{{.BadgerVersion}}"
 log:
-  level: INFO
+  level: "INFO"
-  format: common
+  format: "common"
  maxSize: 100
  maxBackups: 3
  maxAge: 3
  compress: true
 certificatesResolvers:
  letsencrypt:
    acme:
      httpChallenge:
        entryPoint: web
-      email: '{{.LetsEncryptEmail}}'
+      email: "{{.LetsEncryptEmail}}"
-      storage: /letsencrypt/acme.json
+      storage: "/letsencrypt/acme.json"
-      caServer: https://acme-v02.api.letsencrypt.org/directory
+      caServer: "https://acme-v02.api.letsencrypt.org/directory"
 entryPoints:
  web:
-    address: ':80'
+    address: ":80"
  websecure:
-    address: ':443'
+    address: ":443"
    transport:
      respondingTimeouts:
-        readTimeout: 30m
+        readTimeout: "30m"
    http:
      tls:
-        certResolver: letsencrypt
+        certResolver: "letsencrypt"
      encodedCharacters:
        allowEncodedSlash: true
        allowEncodedQuestionMark: true
 serversTransport:
  insecureSkipVerify: true
 ping:
-  entryPoint: web
+  entryPoint: "web"
@@ -41,7 +41,7 @@ services:
      - 80:80 # Port for traefik because of the network_mode
  traefik:
-    image: traefik:v3.7
+    image: traefik:v3.6
    container_name: traefik
    restart: unless-stopped
    network_mode: service:gerbil # Ports appear on the gerbil service
@@ -8,7 +8,7 @@ services:
      POSTGRES_USER: postgres # Default user
      POSTGRES_PASSWORD: password # Default password (change for production!)
    volumes:
-      - ${HOME}/.local/share/pangolin-dev/postgres:/var/lib/postgresql/data
+      - ./config/postgres:/var/lib/postgresql/data
    ports:
      - "5432:5432" # Map host port 5432 to container port 5432
    restart: no
@@ -1,350 +0,0 @@
 # AI Gateway Provider Selection
 How the AI gateway picks which attached provider handles a request when an
 inference resource has more than one AI provider.
 **Code:**
 - Route → capability binding: `server/routers/aiGateway/createAiGatewayRouter.ts`
 - Request pipeline: `server/routers/aiGateway/pipeline.ts` (`selectProvider`)
 - Model discovery: `server/routers/aiGateway/v1Models.ts` and
  `server/lib/aiModelDiscovery.ts`
 - Tie-break scoring: `server/lib/aiProviderSelection.ts`
 - Allow/block matching: `server/lib/aiModelKeyMatch.ts`
 - Model catalog: `server/lib/aiModelCatalog.ts`
 - Default capabilities per provider type: `server/lib/aiProviderDefaults.ts`
 Overlapping model allows are permitted at save time. Selection happens at
 request time. If the algorithm cannot confidently pick one provider, the
 gateway returns `403` with an ambiguous-provider error.
 ## Selection Pipeline
 Every gateway request runs through these steps in order. Each step narrows
 the candidate set. Later steps only run when more than one provider remains.
 ```
 1. Capability filter
 2. Allow / block lists
 3. Most specific allow pattern
 4. Catalog ownership
 5. Provider class preference
 6. Ambiguous → error
 ```
 ### 1. Capability Filter
 The incoming path selects a capability before any provider logic runs.
 | Path | Capability |
 |------|------------|
 | `POST /v1/chat/completions` | `openai_chat` |
 | `POST /v1/responses` | `openai_responses` |
 | `POST /v1/messages` | `anthropic_messages` |
 | `GET /v1/models`, `GET /v1/models/{id}` | `v1_models` |
 | Gemini / Vertex / Bedrock routes | their respective capability ids |
 Only attached providers that advertise that capability stay in the candidate
 set. Default capabilities do not overlap for native OpenAI vs Anthropic:
 | Provider type | Default capabilities |
 |---------------|----------------------|
 | `openai` | `openai_chat`, `openai_responses` |
 | `anthropic` | `anthropic_messages`, `v1_models` |
 | `openRouter` | `openai_chat` |
 | `vercelAiGateway` | `openai_chat`, `openai_responses` |
 | `microsoftFoundry` | `openai_chat`, `openai_responses`, `anthropic_messages`, `v1_models` |
 | `custom` | whatever was configured |
 ### 2. Allow / Block Lists
 For each remaining provider, the gateway resolves the effective allow and
 block patterns:
 - **`inherit`**: use the provider's own model lists
 - **`select`**: use the resource-selected subset of those lists
 A candidate is kept only if `isAllowedByLists(requestedModel, allows, blocks)`
 passes:
 1. At least one allow pattern must match
 2. No block pattern may match
 Patterns support `*` and `?` globs (`gpt-*`, `claude-3-5-sonnet-?`).
 ### 3. Most Specific Allow Pattern
 Among providers that allow the model, keep those whose matching allow
 pattern is most specific:
 1. Exact keys beat patterns
 2. Fewer wildcard characters win
 3. Longer literal length wins
 Example: `gpt-4o` beats `gpt-*` beats `*`.
 ### 4. Catalog Ownership
 When specificity is tied (common with multiple `*` allows), score each
 provider against the known model catalog:
 | Score | Meaning |
 |------:|---------|
 | 2 | Typed provider whose catalog contains the model (`openai` → openai catalog, `anthropic` → anthropic, etc.) |
 | 1 | Aggregator or custom (`openRouter`, `vercelAiGateway`, `custom`) and the model exists somewhere in the catalog |
 | 0 | No ownership signal (typed catalog miss, or unknown model on aggregator/custom) |
 Model id lookup tries the raw id, then a stripped `vendor/model` form
 (e.g. `openai/gpt-4o` → also try `gpt-4o`).
 Typed providers map to catalog providers as:
 | Provider type | Catalog |
 |---------------|---------|
 | `openai` | `openai` |
 | `anthropic` | `anthropic` |
 | `googleGemini` | `gemini` |
 | `vertexAi` | `vertex` |
 | `bedrock` | `bedrock` |
 | `microsoftFoundry` | `azure` |
 | `openRouter` / `vercelAiGateway` / `custom` | none (aggregator/custom path) |
 ### 5. Provider Class Preference
 If catalog ownership is still tied, prefer:
 | Rank | Class |
 |-----:|-------|
 | 2 | Native typed provider (`openai`, `anthropic`, `googleGemini`, …) |
 | 1 | Aggregator (`openRouter`, `vercelAiGateway`) |
 | 0 | `custom` |
 ### 6. Ambiguous Error
 If more than one distinct provider remains after all steps, the gateway
 rejects the request:
 ```
 Model "<id>" is ambiguous across multiple AI providers on this resource
 ```
 Typical remaining ties: two OpenAI-type providers both with `*`, or two
 customs advertising the same capability for an unknown model.
 ## Model Discovery Is Not Selection
 `GET /v1/models` and `GET /v1/models/{id}` (`v1_models`) skip steps 3-6
 entirely. There is no requested model to disambiguate on, so the gateway does
 not pick one provider - it returns the **union** of what every attached
 provider advertising `v1_models` would accept, deduplicated by model id
 (lowest `providerId` wins a collision).
 Discovery is answered from the gateway's own view of the allow/block lists,
 never proxied upstream. Providers that expose no `/v1/models` endpoint of their
 own still get a working listing, and a model an allow/block list forbids is
 never advertised.
 Each provider's candidate ids come from two places:
 | Source | Contributes |
 |--------|-------------|
 | Exact (non-wildcard) allow entries | the model key itself |
 | The model catalog for the provider's type | every catalog id matching an allow pattern |
 Both sources are then filtered through the same
 `isAllowedByLists(id, allows, blocks)` check step 2 applies, so a block pattern
 hides a model from discovery exactly as it would reject it at request time.
 The catalog source is what makes a wildcard allow such as `claude-*`
 enumerable. Provider types with no catalog mapping (`openRouter`,
 `vercelAiGateway`, `custom`) have nothing to expand against, so a wildcard
 allow on those types lists nothing - **add exact allow entries to make their
 models discoverable.**
 ### Where each field comes from
 Token limits and capability flags can't be derived from an allow/block list.
 They come from the model catalog (`server/lib/aiModelCatalog.ts`), which the
 Fossorial API builds from LiteLLM:
 | Field | Source |
 |-------|--------|
 | `max_input_tokens` | catalog `limits.input` |
 | `max_tokens` | catalog `limits.output` |
 | `capabilities` | catalog flags, mapped to the Models API shape by `capabilitiesFromCatalog` |
 | `display_name` | the configured model row's name, else the model id |
 | `created_at` | the configured model row's timestamp, else the epoch |
 A model the catalog doesn't know (an exact allow entry for a fine-tune, say)
 reports `null` for all three metadata fields. The Models API declares them
 nullable, so that is a valid answer rather than a broken one.
 The catalog's flags are coarser than the Models API describes: it carries a
 single `reasoning` flag with no way to distinguish adaptive from
 `budget_tokens`-style thinking, and nothing at all for batch, citations, code
 execution, PDF input, or context management. Anything it reports as unknown
 (`null`) is surfaced as unsupported rather than invented, so `capabilities`
 understates rather than overstates what a model can do.
 The gateway does **not** query the provider's own `/v1/models`. Discovery is
 answered entirely from local state.
 Results are ordered newest-first with the id as tie-break, and paginated with
 Anthropic's `limit` / `after_id` / `before_id` semantics (default 20, max
 1000).
 ## Examples
 Assume each provider below is attached and enabled on the same inference
 resource.
 ### Example A: OpenAI + Anthropic, Both `*`
 | Provider | Allow | Capabilities |
 |----------|-------|--------------|
 | OpenAI | `*` | `openai_chat`, `openai_responses` |
 | Anthropic | `*` | `anthropic_messages` |
 **Request:** `POST /v1/chat/completions` with `model: "gpt-4o"`
 1. Capability → only OpenAI remains
 2. Allow → OpenAI matches `*`
 3. Result → **OpenAI**
 Anthropic never reaches pattern or catalog scoring. Capability alone decides.
 **Request:** `POST /v1/messages` with `model: "claude-3-5-sonnet-latest"`
 1. Capability → only Anthropic remains
 2. Result → **Anthropic**
 ### Example B: OpenAI + OpenRouter, Both `*`
 | Provider | Allow | Capabilities |
 |----------|-------|--------------|
 | OpenAI | `*` | `openai_chat`, … |
 | OpenRouter | `*` | `openai_chat` |
 **Request:** `POST /v1/chat/completions` with `model: "gpt-4o"`
 1. Capability → both remain (`openai_chat`)
 2. Allow → both match `*`
 3. Specificity → tie (`*` vs `*`)
 4. Catalog → OpenAI scores `2` (owns `gpt-4o`); OpenRouter scores `1`
 5. Result → **OpenAI**
 ### Example C: OpenRouter Only Serving a Claude Model Over OpenAI Chat
 | Provider | Allow | Capabilities |
 |----------|-------|--------------|
 | OpenRouter | `*` | `openai_chat` |
 **Request:** `POST /v1/chat/completions` with `model: "anthropic/claude-3.5-sonnet"`
 1. Capability → OpenRouter remains
 2. Only one candidate → **OpenRouter**
 No tie-breaking needed.
 ### Example D: OpenAI (`gpt-*`) + OpenRouter (`*`)
 | Provider | Allow |
 |----------|-------|
 | OpenAI | `gpt-*` |
 | OpenRouter | `*` |
 **Request:** `model: "gpt-4o"` on `openai_chat`
 1. Capability → both
 2. Allow → both match
 3. Specificity → OpenAI's `gpt-*` beats OpenRouter's `*`
 4. Result → **OpenAI**
 Catalog scoring is not needed because specificity already unique'd the set.
 ### Example E: OpenAI + Anthropic With Overlapping Custom Capabilities
 Someone grants Anthropic `openai_chat` as well (non-default).
 | Provider | Allow | Capabilities |
 |----------|-------|--------------|
 | OpenAI | `*` | `openai_chat`, … |
 | Anthropic | `*` | `anthropic_messages`, `openai_chat` |
 **Request:** `POST /v1/chat/completions` with `model: "gpt-4o"`
 1. Capability → both remain
 2. Allow → both match `*`
 3. Specificity → tie
 4. Catalog → OpenAI `2`, Anthropic `0` (`gpt-4o` is not in the anthropic catalog)
 5. Result → **OpenAI**
 ### Example F: Two Aggregators, Known Model
 | Provider | Allow |
 |----------|-------|
 | OpenRouter | `*` |
 | Vercel AI Gateway | `*` |
 **Request:** `model: "gpt-4o"` on `openai_chat`
 1. Capability → both
 2. Allow / specificity → tie
 3. Catalog → both score `1` (known model, no typed owner in the set)
 4. Class → both aggregators (rank `1`) → still tied
 5. Result → **ambiguous error**
 Attach a native OpenAI provider (or narrow one aggregator's allow list) to
 make this determinable.
 ### Example G: Two OpenAI Providers, Both `*`
 | Provider | Type | Allow |
 |----------|------|-------|
 | OpenAI Prod | `openai` | `*` |
 | OpenAI Staging | `openai` | `*` |
 **Request:** `model: "gpt-4o"`
 1–5 all leave both candidates (same capability, same specificity, same
 catalog ownership, same class).
 Result → **ambiguous error**
 Disambiguate with different allow patterns, disable one attachment, or
 split across resources.
 ### Example H: Unknown Model Across Native + Aggregator
 | Provider | Allow |
 |----------|-------|
 | OpenAI | `*` |
 | OpenRouter | `*` |
 **Request:** `model: "my-fine-tune-v3"` (not in catalog)
 1. Capability → both
 2. Allow / specificity → tie
 3. Catalog → both score `0` (typed miss + unknown aggregator model)
 4. Class → OpenAI (`2`) beats OpenRouter (`1`)
 5. Result → **OpenAI**
 ## Practical Guidance
 - Native OpenAI + Anthropic with `*` is safe. Different default APIs never
  collide.
 - OpenAI + OpenRouter with `*` is usually fine for catalog-known OpenAI
  models. Native wins.
 - Prefer specific allow patterns (`gpt-4o`, `gpt-*`) when two providers share
  a capability.
 - Two providers of the same type both using `*` will stay ambiguous. Narrow
  at least one allow list.
 - Custom providers only win ties when no stronger native/aggregator signal
  remains.
 ## Related Behavior
 - **Saving providers on a resource does not reject overlapping allows.**
  Collisions are resolved (or rejected) per request.
 - Budgets, auth, and upstream URL / target routing run after a single
  provider has been selected.
@@ -1,347 +0,0 @@
 # How to build a CRUD endpoint in this repo
 Reference for adding a new CRUD entity to the server. Based on two real
 examples already in the codebase — read them side by side with this doc:
 - **Public / open-source (Community Edition) pattern**: `server/routers/aiProvider/`
 - **Enterprise-only pattern**: `server/private/routers/alertRule/`
 The two are structurally identical. The only difference is *where the files
 live* and *which router they get wired into*.
 ## 1. Decide: public or private?
 - `server/routers/<entity>/` — ships in the open-source Community Edition.
  Anyone running Pangolin gets this.
 - `server/private/routers/<entity>/` — Enterprise/SaaS only. Gated behind
  `verifyValidLicense` (and often `verifyValidSubscription(tierMatrix.x)`).
  Every file here starts with the Fossorial Commercial License header block
  (copy it verbatim from an existing private file).
 Everything below applies to both — swap `@server/...` for `#private/...`
 import paths and add license headers when building the private version.
 ## 2. Directory layout
 One folder per entity, one file per operation, a barrel `index.ts`:
 ```
 server/routers/<entity>/
  index.ts          # export * from each operation file + ./types
  types.ts          # response payload types + row->public mapper
  validation.ts      # zod schemas/refinements shared by create + update (optional)
  create<Entity>.ts
  list<Entities>.ts
  get<Entity>.ts
  update<Entity>.ts
  delete<Entity>.ts
 ```
 `index.ts` is a flat barrel:
 ```ts
 export * from "./createAiProvider";
 export * from "./listAiProviders";
 export * from "./getAiProvider";
 export * from "./updateAiProvider";
 export * from "./deleteAiProvider";
 export * from "./types";
 ```
 ## 3. Anatomy of a single handler
 Every handler file (`create<Entity>.ts`, etc.) follows the same shape:
 ```ts
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { <table>, db } from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
 import { eq } from "drizzle-orm";
 import type { GetXResponse } from "@server/routers/<entity>/types";
 const paramsSchema = z.strictObject({
    orgId: z.string().nonempty()          // or entityId: z.coerce.number().int().positive()
 });
 const bodySchema = z.strictObject({ /* ... */ }); // create/update only
 registry.registerPath({
    method: "get", // put | post | delete
    path: "/org/{orgId}/x",
    description: "...",
    tags: [OpenAPITags.<Entity>],
    request: { params: paramsSchema, /* body: {...} for write ops, query: for list */ },
    responses: { 200: { description: "Successful response" } }
 });
 export async function getX(req: Request, res: Response, next: NextFunction): Promise<any> {
    try {
        const parsedParams = paramsSchema.safeParse(req.params);
        if (!parsedParams.success) {
            return next(createHttpError(HttpCode.BAD_REQUEST, fromError(parsedParams.error).toString()));
        }
        // parse body too, if present, same pattern
        // ...business logic against db...
        if (!row) {
            return next(createHttpError(HttpCode.NOT_FOUND, `X with ID ${id} not found`));
        }
        return response<GetXResponse>(res, {
            data: { /* ... */ },
            success: true,
            error: false,
            message: "X retrieved successfully",
            status: HttpCode.OK
        });
    } catch (error) {
        logger.error(error);
        return next(createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred"));
    }
 }
 ```
 Rules to keep consistent with the rest of the codebase:
 - `z.strictObject` for params/body — rejects unknown keys.
 - Params parsed first, then body; each on its own `safeParse` + early
  `next(createHttpError(...))` — never throw raw errors.
 - Every handler registers itself with the OpenAPI `registry` even if nobody
  reads the spec directly — it's how `/api/v1/docs` stays accurate.
 - Catch-all `try/catch` at the bottom: `logger.error(error)` +
  generic `500` message. Never leak internal error details to the client.
 - Use `response<T>(res, { data, success, error, message, status })` from
  `@server/lib/response` for every response, success or otherwise (errors go
  through `next(createHttpError(...))` instead, not through `response`).
 - If the route already ran an access-control middleware that fetched the row
  (see §5), reuse it instead of re-querying:
  `req.aiProvider && req.aiProvider.providerId === providerId ? [req.aiProvider] : await db.select()...`
 ### List handler specifics
 Pagination is a fixed shape (`page`, `pageSize`, optional `query` for
 search). See `listAiProviders.ts`:
 ```ts
 const listSchema = z.object({
    pageSize: z.coerce.number<string>().int().positive().optional().catch(20).default(20),
    page: z.coerce.number<string>().int().min(0).optional().catch(1).default(1),
    query: z.string().optional()
 });
 ```
 Run the count query and the page query in `Promise.all`, and return
 `PaginatedResponse<{ items: T[] }>` (`@server/types/Pagination`) with
 `{ total, pageSize, page }`.
 ### types.ts specifics
 - Define one response type per operation: `List<Entities>Response`,
  `Get<Entity>Response`, `CreateOrEdit<Entity>Response` (create and update
  commonly share a response shape).
 - If the raw DB row needs to be shaped for clients (decrypting secrets,
  parsing a serialized column, hiding a column), put a `toPublic<Entity>()`
  mapper here — see `toPublicAiProvider` for the pattern of stripping
  `apiKey`/serialized columns and re-adding decrypted/parsed versions.
 ### validation.ts specifics
 Only needed when create and update share non-trivial zod pieces (enums,
 `superRefine` cross-field rules). Export the raw schemas (`z.enum([...])`)
 and refinement functions, and import them into both `createX.ts` and
 `updateX.ts` — see `aiProvider/validation.ts`'s
 `refineProviderUpstreamFields`.
 ## 4. Wire up an access-control middleware (for id-scoped routes)
 For routes scoped to a single row (`/x/:xId`, as opposed to
 `/org/:orgId/x` create/list), add a `verify<Entity>Access` middleware in
 `server/middlewares/` (or `server/private/middlewares/` for enterprise-only
 entities) and export it from that directory's `index.ts`.
 Pattern (`verifyAiProviderAccess.ts`):
 1. Read the id param, `Number.parseInt`/validate it.
 2. Load the row by id.
 3. `404` if it doesn't exist.
 4. Resolve the row's `orgId`, then check/attach `req.userOrg` (query
   `userOrgs` if not already on the request), `403` if the user isn't in
   that org.
 5. Run `checkOrgAccessPolicy` if `req.orgPolicyAllowed` hasn't been resolved
   yet.
 6. Set `req.userOrgId`, `req.userOrgRoleIds`, and stash the row on the
   request (e.g. `req.aiProvider = provider`) so downstream handlers and
   `verifyUserHasAction` don't have to refetch it.
 Org-scoped create/list routes (`/org/:orgId/x`) don't need a bespoke
 middleware — they use the existing generic `verifyOrgAccess` from
 `@server/middlewares`.
 ## 5. Register an action + permission check
 Add one `ActionsEnum` entry per operation in `server/auth/actions.ts`,
 grouped near the entity's other actions, named `create<Entity>`,
 `get<Entity>`, `update<Entity>`, `delete<Entity>`, `list<Entities>`:
 ```ts
 createAiProvider = "createAiProvider",
 deleteAiProvider = "deleteAiProvider",
 getAiProvider = "getAiProvider",
 listAiProviders = "listAiProviders",
 updateAiProvider = "updateAiProvider",
 ```
 Every route uses `verifyUserHasAction(ActionsEnum.x)` to check the caller's
 role/permissions for that action, and mutating routes (create/update/delete)
 follow it with `logActionAudit(ActionsEnum.x)` to record the action in the
 audit log.
 ## 6. Register the routes
 There are four router files; which one(s) you touch depends on public vs.
 private and user-facing vs. service-to-service:
 | File | Purpose |
 |---|---|
 | `server/routers/external.ts` | Public, user-facing API. Exports `authenticated`, `unauthenticated`, `authRouter` Express routers. |
 | `server/routers/internal.ts` | Public, internal service-to-service API (gerbil, badger, traefik-config) — no user auth, exports `internalRouter`. |
 | `server/private/routers/external.ts` | Enterprise-only, user-facing. Imports `authenticated`/`unauthenticated`/`authRouter` **from the public `external.ts`** and re-exports them, then adds more routes on top. |
 | `server/private/routers/internal.ts` | Enterprise-only, service-to-service. Same re-export trick with `internalRouter`. |
 Private router files always start:
 ```ts
 import {
    unauthenticated as ua,
    authenticated as a,
    authRouter as aa
 } from "@server/routers/external";
 export const authenticated = a;
 export const unauthenticated = ua;
 export const authRouter = aa;
 ```
 ...and then call `authenticated.get/put/post/delete(...)` to bolt on
 additional, enterprise-only routes on the *same* router instances the public
 build uses. This is why the private build has strictly more routes than the
 public build, not a divergent copy.
 ### Route registration order (mutating vs read)
 Standard middleware chain per verb, using `alertRule`'s registrations as the
 template:
 ```ts
 // Create — org-scoped, no row exists yet
 authenticated.put(
    "/org/:orgId/x",
    verifyValidLicense,              // private/enterprise routes only
    verifyOrgAccess,
    verifyLimits,                    // if the entity counts against a plan limit
    verifyUserHasAction(ActionsEnum.createX),
    logActionAudit(ActionsEnum.createX),
    x.createX
 );
 // Update — row-scoped
 authenticated.post(
    "/org/:orgId/x/:xId",            // or "/x/:xId" if id is globally unique
    verifyValidLicense,
    verifyOrgAccess,                 // or verifyXAccess if globally-keyed
    verifyUserHasAction(ActionsEnum.updateX),
    logActionAudit(ActionsEnum.updateX),
    x.updateX
 );
 // Delete — row-scoped
 authenticated.delete(
    "/org/:orgId/x/:xId",
    verifyValidLicense,
    verifyOrgAccess,
    verifyUserHasAction(ActionsEnum.deleteX),
    logActionAudit(ActionsEnum.deleteX),
    x.deleteX
 );
 // List — org-scoped, read-only, no audit log
 authenticated.get(
    "/org/:orgId/xs",
    verifyValidLicense,
    verifyOrgAccess,
    verifyUserHasAction(ActionsEnum.listXs),
    x.listXs
 );
 // Get one — row-scoped, read-only, no audit log
 authenticated.get(
    "/org/:orgId/x/:xId",
    verifyValidLicense,
    verifyOrgAccess,
    verifyUserHasAction(ActionsEnum.getX),
    x.getX
 );
 ```
 Notes:
 - HTTP verbs: `PUT` = create, `POST` = update, `GET` = read, `DELETE` =
  delete. This repo does not use `PATCH` for entity updates (site
  provisioning keys are the one exception, using `PATCH`).
 - `verifyValidLicense` is only needed on private/enterprise routes; public
  OSS routes skip it.
 - Use `verifyValidSubscription(tierMatrix.someFeature)` right after
  `verifyValidLicense` when a feature is gated to specific SaaS tiers (see
  `tierMatrix` usages in `server/private/routers/external.ts`).
 - `verifyLimits` goes on create routes for entities that count against a
  plan/seat limit.
 - For entities keyed by a globally-unique id (not nested under `/org/:orgId`),
  use the dedicated `verify<Entity>Access` middleware from §4 instead of
  `verifyOrgAccess` on the row-scoped routes (see how `/ai-provider/:providerId`
  uses `verifyAiProviderAccess`, while `/org/:orgId/ai-provider` create/list
  use plain `verifyOrgAccess`).
 - Read-only routes (`get`, `list`) skip `logActionAudit` — only mutations are
  audited.
 - `internal*.ts` routes are for trusted internal callers (gerbil/badger
  sidecars) and generally skip user-facing auth entirely, using
  `verifySessionUserMiddleware` / `verifyUserFromResourceSessionMiddleware`
  instead of `verifyOrgAccess`/`verifyUserHasAction`. CRUD entities almost
  never need internal router entries — only add one if a sidecar process
  needs direct access to the resource.
 ## 7. The `#dynamic` alias (advanced — most CRUD work can ignore this)
 Some middleware (e.g. `logActionAudit`) needs a real implementation in the
 enterprise/SaaS build but a no-op stub in the open-source build, while
 being imported by identical code in `server/routers/external.ts` in both
 builds. That's done via the `#dynamic/*` import alias, which
 `tsconfig.oss.json` points at `./server/*` and `tsconfig.enterprise.json` /
 `tsconfig.saas.json` point at `./server/private/*`. You only need this
 pattern if you're adding a genuinely dual-implementation hook; a normal
 private-only CRUD entity (like `alertRule`) never touches `#dynamic` — it
 just lives entirely under `server/private/` and is imported with `#private/*`
 directly from `server/private/routers/external.ts`.
 ## 8. Checklist for a new entity
 1. Add the DB table to `server/db/pg/schema/schema.ts` (and sqlite schema if
   applicable).
 2. Add `ActionsEnum` entries in `server/auth/actions.ts`.
 3. Create `server/routers/<entity>/` (or `server/private/routers/<entity>/`):
   `types.ts`, optional `validation.ts`, one file per operation, `index.ts`
   barrel.
 4. If routes are row-scoped by a global id, add
   `verify<Entity>Access.ts` to `server/middlewares/` or
   `server/private/middlewares/`, and export it from that directory's
   `index.ts`.
 5. Wire routes into `external.ts` (public or private) following the verb/
   middleware table in §6. Add to `internal.ts` only if a sidecar needs
   direct access.
 6. Add license header block to every new file if it's under `server/private/`.
@@ -1,4 +1,4 @@
-import { APP_PATH } from "./server/lib/consts";
+import { APP_PATH } from "@server/lib/consts";
 import { defineConfig } from "drizzle-kit";
 import path from "path";
@@ -1,2 +0,0 @@
 tls:
  certificates: []
@@ -1 +0,0 @@
 {}
@@ -22,8 +22,7 @@ server:
        methods: ["GET", "POST", "PUT", "DELETE", "PATCH"]
        allowed_headers: ["X-CSRF-Token", "Content-Type"]
        credentials: false
-    {{if .EnableMaxMind}}maxmind_db_path: "./config/GeoLite2-Country.mmdb"{{end}}
+    {{if .EnableGeoblocking}}maxmind_db_path: "./config/GeoLite2-Country.mmdb"{{end}}
    {{if .EnableMaxMind}}maxmind_asn_path: "./config/GeoLite2-ASN.mmdb"{{end}}
 {{if .EnableEmail}}
 email:
    smtp_host: "{{.EmailSMTPHost}}"
@@ -37,6 +36,3 @@ flags:
    disable_signup_without_invite: true
    disable_user_create_org: false
    allow_raw_resources: true
 {{if .IsPostgreSQL}}postgres:
    connection_string: postgresql://pangolin:{{.IsPostgreSQLPass}}@postgres:5432/pangolin{{end}}
@@ -16,7 +16,7 @@ experimental:
      version: "{{.BadgerVersion}}"
    crowdsec: # CrowdSec plugin configuration added
      moduleName: "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      version: "v1.7.1"
+      version: "v1.4.4"
 log:
  level: "INFO"
@@ -1,23 +1,15 @@
 name: pangolin
 services:
  pangolin:
-    image: docker.io/fosrl/pangolin:{{if .IsEnterprise}}ee-{{end}}{{if .IsPostgreSQL}}postgresql-{{end}}{{.PangolinVersion}}
+    image: docker.io/fosrl/pangolin:{{if .IsEnterprise}}ee-{{end}}{{.PangolinVersion}}
    container_name: pangolin
    restart: unless-stopped
    deploy:
      resources:
        limits:
-          memory: 2g
+          memory: 1g
        reservations:
-          memory: 512m
+          memory: 256m
    {{if or .IsPostgreSQL .IsRedis}}depends_on:
      {{if .IsPostgreSQL}}postgres:
          condition: service_healthy{{end}}
      {{if .IsRedis}}redis:
          condition: service_healthy{{end}}
    networks:
      - default
      - backend{{end}}
    volumes:
      - ./config:/app/config
    healthcheck:
@@ -25,8 +17,8 @@ services:
      interval: "10s"
      timeout: "10s"
      retries: 15
-
+{{if .InstallGerbil}}
-  {{if .InstallGerbil}}gerbil:
+  gerbil:
    image: docker.io/fosrl/gerbil:{{.GerbilVersion}}
    container_name: gerbil
    restart: unless-stopped
@@ -47,16 +39,17 @@ services:
      - 21820:21820/udp
      - 443:443
      - 443:443/udp # For http3 QUIC if desired
-      - 80:80{{end}}
+      - 80:80
-
+{{end}}
  traefik:
-    image: docker.io/traefik:v3.7
+    image: docker.io/traefik:v3.6
    container_name: traefik
    restart: unless-stopped
-    {{if .InstallGerbil}}network_mode: service:gerbil # Ports appear on the gerbil service{{end}}{{if not .InstallGerbil}}
+{{if .InstallGerbil}}    network_mode: service:gerbil # Ports appear on the gerbil service{{end}}{{if not .InstallGerbil}}
    ports:
      - 443:443
-      - 80:80{{end}}
+      - 80:80
 {{end}}
    depends_on:
      pangolin:
        condition: service_healthy
@@ -67,50 +60,8 @@ services:
      - ./config/letsencrypt:/letsencrypt # Volume to store the Let's Encrypt certificates
      - ./config/traefik/logs:/var/log/traefik # Volume to store Traefik logs
  {{if .IsPostgreSQL}}postgres:
    image: postgres:18
    container_name: postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: pangolin
      POSTGRES_PASSWORD: {{.IsPostgreSQLPass}}
      POSTGRES_DB: pangolin
    volumes:
      - ./postgres18:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U pangolin"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - backend{{end}}
  {{if .IsRedis}}redis:
    image: redis:8-trixie
    container_name: redis
    restart: unless-stopped
    command: >
      redis-server
      --save 3600 1000
      --appendonly yes
      --requirepass {{.IsRedisPass}}
    volumes:
      - ./redis8:/data
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "{{.IsRedisPass}}", "ping"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s
    networks:
      - backend{{end}}
 networks:
  default:
    driver: bridge
-    name: pangolin_frontend
+    name: pangolin
 {{if .EnableIPv6}}    enable_ipv6: true{{end}}
 {{if or .IsPostgreSQL .IsRedis}}  backend:
    driver: bridge
    name: pangolin_backend
    internal: true{{end}}
@@ -1,4 +0,0 @@
 {{if .IsRedis}}redis:
  host: "redis"
  port: 6379
  password: "{{.IsRedisPass}}"{{end}}
@@ -5,7 +5,7 @@ go 1.25.0
 require (
 	github.com/charmbracelet/huh v1.0.0
 	github.com/charmbracelet/lipgloss v1.1.0
-	golang.org/x/term v0.45.0
+	golang.org/x/term v0.42.0
 	gopkg.in/yaml.v3 v3.0.1
 )
@@ -33,6 +33,6 @@ require (
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	golang.org/x/sync v0.15.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect
 	golang.org/x/text v0.23.0 // indirect
 )
@@ -69,10 +69,10 @@ golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
 golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
 golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
 golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
@@ -54,13 +54,9 @@ type Config struct {
 	InstallGerbil             bool
 	TraefikBouncerKey         string
 	DoCrowdsecInstall         bool
-	EnableMaxMind             bool
+	EnableGeoblocking         bool
 	Secret                    string
 	IsEnterprise              bool
    IsPostgreSQL              bool
 	IsPostgreSQLPass          string
    IsRedis                   bool
 	IsRedisPass               string
 }
 type SupportedContainer string
@@ -71,12 +67,9 @@ const (
 	Undefined SupportedContainer = "undefined"
 )
 var redisFlag *bool
 func main() {
 	crowdsecFlag := flag.Bool("crowdsec", false, "Enable the CrowdSec installation prompt")
 	redisFlag = flag.Bool("redis", false, "Install Redis as caching solution. Required for HA. Not required for the Enterprise version.")
 	flag.Parse()
 	// print a banner about prerequisites - opening port 80, 443, 51820, and 21820 on the VPS and firewall and pointing your domain to the VPS IP with a records. Docs are at http://localhost:3000/Getting%20Started/dns-networking
@@ -130,11 +123,11 @@ func main() {
 		fmt.Println("\nConfiguration files created successfully!")
-		// Download MaxMind Country / ASN database if requested
+		// Download MaxMind database if requested
-		if config.EnableMaxMind {
+		if config.EnableGeoblocking {
-			fmt.Println("\n=== Downloading MaxMind Country and ASN Databases ===")
+			fmt.Println("\n=== Downloading MaxMind Database ===")
 			if err := downloadMaxMindDatabase(); err != nil {
-				fmt.Printf("Error downloading MaxMind databases: %v\n", err)
+				fmt.Printf("Error downloading MaxMind database: %v\n", err)
 				fmt.Println("You can download it manually later if needed.")
 			}
 		}
@@ -195,15 +188,15 @@ func main() {
 		fmt.Println("\n=== MaxMind Database Update ===")
 		if _, err := os.Stat("config/GeoLite2-Country.mmdb"); err == nil {
 			fmt.Println("MaxMind GeoLite2 Country database found.")
-			if readBool("Would you like to update the MaxMind databases (Country and ASN) to the latest version?", false) {
+			if readBool("Would you like to update the MaxMind database to the latest version?", false) {
 				if err := downloadMaxMindDatabase(); err != nil {
 					fmt.Printf("Error updating MaxMind database: %v\n", err)
 					fmt.Println("You can try updating it manually later if needed.")
 				}
 			}
 		} else {
-			fmt.Println("MaxMind GeoLite2 Country and ASN databases not found.")
+			fmt.Println("MaxMind GeoLite2 Country database not found.")
-			if readBool("Would you like to download the MaxMind GeoLite2 databases for blocking functionality?", false) {
+			if readBool("Would you like to download the MaxMind GeoLite2 database for geoblocking functionality?", false) {
 				if err := downloadMaxMindDatabase(); err != nil {
 					fmt.Printf("Error downloading MaxMind database: %v\n", err)
 					fmt.Println("You can try downloading it manually later if needed.")
@@ -211,10 +204,8 @@ func main() {
 				// Now you need to update your config file accordingly to enable geoblocking
 				fmt.Print("Please remember to update your config/config.yml file to enable geoblocking! \n\n")
 				// add   maxmind_db_path: "./config/GeoLite2-Country.mmdb" under server
-				// add   maxmind_asn_path: "./config/GeoLite2-ASN.mmdb" under server
+				fmt.Println("Add the following line under the 'server' section:")
 				fmt.Println("Add the following lines under the 'server' section:")
 				fmt.Println("  maxmind_db_path: \"./config/GeoLite2-Country.mmdb\"")
 				fmt.Println("  maxmind_asn_path: \"./config/GeoLite2-ASN.mmdb\"")
 			}
 		}
 	}
@@ -493,17 +484,6 @@ func collectUserInput() Config {
 	fmt.Println("\n=== Basic Configuration ===")
 	config.IsEnterprise = readBoolNoDefault("Do you want to install the Enterprise version of Pangolin? The EE is free for personal use or for businesses making less than 100k USD annually.")
    if config.IsEnterprise {
        if *redisFlag {
 			config.IsRedis = true
            config.IsRedisPass = readPassword("Enter a unique password for the Redis service.")
        }
    }
    config.IsPostgreSQL = readBool("Do you want to use PostgreSQL (not recommended for most users)?", false)
 	if config.IsPostgreSQL {
 		config.IsPostgreSQLPass = readPassword("Enter a unique password for the PostgreSQL pangolin user.")
 	}
 	config.BaseDomain = readString("Enter your base domain (no subdomain e.g. example.com)", "")
@@ -547,7 +527,7 @@ func collectUserInput() Config {
 	fmt.Println("\n=== Advanced Configuration ===")
 	config.EnableIPv6 = readBool("Is your server IPv6 capable?", true)
-	config.EnableMaxMind = readBool("Do you want to download the MaxMind GeoLite2 Country and ASN databases for blocking functionality?", true)
+	config.EnableGeoblocking = readBool("Do you want to download the MaxMind GeoLite2 database for geoblocking functionality?", true)
 	if config.DashboardDomain == "" {
 		fmt.Println("Error: Dashboard Domain name is required")
@@ -800,42 +780,29 @@ func checkPortsAvailable(port int) error {
 }
 func downloadMaxMindDatabase() error {
-	fmt.Println("Downloading MaxMind GeoLite2 Country and ASN databases...")
+	fmt.Println("Downloading MaxMind GeoLite2 Country database...")
-	// Download the GeoLite2 Country databases
+	// Download the GeoLite2 Country database
 	if err := run("curl", "-L", "-o", "GeoLite2-Country.tar.gz",
 		"https://github.com/GitSquared/node-geolite2-redist/raw/refs/heads/master/redist/GeoLite2-Country.tar.gz"); err != nil {
-		return fmt.Errorf("failed to download GeoLite2 Country database: %v", err)
+		return fmt.Errorf("failed to download GeoLite2 database: %v", err)
 	}
 	if err := run("curl", "-L", "-o", "GeoLite2-ASN.tar.gz",
 		"https://github.com/GitSquared/node-geolite2-redist/raw/refs/heads/master/redist/GeoLite2-ASN.tar.gz"); err != nil {
 		return fmt.Errorf("failed to download GeoLite2 ASN database: %v", err)
 	}
-	// Extract the Country database
+	// Extract the database
 	if err := run("tar", "-xzf", "GeoLite2-Country.tar.gz"); err != nil {
-		return fmt.Errorf("failed to extract GeoLite2 Country database: %v", err)
+		return fmt.Errorf("failed to extract GeoLite2 database: %v", err)
 	}
 	if err := run("tar", "-xzf", "GeoLite2-ASN.tar.gz"); err != nil {
 		return fmt.Errorf("failed to extract GeoLite2 ASN database: %v", err)
 	}
 	// Find the .mmdb file and move it to the config directory
 	if err := run("bash", "-c", "mv GeoLite2-Country_*/GeoLite2-Country.mmdb config/"); err != nil {
-		return fmt.Errorf("failed to move GeoLite2 Country database to config directory: %v", err)
+		return fmt.Errorf("failed to move GeoLite2 database to config directory: %v", err)
 	}
 	if err := run("bash", "-c", "mv GeoLite2-ASN_*/GeoLite2-ASN.mmdb config/"); err != nil {
 		return fmt.Errorf("failed to move GeoLite2 ASN database to config directory: %v", err)
 	}
 	// Clean up the downloaded files
-	if err := run("sh", "-c", "rm -rf GeoLite2-Country.tar.gz GeoLite2-Country_*"); err != nil {
+	if err := run("rm", "-rf", "GeoLite2-Country.tar.gz", "GeoLite2-Country_*"); err != nil {
-		fmt.Printf("Warning: failed to clean up temporary country files: %v\n", err)
+		fmt.Printf("Warning: failed to clean up temporary files: %v\n", err)
 	}
 	if err := run("sh", "-c", "rm -rf GeoLite2-ASN.tar.gz GeoLite2-ASN_*"); err != nil {
 		fmt.Printf("Warning: failed to clean up temporary ASN files: %v\n", err)
 	}
-	fmt.Println("MaxMind GeoLite2 Country and ASN database downloaded successfully!")
+	fmt.Println("MaxMind GeoLite2 Country database downloaded successfully!")
 	return nil
 }
@@ -1,42 +1,17 @@
 import type { NextConfig } from "next";
 import createNextIntlPlugin from "next-intl/plugin";
 import fs from "fs";
 import path from "path";
 const withNextIntl = createNextIntlPlugin();
 // read allowedDevOrigins.json if it exists
 let allowedDevOrigins: string[] = [];
 const allowedDevOriginsPath = path.join(
    process.cwd(),
    "allowedDevOrigins.json"
 );
 if (fs.existsSync(allowedDevOriginsPath)) {
    try {
        const data = fs.readFileSync(allowedDevOriginsPath, "utf-8");
        allowedDevOrigins = JSON.parse(data);
    } catch {}
 }
 const nextConfig: NextConfig = {
    reactStrictMode: false,
-    reactCompiler: true,
+    eslint: {
-    transpilePackages: ["@novnc/novnc"],
+        ignoreDuringBuilds: true
    output: "standalone",
    allowedDevOrigins,
    async redirects() {
        return [
            {
                source: "/:orgId/settings/resources/proxy/:path*",
                destination: "/:orgId/settings/resources/public/:path*",
                permanent: true
    },
-            {
+    experimental: {
-                source: "/:orgId/settings/resources/client/:path*",
+        reactCompiler: true
-                destination: "/:orgId/settings/resources/private/:path*",
+    },
-                permanent: true
+    output: "standalone"
            }
        ];
    }
 };
 export default withNextIntl(nextConfig);
@@ -32,50 +32,43 @@
        "format": "prettier --write ."
    },
    "dependencies": {
-        "@asteasolutions/zod-to-openapi": "9.1.0",
+        "@asteasolutions/zod-to-openapi": "8.4.1",
-        "@aws-sdk/client-s3": "3.1121.0",
+        "@aws-sdk/client-s3": "3.1011.0",
-        "@devolutions/iron-remote-desktop": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-0.0.0.tgz",
+        "@faker-js/faker": "10.3.0",
        "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
        "@headlessui/react": "2.2.10",
-        "@hookform/resolvers": "5.9.1",
+        "@hookform/resolvers": "5.2.2",
        "@monaco-editor/react": "4.7.0",
-        "@node-rs/argon2": "2.2.0",
+        "@node-rs/argon2": "2.0.2",
        "@novnc/novnc": "^1.7.0",
        "@oslojs/crypto": "1.0.1",
        "@oslojs/encoding": "1.1.0",
-        "@radix-ui/react-avatar": "1.2.6",
+        "@radix-ui/react-avatar": "1.1.11",
-        "@radix-ui/react-checkbox": "1.3.11",
+        "@radix-ui/react-checkbox": "1.3.3",
-        "@radix-ui/react-collapsible": "1.1.20",
+        "@radix-ui/react-collapsible": "1.1.12",
-        "@radix-ui/react-dialog": "1.1.23",
+        "@radix-ui/react-dialog": "1.1.15",
-        "@radix-ui/react-dropdown-menu": "2.1.24",
+        "@radix-ui/react-dropdown-menu": "2.1.16",
        "@radix-ui/react-icons": "1.3.2",
-        "@radix-ui/react-label": "2.1.15",
+        "@radix-ui/react-label": "2.1.8",
-        "@radix-ui/react-popover": "1.1.23",
+        "@radix-ui/react-popover": "1.1.15",
-        "@radix-ui/react-progress": "1.1.16",
+        "@radix-ui/react-progress": "1.1.8",
-        "@radix-ui/react-radio-group": "1.4.7",
+        "@radix-ui/react-radio-group": "1.3.8",
-        "@radix-ui/react-scroll-area": "1.2.18",
+        "@radix-ui/react-scroll-area": "1.2.10",
-        "@radix-ui/react-select": "2.3.7",
+        "@radix-ui/react-select": "2.2.6",
-        "@radix-ui/react-separator": "1.1.15",
+        "@radix-ui/react-separator": "1.1.8",
-        "@radix-ui/react-slot": "1.3.3",
+        "@radix-ui/react-slot": "1.2.4",
-        "@radix-ui/react-switch": "1.3.7",
+        "@radix-ui/react-switch": "1.2.6",
-        "@radix-ui/react-tabs": "1.1.21",
+        "@radix-ui/react-tabs": "1.1.13",
-        "@radix-ui/react-toast": "1.2.23",
+        "@radix-ui/react-toast": "1.2.15",
-        "@radix-ui/react-tooltip": "1.2.16",
+        "@radix-ui/react-tooltip": "1.2.8",
        "@react-email/body": "0.3.0",
        "@react-email/components": "1.0.12",
-        "@react-email/render": "2.1.0",
+        "@react-email/render": "2.0.8",
        "@react-email/tailwind": "2.0.7",
        "@simplewebauthn/browser": "13.3.0",
-        "@simplewebauthn/server": "13.3.3",
+        "@simplewebauthn/server": "13.3.0",
        "@tailwindcss/forms": "0.5.11",
-        "@tanstack/react-query": "5.102.8",
+        "@tanstack/react-query": "5.90.21",
        "@tanstack/react-table": "8.21.3",
        "@xterm/addon-fit": "^0.11.0",
        "@xterm/addon-web-links": "^0.12.0",
        "@xterm/xterm": "^6.0.0",
        "acme-client": "^5.4.0",
        "arctic": "3.7.0",
-        "axios": "1.20.0",
+        "axios": "1.15.0",
        "better-sqlite3": "11.9.1",
        "canvas-confetti": "1.9.4",
        "class-variance-authority": "0.7.1",
@@ -85,106 +78,103 @@
        "cors": "2.8.6",
        "crypto-js": "4.2.0",
        "d3": "7.9.0",
        "dns-packet": "^5.6.1",
        "drizzle-orm": "0.45.2",
        "express": "5.2.1",
-        "express-rate-limit": "8.7.0",
+        "express-rate-limit": "8.3.0",
        "glob": "13.0.6",
-        "gpt-tokenizer": "^4.0.0",
+        "helmet": "8.1.0",
        "helmet": "8.3.0",
        "http-errors": "2.0.1",
-        "input-otp": "1.5.0",
+        "input-otp": "1.4.2",
-        "ioredis": "6.0.0",
+        "ioredis": "5.10.1",
        "jmespath": "0.16.0",
-        "js-yaml": "5.4.1",
+        "js-yaml": "4.1.1",
        "jsonwebtoken": "9.0.3",
-        "lucide-react": "1.38.0",
+        "lucide-react": "0.577.0",
-        "maxmind": "5.0.7",
+        "maxmind": "5.0.6",
        "moment": "2.30.1",
-        "next": "16.3.3",
+        "next": "15.5.15",
-        "next-intl": "4.14.1",
+        "next-intl": "4.8.3",
        "next-themes": "0.4.6",
        "nextjs-toploader": "3.9.17",
        "node-cache": "5.1.2",
-        "nodemailer": "9.1.0",
+        "nodemailer": "8.0.7",
        "oslo": "1.2.1",
-        "pg": "8.23.0",
+        "pg": "8.20.0",
-        "posthog-node": "5.51.4",
+        "posthog-node": "5.28.0",
        "qrcode.react": "4.2.0",
-        "react": "19.2.8",
+        "react": "19.2.6",
        "react-day-picker": "9.14.0",
-        "react-dom": "19.2.8",
+        "react-dom": "19.2.6",
        "react-easy-sort": "1.8.0",
-        "react-hook-form": "7.87.0",
+        "react-hook-form": "7.71.2",
-        "react-icons": "5.7.0",
+        "react-icons": "5.6.0",
-        "recharts": "3.10.1",
+        "recharts": "2.15.4",
        "reodotdev": "1.1.0",
-        "semver": "7.8.5",
+        "resend": "6.9.2",
        "semver": "7.7.4",
        "sshpk": "1.18.0",
-        "stripe": "22.6.0",
+        "stripe": "20.4.1",
        "swagger-ui-express": "5.0.1",
-        "tailwind-merge": "3.6.0",
+        "tailwind-merge": "3.5.0",
        "topojson-client": "3.1.0",
        "tw-animate-css": "1.4.0",
        "use-debounce": "10.1.1",
-        "uuid": "14.0.2",
+        "uuid": "13.0.0",
        "vaul": "1.1.2",
        "visionscarto-world-atlas": "1.0.0",
        "winston": "3.19.0",
        "winston-daily-rotate-file": "5.0.0",
-        "ws": "8.21.3",
+        "ws": "8.19.0",
-        "yaml": "2.9.0",
+        "yaml": "2.8.3",
-        "yargs": "18.1.0",
+        "yargs": "18.0.0",
-        "zod": "4.5.4",
+        "zod": "4.3.6",
        "zod-validation-error": "5.0.0"
    },
    "devDependencies": {
-        "@dotenvx/dotenvx": "2.23.0",
+        "@dotenvx/dotenvx": "1.54.1",
        "@esbuild-plugins/tsconfig-paths": "0.1.2",
-        "@react-email/ui": "^6.9.3",
+        "@react-email/preview-server": "5.2.10",
-        "@tailwindcss/postcss": "4.3.3",
+        "@tailwindcss/postcss": "4.2.2",
-        "@tanstack/react-query-devtools": "5.102.8",
+        "@tanstack/react-query-devtools": "5.91.3",
        "@types/better-sqlite3": "7.6.13",
        "@types/cookie-parser": "1.4.10",
        "@types/cors": "2.8.19",
        "@types/crypto-js": "4.2.2",
        "@types/d3": "7.4.3",
        "@types/dns-packet": "^5.6.5",
        "@types/express": "5.0.6",
-        "@types/express-session": "1.19.0",
+        "@types/express-session": "1.18.2",
        "@types/jmespath": "0.15.2",
        "@types/js-yaml": "4.0.9",
        "@types/jsonwebtoken": "9.0.10",
-        "@types/node": "26.4.0",
+        "@types/node": "25.3.5",
-        "@types/nodemailer": "8.0.1",
+        "@types/nodemailer": "8.0.0",
        "@types/nprogress": "0.2.3",
-        "@types/pg": "8.23.1",
+        "@types/pg": "8.18.0",
-        "@types/react": "19.2.18",
+        "@types/react": "19.2.14",
-        "@types/react-dom": "19.2.5",
+        "@types/react-dom": "19.2.3",
-        "@types/semver": "7.8.0",
+        "@types/semver": "7.7.1",
-        "@types/sshpk": "1.17.5",
+        "@types/sshpk": "1.17.4",
        "@types/swagger-ui-express": "4.1.8",
        "@types/topojson-client": "3.1.5",
        "@types/ws": "8.18.1",
        "@types/yargs": "17.0.35",
        "babel-plugin-react-compiler": "1.0.0",
        "drizzle-kit": "0.31.10",
-        "esbuild": "0.28.2",
+        "esbuild": "0.27.4",
-        "esbuild-node-externals": "2.0.0",
+        "esbuild-node-externals": "1.20.1",
-        "eslint": "10.9.1",
+        "eslint": "10.0.3",
-        "eslint-config-next": "16.3.3",
+        "eslint-config-next": "16.1.7",
-        "postcss": "8.5.26",
+        "postcss": "8.5.8",
-        "prettier": "3.9.6",
+        "prettier": "3.8.1",
-        "react-email": "6.9.3",
+        "react-email": "5.2.10",
-        "tailwindcss": "4.3.3",
+        "tailwindcss": "4.2.2",
-        "tsc-alias": "1.9.2",
+        "tsc-alias": "1.8.16",
-        "tsx": "4.23.13",
+        "tsx": "4.21.0",
-        "typescript": "6.0.3",
+        "typescript": "5.9.3",
-        "typescript-eslint": "8.68.0"
+        "typescript-eslint": "8.56.1"
    },
    "overrides": {
-        "esbuild": "0.28.2",
+        "esbuild": "0.27.4",
-        "dompurify": "3.4.0",
+        "dompurify": "3.3.2"
        "postcss": "8.5.26"
    }
 }
@@ -1,10 +0,0 @@
 <svg width="256" height="257" viewBox="0 0 256 257" fill="none" xmlns="http://www.w3.org/2000/svg">
 <g clip-path="url(#clip0_29_2)">
 <path d="M50.2278 170.321L100.585 142.064L101.428 139.601L100.585 138.24H98.1225L89.6972 137.722L60.9215 136.944L35.9696 135.907L11.7954 134.611L5.70329 133.314L0 125.796L0.583291 122.037L5.70329 118.603L13.0268 119.251L29.2294 120.352L53.5332 122.037L71.1615 123.074L97.28 125.796H101.428L102.011 124.111L100.585 123.074L99.4835 122.037L74.3372 104.992L47.117 86.9752L32.8587 76.6056L25.1463 71.3559L21.2577 66.4304L19.5727 55.6719L26.5722 47.9595L35.9696 48.6076L38.3676 49.2557L47.8947 56.5792L68.2451 72.3281L94.8172 91.9008L98.7058 95.1413L100.261 94.0395L100.456 93.2618L98.7058 90.3453L84.2532 64.2268L68.8284 37.6547L61.9585 26.637L60.1438 20.0263C59.4957 17.3043 59.042 15.0359 59.042 12.2491L67.0137 1.42582L71.4208 0L82.0496 1.42582L86.5215 5.31443L93.1321 20.4152L103.826 44.2005L120.417 76.5408L125.278 86.1327L127.87 95.0116L128.843 97.7337H130.528V96.1782L131.889 77.9666L134.416 55.6071L136.879 26.8314L137.722 18.7301L141.74 9.00861L149.711 3.75899L155.933 6.74025L161.053 14.0638L160.34 18.7949L157.294 38.562L151.332 69.5413L147.443 90.2805H149.711L152.304 87.6881L162.803 73.7539L180.431 51.7185L188.209 42.9691L197.282 33.3124L203.115 28.7109H214.133L222.234 40.7656L218.605 53.2091L207.263 67.597L197.865 79.7813L184.385 97.9281L175.959 112.446L176.737 113.612L178.746 113.418L209.207 106.937L225.669 103.955L245.306 100.585L254.185 104.733L255.157 108.946L251.658 117.566L230.659 122.75L206.031 127.676L169.349 136.361L168.895 136.685L169.414 137.333L185.94 138.888L193.005 139.277H210.309L242.52 141.675L250.945 147.249L256 154.054L255.157 159.238L242.195 165.849L224.697 161.701L183.866 151.98L169.867 148.48H167.923V149.647L179.589 161.053L200.976 180.367L227.743 205.254L229.104 211.411L225.669 216.271L222.039 215.753L198.513 198.06L189.44 190.088L168.895 172.784H167.534V174.598L172.265 181.533L197.282 219.123L198.578 230.659L196.764 234.418L190.283 236.687L183.153 235.39L168.506 214.846L153.406 191.708L141.221 170.969L139.731 171.812L132.537 249.26L129.167 253.213L121.389 256.194L114.908 251.269L111.473 243.297L114.908 227.548L119.056 207.004L122.426 190.671L125.472 170.386L127.287 163.646L127.157 163.192L125.667 163.386L110.372 184.385L87.1048 215.818L68.6987 235.52L64.2916 237.27L56.6441 233.316L57.357 226.252L61.6344 219.966L87.1048 187.561L102.465 167.469L112.381 155.868L112.316 154.183H111.733L44.0709 198.125L32.0162 199.68L26.8314 194.819L27.4795 186.848L29.9423 184.255L50.2927 170.256L50.2278 170.321Z" fill="#0B0B0B"/>
 </g>
 <defs>
 <clipPath id="clip0_29_2">
 <rect width="256" height="257" fill="white"/>
 </clipPath>
 </defs>
 </svg>
@@ -1,10 +0,0 @@
 <svg width="256" height="257" viewBox="0 0 256 257" fill="none" xmlns="http://www.w3.org/2000/svg">
 <g clip-path="url(#clip0_29_2)">
 <path d="M50.2278 170.321L100.585 142.064L101.428 139.601L100.585 138.24H98.1225L89.6972 137.722L60.9215 136.944L35.9696 135.907L11.7954 134.611L5.70329 133.314L0 125.796L0.583291 122.037L5.70329 118.603L13.0268 119.251L29.2294 120.352L53.5332 122.037L71.1615 123.074L97.28 125.796H101.428L102.011 124.111L100.585 123.074L99.4835 122.037L74.3372 104.992L47.117 86.9752L32.8587 76.6056L25.1463 71.3559L21.2577 66.4304L19.5727 55.6719L26.5722 47.9595L35.9696 48.6076L38.3676 49.2557L47.8947 56.5792L68.2451 72.3281L94.8172 91.9008L98.7058 95.1413L100.261 94.0395L100.456 93.2618L98.7058 90.3453L84.2532 64.2268L68.8284 37.6547L61.9585 26.637L60.1438 20.0263C59.4957 17.3043 59.042 15.0359 59.042 12.2491L67.0137 1.42582L71.4208 0L82.0496 1.42582L86.5215 5.31443L93.1321 20.4152L103.826 44.2005L120.417 76.5408L125.278 86.1327L127.87 95.0116L128.843 97.7337H130.528V96.1782L131.889 77.9666L134.416 55.6071L136.879 26.8314L137.722 18.7301L141.74 9.00861L149.711 3.75899L155.933 6.74025L161.053 14.0638L160.34 18.7949L157.294 38.562L151.332 69.5413L147.443 90.2805H149.711L152.304 87.6881L162.803 73.7539L180.431 51.7185L188.209 42.9691L197.282 33.3124L203.115 28.7109H214.133L222.234 40.7656L218.605 53.2091L207.263 67.597L197.865 79.7813L184.385 97.9281L175.959 112.446L176.737 113.612L178.746 113.418L209.207 106.937L225.669 103.955L245.306 100.585L254.185 104.733L255.157 108.946L251.658 117.566L230.659 122.75L206.031 127.676L169.349 136.361L168.895 136.685L169.414 137.333L185.94 138.888L193.005 139.277H210.309L242.52 141.675L250.945 147.249L256 154.054L255.157 159.238L242.195 165.849L224.697 161.701L183.866 151.98L169.867 148.48H167.923V149.647L179.589 161.053L200.976 180.367L227.743 205.254L229.104 211.411L225.669 216.271L222.039 215.753L198.513 198.06L189.44 190.088L168.895 172.784H167.534V174.598L172.265 181.533L197.282 219.123L198.578 230.659L196.764 234.418L190.283 236.687L183.153 235.39L168.506 214.846L153.406 191.708L141.221 170.969L139.731 171.812L132.537 249.26L129.167 253.213L121.389 256.194L114.908 251.269L111.473 243.297L114.908 227.548L119.056 207.004L122.426 190.671L125.472 170.386L127.287 163.646L127.157 163.192L125.667 163.386L110.372 184.385L87.1048 215.818L68.6987 235.52L64.2916 237.27L56.6441 233.316L57.357 226.252L61.6344 219.966L87.1048 187.561L102.465 167.469L112.381 155.868L112.316 154.183H111.733L44.0709 198.125L32.0162 199.68L26.8314 194.819L27.4795 186.848L29.9423 184.255L50.2927 170.256L50.2278 170.321Z" fill="#F0EFEC"/>
 </g>
 <defs>
 <clipPath id="clip0_29_2">
 <rect width="256" height="257" fill="white"/>
 </clipPath>
 </defs>
 </svg>
@@ -1,3 +0,0 @@
 <svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
 <path d="M11.04 19.32Q12 21.51 12 24q0-2.49.93-4.68.96-2.19 2.58-3.81t3.81-2.55Q21.51 12 24 12q-2.49 0-4.68-.93a12.3 12.3 0 0 1-3.81-2.58 12.3 12.3 0 0 1-2.58-3.81Q12 2.49 12 0q0 2.49-.96 4.68-.93 2.19-2.55 3.81a12.3 12.3 0 0 1-3.81 2.58Q2.49 12 0 12q2.49 0 4.68.96 2.19.93 3.81 2.55t2.55 3.81" fill="black"/>
 </svg>
@@ -1,3 +0,0 @@
 <svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
 <path d="M11.04 19.32Q12 21.51 12 24q0-2.49.93-4.68.96-2.19 2.58-3.81t3.81-2.55Q21.51 12 24 12q-2.49 0-4.68-.93a12.3 12.3 0 0 1-3.81-2.58 12.3 12.3 0 0 1-2.58-3.81Q12 2.49 12 0q0 2.49-.96 4.68-.93 2.19-2.55 3.81a12.3 12.3 0 0 1-3.81 2.58Q2.49 12 0 12q2.49 0 4.68.96 2.19.93 3.81 2.55t2.55 3.81" fill="white"/>
 </svg>
@@ -1,3 +0,0 @@
 <svg width="716" height="716" viewBox="157 157 402 402" fill="none" xmlns="http://www.w3.org/2000/svg">
 <path d="M508.749 317.399C516.777 287.314 508.991 253.884 485.389 230.282C461.788 206.681 428.36 198.895 398.273 206.923C376.231 184.928 343.39 174.956 311.148 183.596C278.906 192.234 255.45 217.292 247.36 247.361C217.291 255.451 192.233 278.91 183.595 311.149C174.957 343.391 184.927 376.232 206.924 398.274C198.896 428.359 206.683 461.789 230.284 485.391C253.885 508.992 287.313 516.779 317.401 508.75C339.442 530.745 372.286 540.717 404.525 532.079C436.767 523.441 460.223 498.384 468.313 468.315C498.383 460.224 523.44 436.766 532.078 404.526C540.716 372.285 530.747 339.443 508.749 317.402V317.399ZM470.899 244.776C486.892 260.77 493.488 282.601 490.687 303.412L415.577 260.046C412.411 258.218 408.509 258.218 405.345 260.046L317.401 310.82V277.526C317.401 275.191 318.652 273.005 320.676 271.837L387.644 233.174C414.178 218.353 448.346 222.223 470.901 244.776H470.899ZM357.837 311.144L398.275 334.491V381.185L357.837 404.532L317.398 381.185V334.491L357.837 311.144ZM264.776 269.693C265.207 239.305 285.644 211.649 316.453 203.393C338.3 197.54 360.505 202.744 377.127 215.573L302.014 258.937C298.848 260.764 296.898 264.144 296.898 267.798V369.346L268.065 352.699C266.043 351.531 264.776 349.353 264.776 347.017V269.691V269.693ZM203.391 316.454C209.244 294.608 224.854 277.978 244.276 269.999V356.73C244.276 360.384 246.226 363.763 249.392 365.591L337.337 416.365L308.503 433.013C306.481 434.181 303.961 434.188 301.939 433.02L234.971 394.357C208.868 378.789 195.138 347.261 203.391 316.454ZM244.775 470.9C228.781 454.906 222.186 433.075 224.986 412.264L300.096 455.63C303.263 457.457 307.164 457.457 310.328 455.63L398.273 404.856V438.149C398.273 440.485 397.022 442.671 394.997 443.839L328.029 482.502C301.495 497.322 267.327 493.452 244.772 470.9H244.775ZM450.897 445.982C450.466 476.371 430.029 504.027 399.22 512.283C377.373 518.136 355.168 512.932 338.547 500.102L413.659 456.738C416.826 454.911 418.775 451.532 418.775 447.877V346.329L447.609 362.977C449.631 364.145 450.897 366.323 450.897 368.659V445.985V445.982ZM512.282 399.221C506.429 421.068 490.819 437.697 471.397 445.676V358.946C471.397 355.292 469.448 351.912 466.281 350.085L378.336 299.311L407.17 282.663C409.192 281.495 411.712 281.487 413.734 282.655L480.702 321.318C506.805 336.887 520.536 368.415 512.282 399.221Z" fill="black"/>
 </svg>
@@ -1,3 +0,0 @@
 <svg width="716" height="716" viewBox="157 157 402 402" fill="none" xmlns="http://www.w3.org/2000/svg">
 <path d="M508.749 317.399C516.777 287.314 508.991 253.884 485.389 230.282C461.788 206.681 428.36 198.895 398.273 206.923C376.231 184.928 343.39 174.956 311.148 183.596C278.906 192.234 255.45 217.292 247.36 247.361C217.291 255.451 192.233 278.91 183.595 311.149C174.957 343.391 184.927 376.232 206.924 398.274C198.896 428.359 206.683 461.789 230.284 485.391C253.885 508.992 287.313 516.779 317.401 508.75C339.442 530.745 372.286 540.717 404.525 532.079C436.767 523.441 460.223 498.384 468.313 468.315C498.383 460.224 523.44 436.766 532.078 404.526C540.716 372.285 530.747 339.443 508.749 317.402V317.399ZM470.899 244.776C486.892 260.77 493.488 282.601 490.687 303.412L415.577 260.046C412.411 258.218 408.509 258.218 405.345 260.046L317.401 310.82V277.526C317.401 275.191 318.652 273.005 320.676 271.837L387.644 233.174C414.178 218.353 448.346 222.223 470.901 244.776H470.899ZM357.837 311.144L398.275 334.491V381.185L357.837 404.532L317.398 381.185V334.491L357.837 311.144ZM264.776 269.693C265.207 239.305 285.644 211.649 316.453 203.393C338.3 197.54 360.505 202.744 377.127 215.573L302.014 258.937C298.848 260.764 296.898 264.144 296.898 267.798V369.346L268.065 352.699C266.043 351.531 264.776 349.353 264.776 347.017V269.691V269.693ZM203.391 316.454C209.244 294.608 224.854 277.978 244.276 269.999V356.73C244.276 360.384 246.226 363.763 249.392 365.591L337.337 416.365L308.503 433.013C306.481 434.181 303.961 434.188 301.939 433.02L234.971 394.357C208.868 378.789 195.138 347.261 203.391 316.454ZM244.775 470.9C228.781 454.906 222.186 433.075 224.986 412.264L300.096 455.63C303.263 457.457 307.164 457.457 310.328 455.63L398.273 404.856V438.149C398.273 440.485 397.022 442.671 394.997 443.839L328.029 482.502C301.495 497.322 267.327 493.452 244.772 470.9H244.775ZM450.897 445.982C450.466 476.371 430.029 504.027 399.22 512.283C377.373 518.136 355.168 512.932 338.547 500.102L413.659 456.738C416.826 454.911 418.775 451.532 418.775 447.877V346.329L447.609 362.977C449.631 364.145 450.897 366.323 450.897 368.659V445.985V445.982ZM512.282 399.221C506.429 421.068 490.819 437.697 471.397 445.676V358.946C471.397 355.292 469.448 351.912 466.281 350.085L378.336 299.311L407.17 282.663C409.192 281.495 411.712 281.487 413.734 282.655L480.702 321.318C506.805 336.887 520.536 368.415 512.282 399.221Z" fill="white"/>
 </svg>
@@ -1 +0,0 @@
 <svg width='240' height='300' viewBox='0 0 240 300' fill='none' xmlns='http://www.w3.org/2000/svg'><g clip-path='url(#clip0_1401_86274)'><mask id='mask0_1401_86274' style='mask-type:luminance' maskUnits='userSpaceOnUse' x='0' y='0' width='240' height='300'><path d='M240 0H0V300H240V0Z' fill='white'/></mask><g mask='url(#mask0_1401_86274)'><path d='M180 240H60V120H180V240Z' fill='#CFCECD'/><path d='M180 60H60V240H180V60ZM240 300H0V0H240V300Z' fill='#211E1E'/></g></g><defs><clipPath id='clip0_1401_86274'><rect width='240' height='300' fill='white'/></clipPath></defs></svg>
@@ -1 +0,0 @@
 <svg width='240' height='300' viewBox='0 0 240 300' fill='none' xmlns='http://www.w3.org/2000/svg'><g clip-path='url(#clip0_1401_86283)'><mask id='mask0_1401_86283' style='mask-type:luminance' maskUnits='userSpaceOnUse' x='0' y='0' width='240' height='300'><path d='M240 0H0V300H240V0Z' fill='white'/></mask><g mask='url(#mask0_1401_86283)'><path d='M180 240H60V120H180V240Z' fill='#4B4646'/><path d='M180 60H60V240H180V60ZM240 300H0V0H240V300Z' fill='#F1ECEC'/></g></g><defs><clipPath id='clip0_1401_86283'><rect width='240' height='300' fill='white'/></clipPath></defs></svg>
@@ -1,41 +0,0 @@
 import express from "express";
 import helmet from "helmet";
 import cors from "cors";
 import config from "@server/lib/config";
 import logger from "@server/logger";
 import {
    errorHandlerMiddleware,
    notFoundMiddleware
 } from "@server/middlewares";
 import { createAiGatewayRouter } from "@server/routers/aiGateway";
 const aiGatewayPort = config.getRawConfig().server.ai_gateway_port;
 export function createAiGatewayServer() {
    const aiGatewayServer = express();
    const trustProxy = config.getRawConfig().server.trust_proxy;
    if (trustProxy) {
        aiGatewayServer.set("trust proxy", trustProxy);
    }
    aiGatewayServer.use(helmet());
    aiGatewayServer.use(cors());
    // AI requests can carry large payloads (long conversation history, tool
    // results, embedded documents), well beyond express.json()'s 100kb default.
    aiGatewayServer.use(express.json({ limit: "50mb" }));
    aiGatewayServer.use(createAiGatewayRouter());
    aiGatewayServer.use(notFoundMiddleware);
    aiGatewayServer.use(errorHandlerMiddleware);
    aiGatewayServer.listen(aiGatewayPort, (err?: any) => {
        if (err) throw err;
        logger.info(
            `AI gateway server is running on http://localhost:${aiGatewayPort}`
        );
    });
    return aiGatewayServer;
 }
@@ -5,7 +5,6 @@ import { and, eq, inArray } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
 import logger from "@server/logger";
 export enum ActionsEnum {
    createOrgUser = "createOrgUser",
@@ -21,8 +20,6 @@ export enum ActionsEnum {
    getSite = "getSite",
    listSites = "listSites",
    updateSite = "updateSite",
    updateSiteApprovals = "updateSiteApprovals",
    restartSite = "restartSite",
    resetSiteBandwidth = "resetSiteBandwidth",
    reGenerateSecret = "reGenerateSecret",
    createResource = "createResource",
@@ -50,8 +47,6 @@ export enum ActionsEnum {
    setResourceUsers = "setResourceUsers",
    setResourceRoles = "setResourceRoles",
    listResourceUsers = "listResourceUsers",
    listResourceAiModels = "listResourceAiModels",
    setResourceAiModels = "setResourceAiModels",
    // removeRoleSite = "removeRoleSite",
    // addRoleAction = "addRoleAction",
    // removeRoleAction = "removeRoleAction",
@@ -74,7 +69,6 @@ export enum ActionsEnum {
    setResourceWhitelist = "setResourceWhitelist",
    getResourceWhitelist = "getResourceWhitelist",
    generateAccessToken = "generateAccessToken",
    createResourceSessionToken = "createResourceSessionToken",
    deleteAcessToken = "deleteAcessToken",
    listAccessTokens = "listAccessTokens",
    createResourceRule = "createResourceRule",
@@ -153,59 +147,12 @@ export enum ActionsEnum {
    createAlertRule = "createAlertRule",
    updateAlertRule = "updateAlertRule",
    deleteAlertRule = "deleteAlertRule",
    testAlertRule = "testAlertRule",
    listAlertRules = "listAlertRules",
    listOrgLabels = "listOrgLabels",
    createOrgLabel = "createOrgLabel",
    updateOrgLabel = "updateOrgLabel",
    deleteOrgLabel = "deleteOrgLabel",
    attachLabelToItem = "attachLabelToItem",
    detachLabelFromItem = "detachLabelFromItem",
    getAlertRule = "getAlertRule",
    createHealthCheck = "createHealthCheck",
    updateHealthCheck = "updateHealthCheck",
    deleteHealthCheck = "deleteHealthCheck",
-    listHealthChecks = "listHealthChecks",
+    listHealthChecks = "listHealthChecks"
    createBrowserGatewayTarget = "createBrowserGatewayTarget",
    updateBrowserGatewayTarget = "updateBrowserGatewayTarget",
    deleteBrowserGatewayTarget = "deleteBrowserGatewayTarget",
    getBrowserGatewayTarget = "getBrowserGatewayTarget",
    listBrowserGatewayTargets = "listBrowserGatewayTargets",
    listResourcePolicies = "listResourcePolicies",
    getResourcePolicy = "getResourcePolicy",
    createResourcePolicy = "createResourcePolicy",
    updateResourcePolicy = "updateResourcePolicy",
    deleteResourcePolicy = "deleteResourcePolicy",
    listResourcePolicyRoles = "listResourcePolicyRoles",
    setResourcePolicyRoles = "setResourcePolicyRoles",
    listResourcePolicyUsers = "listResourcePolicyUsers",
    setResourcePolicyUsers = "setResourcePolicyUsers",
    setResourcePolicyPassword = "setResourcePolicyPassword",
    setResourcePolicyPincode = "setResourcePolicyPincode",
    setResourcePolicyHeaderAuth = "setResourcePolicyHeaderAuth",
    setResourcePolicyWhitelist = "setResourcePolicyWhitelist",
    setResourcePolicyRules = "setResourcePolicyRules",
    createOrgWideLauncherView = "createOrgWideLauncherView",
    createAiProvider = "createAiProvider",
    deleteAiProvider = "deleteAiProvider",
    getAiProvider = "getAiProvider",
    listAiProviders = "listAiProviders",
    updateAiProvider = "updateAiProvider",
    createAiModel = "createAiModel",
    deleteAiModel = "deleteAiModel",
    getAiModel = "getAiModel",
    listAiModels = "listAiModels",
    updateAiModel = "updateAiModel",
    createAiBudget = "createAiBudget",
    deleteAiBudget = "deleteAiBudget",
    getAiBudget = "getAiBudget",
    listAiBudgets = "listAiBudgets",
    updateAiBudget = "updateAiBudget",
    createVirtualApiKey = "createVirtualApiKey",
    deleteVirtualApiKey = "deleteVirtualApiKey",
    getVirtualApiKey = "getVirtualApiKey",
    listVirtualApiKeys = "listVirtualApiKeys",
    updateVirtualApiKey = "updateVirtualApiKey"
 }
 export async function checkUserActionPermission(
@@ -238,23 +185,6 @@ export async function checkUserActionPermission(
            }
        }
        // If no direct permission, check role-based permission (any of user's roles)
        const roleActionPermission = await db
            .select()
            .from(roleActions)
            .where(
                and(
                    eq(roleActions.actionId, actionId),
                    inArray(roleActions.roleId, userOrgRoleIds),
                    eq(roleActions.orgId, req.userOrgId!)
                )
            )
            .limit(1);
        if (roleActionPermission.length > 0) {
            return true;
        }
        // Check if the user has direct permission for the action in the current org
        const userActionPermission = await db
            .select()
@@ -272,7 +202,20 @@ export async function checkUserActionPermission(
            return true;
        }
-        return false;
+        // If no direct permission, check role-based permission (any of user's roles)
        const roleActionPermission = await db
            .select()
            .from(roleActions)
            .where(
                and(
                    eq(roleActions.actionId, actionId),
                    inArray(roleActions.roleId, userOrgRoleIds),
                    eq(roleActions.orgId, req.userOrgId!)
                )
            )
            .limit(1);
        return roleActionPermission.length > 0;
    } catch (error) {
        console.error("Error checking user action permission:", error);
        throw createHttpError(
@@ -1,12 +1,6 @@
 import { db } from "@server/db";
-import { and, eq, inArray, isNull, or } from "drizzle-orm";
+import { and, eq, inArray } from "drizzle-orm";
-import {
+import { roleResources, userResources } from "@server/db";
    rolePolicies,
    roleResources,
    resources,
    userPolicies,
    userResources
 } from "@server/db";
 export async function canUserAccessResource({
    userId,
@@ -17,14 +11,9 @@ export async function canUserAccessResource({
    resourceId: number;
    roleIds: number[];
 }): Promise<boolean> {
-    const [
+    const roleResourceAccess =
        roleResourceAccess,
        rolePolicyAccess,
        userResourceAccess,
        userPolicyAccess
    ] = await Promise.all([
        roleIds.length > 0
-            ? db
+            ? await db
                  .select()
                  .from(roleResources)
                  .where(
@@ -34,41 +23,13 @@ export async function canUserAccessResource({
                      )
                  )
                  .limit(1)
-            : [],
+            : [];
-        roleIds.length > 0
+
-            ? db
+    if (roleResourceAccess.length > 0) {
-                  .select({
+        return true;
-                      roleId: rolePolicies.roleId,
+    }
-                      resourcePolicyId: rolePolicies.resourcePolicyId
+
-                  })
+    const userResourceAccess = await db
                  .from(rolePolicies)
                  .innerJoin(
                      resources,
                      // Shared policy wins; only use default policy when no shared
                      // policy is assigned to the resource.
                      or(
                          eq(
                              resources.resourcePolicyId,
                              rolePolicies.resourcePolicyId
                          ),
                          and(
                              isNull(resources.resourcePolicyId),
                              eq(
                                  resources.defaultResourcePolicyId,
                                  rolePolicies.resourcePolicyId
                              )
                          )
                      )
                  )
                  .where(
                      and(
                          eq(resources.resourceId, resourceId),
                          inArray(rolePolicies.roleId, roleIds)
                      )
                  )
                  .limit(1)
            : [],
        db
        .select()
        .from(userResources)
        .where(
@@ -77,44 +38,11 @@ export async function canUserAccessResource({
                eq(userResources.resourceId, resourceId)
            )
        )
-            .limit(1),
+        .limit(1);
        db
            .select({
                userId: userPolicies.userId,
                resourcePolicyId: userPolicies.resourcePolicyId
            })
            .from(userPolicies)
            .innerJoin(
                resources,
                // Shared policy wins; only use default policy when no shared
                // policy is assigned to the resource.
                or(
                    eq(
                        resources.resourcePolicyId,
                        userPolicies.resourcePolicyId
                    ),
                    and(
                        isNull(resources.resourcePolicyId),
                        eq(
                            resources.defaultResourcePolicyId,
                            userPolicies.resourcePolicyId
                        )
                    )
                )
            )
            .where(
                and(
                    eq(resources.resourceId, resourceId),
                    eq(userPolicies.userId, userId)
                )
            )
            .limit(1)
    ]);
-    return (
+    if (userResourceAccess.length > 0) {
-        roleResourceAccess.length > 0 ||
+        return true;
-        rolePolicyAccess.length > 0 ||
+    }
-        userResourceAccess.length > 0 ||
+
-        userPolicyAccess.length > 0
+    return false;
    );
 }
@@ -12,7 +12,7 @@ import {
    users
 } from "@server/db";
 import { db } from "@server/db";
-import { and, eq, inArray, ne } from "drizzle-orm";
+import { eq, inArray } from "drizzle-orm";
 import config from "@server/lib/config";
 import type { RandomReader } from "@oslojs/crypto/random";
 import { generateRandomString } from "@oslojs/crypto/random";
@@ -136,45 +136,6 @@ export async function invalidateAllSessions(userId: string): Promise<void> {
    }
 }
 export async function invalidateAllSessionsExceptCurrent(
    userId: string,
    currentSessionId: string
 ): Promise<void> {
    try {
        await db.transaction(async (trx) => {
            const userSessions = await trx
                .select()
                .from(sessions)
                .where(
                    and(
                        eq(sessions.userId, userId),
                        ne(sessions.sessionId, currentSessionId)
                    )
                );
            if (userSessions.length > 0) {
                await trx.delete(resourceSessions).where(
                    inArray(
                        resourceSessions.userSessionId,
                        userSessions.map((s) => s.sessionId)
                    )
                );
            }
            await trx
                .delete(sessions)
                .where(
                    and(
                        eq(sessions.userId, userId),
                        ne(sessions.sessionId, currentSessionId)
                    )
                );
        });
    } catch (e) {
        logger.error("Failed to invalidate user sessions except current", e);
    }
 }
 export function serializeSessionCookie(
    token: string,
    isSecure: boolean,
@@ -19,9 +19,6 @@ export async function createResourceSession(opts: {
    userSessionId?: string | null;
    whitelistId?: number | null;
    accessTokenId?: string | null;
    policyPasswordId?: number | null;
    policyPincodeId?: number | null;
    policyWhitelistId?: number | null;
    doNotExtend?: boolean;
    expiresAt?: number | null;
    sessionLength?: number | null;
@@ -31,10 +28,7 @@ export async function createResourceSession(opts: {
        !opts.pincodeId &&
        !opts.whitelistId &&
        !opts.accessTokenId &&
-        !opts.userSessionId &&
+        !opts.userSessionId
        !opts.policyPasswordId &&
        !opts.policyPincodeId &&
        !opts.policyWhitelistId
    ) {
        throw new Error("Auth method must be provided");
    }
@@ -55,9 +49,6 @@ export async function createResourceSession(opts: {
        whitelistId: opts.whitelistId || null,
        doNotExtend: opts.doNotExtend || false,
        accessTokenId: opts.accessTokenId || null,
        policyPasswordId: opts.policyPasswordId || null,
        policyPincodeId: opts.policyPincodeId || null,
        policyWhitelistId: opts.policyWhitelistId || null,
        isRequestToken: opts.isRequestToken || false,
        userSessionId: opts.userSessionId || null,
        issuedAt: new Date().getTime()
@@ -1,311 +0,0 @@
 import { canUserAccessResource } from "@server/auth/canUserAccessResource";
 import {
    db,
    users,
    virtualApiKeyResources,
    virtualApiKeys,
    type VirtualApiKey
 } from "@server/db";
 import config from "@server/lib/config";
 import {
    decryptVirtualApiKeyToken,
    VIRTUAL_API_KEY_PREFIX,
    looksLikeVirtualApiKeyCredential
 } from "@server/lib/virtualApiKey";
 import { getUserOrgRoles } from "@server/lib/userOrgRoles";
 import { and, eq } from "drizzle-orm";
 import { isWithinExpirationDate } from "oslo";
 export type VirtualApiKeyCredential = {
    virtualApiKeyId: string;
    secret: string;
 };
 export type VirtualApiKeyUserData = {
    userId: string;
    username: string;
    email: string | null;
    name: string | null;
    role: string | null;
 };
 function getHeader(
    headers: Record<string, string> | undefined,
    name: string
 ): string | undefined {
    if (!headers) {
        return undefined;
    }
    if (headers[name] !== undefined) {
        return headers[name];
    }
    const lower = name.toLowerCase();
    for (const [key, value] of Object.entries(headers)) {
        if (key.toLowerCase() === lower) {
            return value;
        }
    }
    return undefined;
 }
 function parseVkCredential(
    raw: string | undefined
 ): VirtualApiKeyCredential | null {
    if (!raw || !looksLikeVirtualApiKeyCredential(raw)) {
        return null;
    }
    const withoutPrefix = raw.trim().slice(VIRTUAL_API_KEY_PREFIX.length);
    const dot = withoutPrefix.indexOf(".");
    return {
        virtualApiKeyId: withoutPrefix.slice(0, dot),
        secret: withoutPrefix.slice(dot + 1)
    };
 }
 export function extractVirtualApiKeyCredential(
    headers: Record<string, string> | undefined
 ): VirtualApiKeyCredential | null {
    if (!headers) {
        return null;
    }
    const authorization = getHeader(headers, "authorization");
    if (authorization) {
        const bearerMatch = authorization.match(/^Bearer\s+(.+)$/i);
        if (bearerMatch) {
            const credential = parseVkCredential(bearerMatch[1]);
            if (credential) {
                return credential;
            }
        }
        const splunkMatch = authorization.match(/^Splunk\s+(.+)$/i);
        if (splunkMatch) {
            const credential = parseVkCredential(splunkMatch[1]);
            if (credential) {
                return credential;
            }
        }
    }
    const cfAig = getHeader(headers, "cf-aig-authorization");
    if (cfAig) {
        const bearerMatch = cfAig.match(/^Bearer\s+(.+)$/i);
        const credential = parseVkCredential(
            bearerMatch ? bearerMatch[1] : cfAig
        );
        if (credential) {
            return credential;
        }
    }
    for (const name of ["x-api-key", "x-goog-api-key"] as const) {
        const credential = parseVkCredential(getHeader(headers, name));
        if (credential) {
            return credential;
        }
    }
    return null;
 }
 async function buildUserData(
    userId: string,
    orgId: string
 ): Promise<VirtualApiKeyUserData | undefined> {
    const [user] = await db
        .select()
        .from(users)
        .where(eq(users.userId, userId))
        .limit(1);
    if (!user) {
        return undefined;
    }
    if (
        config.getRawConfig().flags?.require_email_verification &&
        !user.emailVerified
    ) {
        return undefined;
    }
    const userOrgRoles = await getUserOrgRoles(user.userId, orgId);
    if (userOrgRoles.length === 0) {
        return undefined;
    }
    return {
        userId: user.userId,
        username: user.username,
        email: user.email,
        name: user.name,
        role: userOrgRoles.map((r) => r.roleName).join(", ") || null
    };
 }
 async function userHasResourceAccess(
    userId: string,
    resourceId: number,
    orgId: string
 ): Promise<{ allowed: boolean; userData?: VirtualApiKeyUserData }> {
    const [user] = await db
        .select()
        .from(users)
        .where(eq(users.userId, userId))
        .limit(1);
    if (!user) {
        return { allowed: false };
    }
    if (
        config.getRawConfig().flags?.require_email_verification &&
        !user.emailVerified
    ) {
        return { allowed: false };
    }
    const userOrgRoles = await getUserOrgRoles(user.userId, orgId);
    if (userOrgRoles.length === 0) {
        return { allowed: false };
    }
    const allowed = await canUserAccessResource({
        userId,
        resourceId,
        roleIds: userOrgRoles.map((r) => r.roleId)
    });
    if (!allowed) {
        return { allowed: false };
    }
    return {
        allowed: true,
        userData: {
            userId: user.userId,
            username: user.username,
            email: user.email,
            name: user.name,
            role: userOrgRoles.map((r) => r.roleName).join(", ") || null
        }
    };
 }
 async function manualKeyHasResourceAccess(
    key: VirtualApiKey,
    resourceId: number
 ): Promise<boolean> {
    if (key.allResources) {
        return true;
    }
    const [row] = await db
        .select({ resourceId: virtualApiKeyResources.resourceId })
        .from(virtualApiKeyResources)
        .where(
            and(
                eq(virtualApiKeyResources.virtualApiKeyId, key.virtualApiKeyId),
                eq(virtualApiKeyResources.resourceId, resourceId)
            )
        )
        .limit(1);
    return Boolean(row);
 }
 async function touchLastUsedAt(virtualApiKeyId: string): Promise<void> {
    try {
        await db
            .update(virtualApiKeys)
            .set({ lastUsedAt: Date.now() })
            .where(eq(virtualApiKeys.virtualApiKeyId, virtualApiKeyId));
    } catch {
        // Best-effort; do not fail auth on audit timestamp updates.
    }
 }
 export async function verifyVirtualApiKey({
    credential,
    resourceId,
    orgId
 }: {
    credential: VirtualApiKeyCredential;
    resourceId: number;
    orgId: string;
 }): Promise<{
    valid: boolean;
    error?: string;
    key?: VirtualApiKey;
    userData?: VirtualApiKeyUserData;
 }> {
    const [key] = await db
        .select()
        .from(virtualApiKeys)
        .where(eq(virtualApiKeys.virtualApiKeyId, credential.virtualApiKeyId))
        .limit(1);
    if (!key) {
        return { valid: false, error: "Virtual API key not found" };
    }
    if (key.orgId !== orgId) {
        return { valid: false, error: "Virtual API key org mismatch" };
    }
    let plaintext: string;
    try {
        plaintext = decryptVirtualApiKeyToken(key.token);
    } catch {
        return { valid: false, error: "Virtual API key secret is invalid" };
    }
    if (plaintext !== credential.secret) {
        return { valid: false, error: "Invalid virtual API key secret" };
    }
    if (key.expiresAt && !isWithinExpirationDate(new Date(key.expiresAt))) {
        return { valid: false, error: "Virtual API key has expired" };
    }
    if (key.kind === "manual") {
        const scoped = await manualKeyHasResourceAccess(key, resourceId);
        if (!scoped) {
            return {
                valid: false,
                error: "Virtual API key is not scoped to this resource"
            };
        }
        let userData: VirtualApiKeyUserData | undefined;
        if (key.userId) {
            userData = await buildUserData(key.userId, orgId);
        }
        await touchLastUsedAt(key.virtualApiKeyId);
        return { valid: true, key, userData };
    }
    if (key.kind === "user") {
        if (!key.userId) {
            return { valid: false, error: "User virtual API key has no user" };
        }
        const access = await userHasResourceAccess(
            key.userId,
            resourceId,
            orgId
        );
        if (!access.allowed || !access.userData) {
            return {
                valid: false,
                error: "User is not allowed to access this resource"
            };
        }
        await touchLastUsedAt(key.virtualApiKeyId);
        return { valid: true, key, userData: access.userData };
    }
    return { valid: false, error: "Unknown virtual API key kind" };
 }
@@ -1,8 +0,0 @@
 export async function startCertificateManager() {
    // No-op: ACME certificate generation/management is only available in
    // builds that include the private/enterprise feature set.
 }
 export async function stopCertificateManager() {
    // No-op counterpart to startCertificateManager.
 }
@@ -3,16 +3,12 @@ import { flushConnectionLogToDb } from "#dynamic/routers/newt";
 import { flushSiteBandwidthToDb } from "@server/routers/gerbil/receiveBandwidth";
 import { stopPingAccumulator } from "@server/routers/newt/pingAccumulator";
 import { cleanup as wsCleanup } from "#dynamic/routers/ws";
 import { shutdownUsageRecorder } from "@server/lib/aiBudgetEnforcement";
 import { shutdownAiSessionLogger } from "@server/routers/aiGateway/logAiSession";
 async function cleanup() {
    await stopPingAccumulator();
    await flushBandwidthToDb();
    await flushConnectionLogToDb();
    await flushSiteBandwidthToDb();
    await shutdownUsageRecorder();
    await shutdownAiSessionLogger();
    await wsCleanup();
    process.exit(0);
@@ -795,13 +795,10 @@ export const COUNTRIES = [
        name: "Serbia",
        code: "RS"
    },
-    // Removed as this is a deprecated ISO country code, not supported anymore
+    {
-    // Also the individual flags for Serbia & Montenegro are already included in the list
+        name: "Serbia and Montenegro",
-    // more details: https://en.wikipedia.org/wiki/ISO_3166-2:CS
+        code: "CS"
-    // {
+    },
    //     name: "Serbia and Montenegro",
    //     code: "CS"
    // },
    {
        name: "Seychelles",
        code: "SC"
--- a/Show More
+++ b/Show More
`@@ -1,4 +1,4 @@`
	`FROM node:24.18.1-alpine`	`FROM node:24-alpine`

	`WORKDIR /app`	`WORKDIR /app`
		`@@ -1 +0,0 @@`
			<svg width='240' height='300' viewBox='0 0 240 300' fill='none' xmlns='http://www.w3.org/2000/svg'><g clip-path='url(#clip0_1401_86274)'><mask id='mask0_1401_86274' style='mask-type:luminance' maskUnits='userSpaceOnUse' x='0' y='0' width='240' height='300'><path d='M240 0H0V300H240V0Z' fill='white'/></mask><g mask='url(#mask0_1401_86274)'><path d='M180 240H60V120H180V240Z' fill='#CFCECD'/><path d='M180 60H60V240H180V60ZM240 300H0V0H240V300Z' fill='#211E1E'/></g></g><defs><clipPath id='clip0_1401_86274'><rect width='240' height='300' fill='white'/></clipPath></defs></svg>