Bump the npm-dependencies group across 1 directory with 19 updates

Bumps the npm-dependencies group with 19 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1131.0` | `3.1136.0` | | [@simplewebauthn/server](https://github.com/MasterKale/SimpleWebAuthn/tree/HEAD/packages/server) | `14.0.1` | `14.0.2` | | [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.102.8` | `5.103.1` | | [@tanstack/react-table](https://github.com/TanStack/table/tree/HEAD/packages/react-table) | `8.21.3` | `9.2.4` | | [js-yaml](https://github.com/nodeca/js-yaml) | `5.4.1` | `5.4.2` | | [lru-cache](https://github.com/isaacs/node-lru-cache) | `11.5.2` | `11.5.3` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.45.0` | `1.47.0` | | [moment](https://github.com/moment/moment) | `2.30.1` | `2.31.0` | | [next-intl](https://github.com/amannn/next-intl) | `4.14.4` | `4.14.5` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `10.0.9` | `10.0.10` | | [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.52.1` | `5.52.4` | | [tailwind-merge](https://github.com/dcastil/tailwind-merge/tree/HEAD/packages/tailwind-merge) | `3.6.0` | `3.7.0` | | [zod](https://github.com/colinhacks/zod) | `4.6.2` | `4.6.5` | | [@dotenvx/dotenvx](https://github.com/dotenvx/dotenvx) | `2.24.1` | `2.28.0` | | [@tanstack/react-query-devtools](https://github.com/TanStack/query/tree/HEAD/packages/react-query-devtools) | `5.102.8` | `5.103.1` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.5.1` | `26.6.2` | | [@types/nodemailer](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/nodemailer) | `8.0.1` | `8.0.2` | | [eslint](https://github.com/eslint/eslint) | `10.10.0` | `10.11.0` | | [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.8` | Updates `@aws-sdk/client-s3` from 3.1131.0 to 3.1136.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1136.0/clients/client-s3) Updates `@simplewebauthn/server` from 14.0.1 to 14.0.2 - [Release notes](https://github.com/MasterKale/SimpleWebAuthn/releases) - [Changelog](https://github.com/MasterKale/SimpleWebAuthn/blob/master/CHANGELOG.md) - [Commits](https://github.com/MasterKale/SimpleWebAuthn/commits/v14.0.2/packages/server) Updates `@tanstack/react-query` from 5.102.8 to 5.103.1 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.103.1/packages/react-query) Updates `@tanstack/react-table` from 8.21.3 to 9.2.4 - [Release notes](https://github.com/TanStack/table/releases) - [Changelog](https://github.com/TanStack/table/blob/main/packages/react-table/CHANGELOG.md) - [Commits](https://github.com/TanStack/table/commits/@tanstack/react-table@9.2.4/packages/react-table) Updates `js-yaml` from 5.4.1 to 5.4.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/5.4.1...5.4.2) Updates `lru-cache` from 11.5.2 to 11.5.3 - [Changelog](https://github.com/isaacs/node-lru-cache/blob/main/CHANGELOG.md) - [Commits](https://github.com/isaacs/node-lru-cache/compare/v11.5.2...v11.5.3) Updates `lucide-react` from 1.45.0 to 1.47.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.47.0/packages/lucide-react) Updates `moment` from 2.30.1 to 2.31.0 - [Release notes](https://github.com/moment/moment/releases) - [Changelog](https://github.com/moment/moment/blob/develop/CHANGELOG.md) - [Commits](https://github.com/moment/moment/compare/2.30.1...2.31.0) Updates `next-intl` from 4.14.4 to 4.14.5 - [Release notes](https://github.com/amannn/next-intl/releases) - [Changelog](https://github.com/amannn/next-intl/blob/main/CHANGELOG.md) - [Commits](https://github.com/amannn/next-intl/compare/v4.14.4...v4.14.5) Updates `nodemailer` from 10.0.9 to 10.0.10 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodemailer/nodemailer/compare/v10.0.9...v10.0.10) Updates `posthog-node` from 5.52.1 to 5.52.4 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.52.4/packages/node) Updates `tailwind-merge` from 3.6.0 to 3.7.0 - [Release notes](https://github.com/dcastil/tailwind-merge/releases) - [Commits](https://github.com/dcastil/tailwind-merge/commits/tailwind-merge@3.7.0/packages/tailwind-merge) Updates `zod` from 4.6.2 to 4.6.5 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](https://github.com/colinhacks/zod/compare/v4.6.2...v4.6.5) Updates `@dotenvx/dotenvx` from 2.24.1 to 2.28.0 - [Release notes](https://github.com/dotenvx/dotenvx/releases) - [Changelog](https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md) - [Commits](https://github.com/dotenvx/dotenvx/compare/v2.24.1...v2.28.0) Updates `@tanstack/react-query-devtools` from 5.102.8 to 5.103.1 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query-devtools/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query-devtools@5.103.1/packages/react-query-devtools) Updates `@types/node` from 26.5.1 to 26.6.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/nodemailer` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/nodemailer) Updates `eslint` from 10.10.0 to 10.11.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/compare/v10.10.0...v10.11.0) Updates `prettier` from 3.9.6 to 3.9.8 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.9.6...3.9.8) --- updated-dependencies: - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.1136.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@simplewebauthn/server" dependency-version: 14.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@tanstack/react-query" dependency-version: 5.103.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@tanstack/react-table" dependency-version: 9.2.4 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-dependencies - dependency-name: js-yaml dependency-version: 5.4.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: lru-cache dependency-version: 11.5.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: lucide-react dependency-version: 1.47.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: moment dependency-version: 2.31.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: next-intl dependency-version: 4.14.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: nodemailer dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: posthog-node dependency-version: 5.52.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: tailwind-merge dependency-version: 3.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: zod dependency-version: 4.6.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@dotenvx/dotenvx" dependency-version: 2.28.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@tanstack/react-query-devtools" dependency-version: 5.103.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@types/node" dependency-version: 26.6.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@types/nodemailer" dependency-version: 8.0.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: eslint dependency-version: 10.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: prettier dependency-version: 3.9.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
Merge pull request #3590 from shleeable/patch-2
2026-09-22 18:43:15 +02:00 · 2026-09-22 01:38:27 +00:00 · 2026-09-21 15:05:22 -04:00 · 2026-09-21 15:01:37 -04:00 · 2026-09-21 14:55:43 -04:00 · 2026-09-21 14:36:38 -04:00
90 changed files with 4840 additions and 2506 deletions
@@ -266,7 +266,7 @@ jobs:
            - name: Install Go
              uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
              with:
-                  go-version: 1.25
+                  go-version: 1.26

            - name: Update version in package.json
              run: |
@@ -26,7 +26,10 @@ jobs:
            - name: Set up Node.js
              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
              with:
-                node-version: '24'
+                # Match the version the app ships on (Dockerfile /
+                # Dockerfile.dev both use 24.18.1) rather than floating
+                # to the latest 24.x.
+                node-version: '24.18.1'

            - name: Install dependencies
              run: npm ci
@@ -19,7 +19,13 @@ jobs:
      - name: Install Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
-          node-version: '24'
+          # Pin to the version the app actually ships on (Dockerfile /
+          # Dockerfile.dev both use 24.18.1; .nvmrc pins the 24 major).
+          # A bare '24' floats to the latest 24.x; Node >= 24.19.0 added
+          # node::ObjectWrap cleanup hooks that crash better-sqlite3 on teardown
+          # ("Assertion failed: (env) != nullptr" in RemoveEnvironmentCleanupHook),
+          # which intermittently kills `npm run dev` in the step below.
+          node-version: '24.18.1'

      - name: Copy config file
        run: cp config/config.example.yml config/config.yml
@@ -43,19 +49,34 @@ jobs:
        run: npx tsc --noEmit

      - name: Start app in background
-        run: nohup npm run dev &
+        run: |
+          nohup npm run dev > app.log 2>&1 &
+          echo $! > app.pid

      - name: Wait for app availability
        run: |
+          print_log() {
+            if [ -f app.log ]; then cat app.log; else echo "(app.log not found)"; fi
+          }
          for i in {1..5}; do
            if curl --silent --fail http://localhost:3002/auth/login; then
              echo "App is up"
              exit 0
            fi
+            # Fail fast (and show why) if the process is gone. Read the PID
+            # safely: if it's missing/empty (e.g. nohup never started), treat
+            # that as "not running" instead of passing a bad arg to kill.
+            pid="$(cat app.pid 2>/dev/null || true)"
+            if [ -z "$pid" ] || ! kill -0 "$pid" 2>/dev/null; then
+              echo "App process exited before becoming available. Output:"
+              print_log
+              exit 1
+            fi
            echo "Waiting for the app... attempt $i"
            sleep 5
          done
-          echo "App failed to start"
+          echo "App failed to start. Output:"
+          print_log
          exit 1

  build-sqlite:
@@ -0,0 +1,4 @@
+# typescript-eslint@8.70.0 declares a peer range of typescript "<6.1.0" and
+# hasn't caught up to typescript@7.x yet, even though it works fine against it
+# in practice. Without this, `npm install`/`npm ci` fail with ERESOLVE.
+legacy-peer-deps=true
@@ -5,7 +5,7 @@ WORKDIR /app

 RUN apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*

-COPY package*.json ./
+COPY package*.json .npmrc ./

 FROM base AS builder-dev

@@ -4,7 +4,7 @@ WORKDIR /app

 RUN apk add --no-cache python3 make g++

-COPY package*.json ./
+COPY package*.json .npmrc ./

 # Install dependencies
 RUN npm ci
@@ -142,6 +142,7 @@ Give users a landing page to quickly find and open the resources they can access
 * Create reusable views for common access patterns

 <img src="public/screenshots/resource-launcher.png" alt="Resource Launcher" width="100%" />
+<img src="public/screenshots/resource-launcher-expanded.png" alt="Resource Launcher Details Panel" width="100%" />

 ## Download Clients

@@ -2,8 +2,8 @@

 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
-import { setAdminCredentials } from "@cli/commands/setAdminCredentials";
-import { resetUserSecurityKeys } from "@cli/commands/resetUserSecurityKeys";
+import { setAdminCredentials } from "./commands/setAdminCredentials";
+import { resetUserSecurityKeys } from "./commands/resetUserSecurityKeys";
 import { clearExitNodes } from "./commands/clearExitNodes";
 import { rotateServerSecret } from "./commands/rotateServerSecret";
 import { clearLicenseKeys } from "./commands/clearLicenseKeys";
@@ -1,3 +1,3 @@
 ## Example Docker Reference HA Deployment

-This directory contains basic config for a highly available deployment of Pangolin with two nodes. For more information [refer to the docs](/self-host/clustering/understanding-clustering).
+This directory contains a basic reference config for a highly available deployment of Pangolin with two nodes. For more information [refer to the docs](https://docs.pangolin.net/self-host/clustering/understanding-clustering).
@@ -1,7 +1,7 @@
 name: pangolin
 services:
  pangolin:
-    image: docker.io/fosrl/pangolin:ee-latest
+    image: docker.io/fosrl/pangolin:ee-postgresql-latest
    container_name: pangolin
    restart: unless-stopped
    volumes:
@@ -1,7 +1,7 @@
 name: pangolin
 services:
  pangolin:
-    image: docker.io/fosrl/pangolin:ee-latest
+    image: docker.io/fosrl/pangolin:ee-postgresql-latest
    container_name: pangolin
    restart: unless-stopped
    volumes:
@@ -1,11 +1,11 @@
 module installer

-go 1.25.0
+go 1.26.0

 require (
 	github.com/charmbracelet/huh v1.0.0
 	github.com/charmbracelet/lipgloss v1.1.0
-	golang.org/x/term v0.45.0
+	golang.org/x/term v0.46.0
 	gopkg.in/yaml.v3 v3.0.1
 )

@@ -33,6 +33,6 @@ require (
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	golang.org/x/sync v0.15.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
 	golang.org/x/text v0.23.0 // indirect
 )
@@ -69,10 +69,10 @@ golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
 golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
+golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
 golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
 golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
@@ -1118,8 +1118,10 @@
    "sitesNotFound": "Няма намерени сайтове.",
    "pangolinServerAdmin": "Администратор на сървър - Панголин",
    "licenseTierProfessional": "Професионален лиценз",
-    "licenseTierEnterprise": "Предприятие лиценз",
-    "licenseTierPersonal": "Персонален лиценз",
+    "licenseTierEnterprise": "Предприятие",
+    "licenseTierPersonal": "Личен",
+    "licenseTierTier1": "Начален",
+    "licenseTierTier2": "Мащаб",
    "licensed": "Лицензиран",
    "yes": "Да",
    "no": "Не",
@@ -1118,8 +1118,10 @@
    "sitesNotFound": "Nebyly nalezeny žádné stránky.",
    "pangolinServerAdmin": "Správce serveru - Pangolin",
    "licenseTierProfessional": "Profesionální licence",
-    "licenseTierEnterprise": "Podniková licence",
-    "licenseTierPersonal": "Osobní licence",
+    "licenseTierEnterprise": "Podniky",
+    "licenseTierPersonal": "Osobní",
+    "licenseTierTier1": "Počáteční",
+    "licenseTierTier2": "Měřítko",
    "licensed": "Licencováno",
    "yes": "Ano",
    "no": "Ne",
@@ -3979,7 +3981,7 @@
    "tpmAvailable": "TPM k dispozici",
    "windowsAntivirusEnabled": "Antivirus povolen",
    "macosSipEnabled": "Ochrana systémové integrity (SIP)",
-    "macosGatekeeperEnabled": "Gatekeeper",
+    "macosGatekeeperEnabled": "Strážce",
    "macosFirewallStealthMode": "Režim neviditelnosti firewallu",
    "linuxAppArmorEnabled": "Pancíř aplikace",
    "linuxSELinuxEnabled": "SELinux",
@@ -1118,8 +1118,10 @@
    "sitesNotFound": "Ingen sites fundet.",
    "pangolinServerAdmin": "Serveradmin - Pangolin",
    "licenseTierProfessional": "Professionel licens",
-    "licenseTierEnterprise": "Enterprise-licens",
-    "licenseTierPersonal": "Personlig licens",
+    "licenseTierEnterprise": "Bedrift",
+    "licenseTierPersonal": "Personlig",
+    "licenseTierTier1": "Begynder",
+    "licenseTierTier2": "Skala",
    "licensed": "Licenseret",
    "yes": "Ja",
    "no": "Nej",
@@ -2068,7 +2070,7 @@
    "aiUsageFilterNotFound": "Ingen valg fundet",
    "aiUsageResetFilters": "Nulstil Filtre",
    "aiUsageRefresh": "Opdater",
-    "aiUsageTokenTypePrompt": "Prompt",
+    "aiUsageTokenTypePrompt": "Vis",
    "aiUsageTokenTypeCacheRead": "Cache læs",
    "aiUsageTokenTypeCacheWrite": "Cache skriv",
    "aiUsageTokenTypeCompletion": "Komplettering",
@@ -1118,8 +1118,10 @@
    "sitesNotFound": "Keine Standorte gefunden.",
    "pangolinServerAdmin": "Server-Admin - Pangolin",
    "licenseTierProfessional": "Professional Lizenz",
-    "licenseTierEnterprise": "Enterprise Lizenz",
-    "licenseTierPersonal": "Persönliche Lizenz",
+    "licenseTierEnterprise": "Firma",
+    "licenseTierPersonal": "Persönlich",
+    "licenseTierTier1": "Starter",
+    "licenseTierTier2": "Maßstab",
    "licensed": "Lizenziert",
    "yes": "Ja",
    "no": "Nein",
@@ -3205,7 +3207,7 @@
    "idpAzureClientIdDescription2": "Azure App Registration Client ID",
    "idpAzureClientSecretDescription2": "Azure App Registration Client Geheimnis",
    "idpGoogleDescription": "Google OAuth2/OIDC Provider",
-    "idpAzureDescription": "Microsoft Azure OAuth2/OIDC provider",
+    "idpAzureDescription": "Microsoft Azure OAuth2/OIDC-Anbieter",
    "subnet": "Subnetz",
    "utilitySubnet": "Nutzsubnetz",
    "subnetDescription": "Das Subnetz für die Netzwerkkonfiguration dieser Organisation.",
@@ -234,6 +234,9 @@
    "clientResourceDescription": "Create and manage resources that are only accessible through a connected client",
    "privateResourcesBannerTitle": "Zero-Trust Private Access",
    "privateResourcesBannerDescription": "Private resources use zero-trust security, ensuring users and machines can only access resources you explicitly grant. Connect user devices or machine clients to access these resources over a secure virtual private network.",
+    "licenseBillingBannerTitle": "Manage License Billing",
+    "licenseBillingBannerDescription": "To manage billing for your license keys, including payment methods and invoices, visit the billing page.",
+    "licenseBillingBannerButton": "Go to Billing",
    "resourcesSearch": "Search resources...",
    "resourceAdd": "Add Resource",
    "resourceErrorDelte": "Error deleting resource",
@@ -1118,8 +1121,10 @@
    "sitesNotFound": "No sites found.",
    "pangolinServerAdmin": "Server Admin - Pangolin",
    "licenseTierProfessional": "Professional License",
-    "licenseTierEnterprise": "Enterprise License",
-    "licenseTierPersonal": "Personal License",
+    "licenseTierEnterprise": "Enterprise",
+    "licenseTierPersonal": "Personal",
+    "licenseTierTier1": "Starter",
+    "licenseTierTier2": "Scale",
    "licensed": "Licensed",
    "yes": "Yes",
    "no": "No",
@@ -1118,8 +1118,10 @@
    "sitesNotFound": "Sitios no encontrados.",
    "pangolinServerAdmin": "Admin Servidor - Pangolin",
    "licenseTierProfessional": "Licencia profesional",
-    "licenseTierEnterprise": "Licencia Enterprise",
-    "licenseTierPersonal": "Licencia personal",
+    "licenseTierEnterprise": "Empresa",
+    "licenseTierPersonal": "Uso personal",
+    "licenseTierTier1": "Iniciador",
+    "licenseTierTier2": "Escala",
    "licensed": "Licenciado",
    "yes": "Sí",
    "no": "Nu",
@@ -1118,8 +1118,10 @@
    "sitesNotFound": "Aucun site trouvé.",
    "pangolinServerAdmin": "Admin Serveur - Pangolin",
    "licenseTierProfessional": "Licence Professionnelle",
-    "licenseTierEnterprise": "Licence Entreprise",
-    "licenseTierPersonal": "Licence personnelle",
+    "licenseTierEnterprise": "Entreprise",
+    "licenseTierPersonal": "Personnel",
+    "licenseTierTier1": "Démarrage",
+    "licenseTierTier2": "Échelle",
    "licensed": "Sous licence",
    "yes": "Oui",
    "no": "Non",
@@ -1118,8 +1118,10 @@
    "sitesNotFound": "Nessun sito trovato.",
    "pangolinServerAdmin": "Server Admin - Pangolina",
    "licenseTierProfessional": "Licenza Professional",
-    "licenseTierEnterprise": "Licenza Enterprise",
-    "licenseTierPersonal": "Licenza Personale",
+    "licenseTierEnterprise": "Impresa",
+    "licenseTierPersonal": "Personale",
+    "licenseTierTier1": "Avviatore",
+    "licenseTierTier2": "Scala",
    "licensed": "Con Licenza",
    "yes": "Sì",
    "no": "No",
@@ -1118,8 +1118,10 @@
    "sitesNotFound": "사이트를 찾을 수 없습니다.",
    "pangolinServerAdmin": "서버 관리자 - 판골린",
    "licenseTierProfessional": "전문 라이센스",
-    "licenseTierEnterprise": "기업 라이선스",
-    "licenseTierPersonal": "개인 라이선스",
+    "licenseTierEnterprise": "기업",
+    "licenseTierPersonal": "개인",
+    "licenseTierTier1": "스타터",
+    "licenseTierTier2": "스케일",
    "licensed": "라이센스",
    "yes": "예",
    "no": "아니요",
@@ -1118,8 +1118,10 @@
    "sitesNotFound": "Ingen områder funnet.",
    "pangolinServerAdmin": "Server Admin - Pangolin",
    "licenseTierProfessional": "Profesjonell lisens",
-    "licenseTierEnterprise": "Bedriftslisens",
-    "licenseTierPersonal": "Personlig lisens",
+    "licenseTierEnterprise": "Bedrift",
+    "licenseTierPersonal": "Personlig",
+    "licenseTierTier1": "Begynner",
+    "licenseTierTier2": "Skala",
    "licensed": "Lisensiert",
    "yes": "Ja",
    "no": "Nei",
@@ -2816,7 +2818,7 @@
    "roleTextImportPreview": "Forhåndsvisning",
    "roleTextImportItemCount": "{count, plural, =0 {Ingen elementer å importere} one {ett element å importere} other {# elementer å importere}}",
    "roleTextImportTotalCount": "{existing} eksisterende + {imported} importert = {total} totalt",
-    "roleTextImportConfirm": "Import",
+    "roleTextImportConfirm": "Importer",
    "roleTextImportInvalidFile": "Ustøttet filtype",
    "roleTextImportInvalidFileDescription": "Bare .txt og .csv filer er støttet.",
    "roleTextImportEmpty": "Ingen elementer funnet i filen",
@@ -3093,7 +3095,7 @@
    "regionAfrica": "Afrika",
    "regionNorthernAfrica": "[country name] Nord-Afrika",
    "regionEasternAfrica": "Øst-Afrika",
-    "regionMiddleAfrica": "Middle Africa",
+    "regionMiddleAfrica": "Midt-Afrika",
    "regionSouthernAfrica": "Sør-Afrika",
    "regionWesternAfrica": "[country name] Vest-Afrika",
    "regionAmericas": "Amerika",
@@ -3112,10 +3114,10 @@
    "regionNorthernEurope": "Nord-Europa",
    "regionSouthernEurope": "Sørlige Europa",
    "regionWesternEurope": "Vest-Europa",
-    "regionOceania": "Oceania",
+    "regionOceania": "Oseania",
    "regionAustraliaAndNewZealand": "Australia og New Zealand",
    "regionMelanesia": "Melanesia",
-    "regionMicronesia": "Micronesia",
+    "regionMicronesia": "Mikronesia",
    "regionPolynesia": "Polynesia",
    "managedSelfHosted": {
        "title": "Administrert selv-hostet",
@@ -3205,7 +3207,7 @@
    "idpAzureClientIdDescription2": "Azure App registrerings klient-ID",
    "idpAzureClientSecretDescription2": "Azure App Registrering Klient Hemmelig",
    "idpGoogleDescription": "Google OAuth2/OIDC leverandør",
-    "idpAzureDescription": "Microsoft Azure OAuth2/OIDC provider",
+    "idpAzureDescription": "Microsoft Azure OAuth2/OIDC-leverandør",
    "subnet": "Subnett",
    "utilitySubnet": "Nyttesubnett",
    "subnetDescription": "Undernettverket for denne organisasjonens nettverkskonfigurasjon.",
@@ -3220,7 +3222,7 @@
    "authPageBrandingRemoveTitle": "Fjern markedsføring for autentiseringsside",
    "authPageBrandingQuestionRemove": "Er du sikker på at du vil fjerne merkevarebyggingen for autentiseringssider?",
    "authPageBrandingDeleteConfirm": "Bekreft sletting av merkevarebygging",
-    "brandingLogoURL": "Logo URL",
+    "brandingLogoURL": "Logo-URL",
    "brandingLogoURLOrPath": "Logoen URL eller sti",
    "brandingLogoPathDescription": "Skriv inn en URL eller en lokal bane.",
    "brandingLogoURLDescription": "Skriv inn en offentlig tilgjengelig nettadresse til din logobilde.",
@@ -3360,7 +3362,7 @@
    "resourceHeaderAuthSetupTitleDescription": "Angi grunnleggende auth legitimasjon (brukernavn og passord) for å beskytte denne ressursen med HTTP Header autentisering. Tilgang til det ved hjelp av formatet https://username:password@resource.example.com",
    "resourceHeaderAuthSubmit": "Angi topptekst godkjenning",
    "actionSetResourceHeaderAuth": "Angi topptekst godkjenning",
-    "enterpriseEdition": "Enterprise Edition",
+    "enterpriseEdition": "Enterprise-utgave",
    "unlicensed": "Ikke lisensiert",
    "beta": "beta",
    "manageUserDevices": "Bruker Enheter",
@@ -3501,7 +3503,7 @@
    "priority": "Prioritet",
    "priorityDescription": "Høyere prioriterte ruter evalueres først. Prioritet = 100 betyr automatisk bestilling (systembeslutninger). Bruk et annet nummer til å håndheve manuell prioritet.",
    "instanceName": "Forekomst navn",
-    "clearInstanceName": "Reset Server Association",
+    "clearInstanceName": "Tilbakestill server-assosiasjon",
    "pathMatchModalTitle": "Konfigurere matching av sti",
    "pathMatchModalDescription": "Sett opp hvordan innkommende forespørsler skal matches basert på deres bane.",
    "pathMatchType": "Trefftype",
@@ -3557,11 +3559,11 @@
    "allowedByRule": "Tillatt etter regel",
    "allowedNoAuth": "Tillatt Ingen Auth",
    "validAccessToken": "Gyldig tilgangsnøkkel",
-    "validHeaderAuth": "Valid header auth",
+    "validHeaderAuth": "Gyldig header-autentisering",
    "validPincode": "Gyldig PIN-kode",
    "validPassword": "Gyldig passord",
-    "validEmail": "Valid email",
-    "validSSO": "Valid SSO",
+    "validEmail": "Gyldig e-post",
+    "validSSO": "Gyldig SSO",
    "validVirtualAPIKey": "Gyldig Virtuell API-nøkkel",
    "view": "Vis",
    "configManaged": "Konfigurasjon administrert",
@@ -3570,7 +3572,7 @@
    "droppedByRule": "Legg i regelen",
    "noSessions": "Ingen økter",
    "temporaryRequestToken": "Midlertidig forespørsel Token",
-    "noMoreAuthMethods": "No Valid Auth",
+    "noMoreAuthMethods": "Ingen gyldig autentisering",
    "ip": "IP",
    "reason": "Grunn",
    "requestLogs": "HTTP-forespørselslogger",
@@ -3784,14 +3786,14 @@
    "niceIdUpdateErrorDescription": "Det oppstod en feil under oppdatering av Nice ID.",
    "niceIdCannotBeEmpty": "God ID kan ikke være tom",
    "enterIdentifier": "Angi identifikator",
-    "identifier": "Identifier",
+    "identifier": "Identifikator",
    "deviceLoginUseDifferentAccount": "Ikke du? Bruk en annen konto.",
    "deviceLoginDeviceRequestingAccessToAccount": "En enhet ber om tilgang til denne kontoen.",
    "loginSelectAuthenticationMethod": "Velg en autentiseringsmetode for å fortsette.",
    "noData": "Ingen data",
    "machineClients": "Maskinklienter",
    "install": "Installer",
-    "downloadInstaller": "Download Installer",
+    "downloadInstaller": "Last ned installasjonsprogram",
    "run": "Kjør",
    "envFile": "Miljøfil",
    "serviceFile": "Tjenestefil",
@@ -3969,7 +3971,7 @@
    "kernelVersion": "Kjerne versjon",
    "deviceModel": "Enhets modell",
    "serialNumber": "Serienummer",
-    "hostname": "Hostname",
+    "hostname": "Vertsnavn",
    "firstSeen": "Først sett",
    "lastSeen": "Sist sett",
    "biometricsEnabled": "Biometri aktivert",
@@ -3999,7 +4001,7 @@
    "disconnected": "Frakoblet",
    "approvalsEmptyStateTitle": "Enhetsgodkjenninger er ikke aktivert",
    "approvalsEmptyStateDescription": "Aktivere godkjenninger av enheter for at roller må godkjennes av admin før brukere kan koble til nye enheter.",
-    "approvalsEmptyStateHowToTitle": "How to Enable",
+    "approvalsEmptyStateHowToTitle": "Hvordan aktivere",
    "approvalsEmptyStateStep1Title": "Gå til roller",
    "approvalsEmptyStateStep1Description": "Naviger til organisasjonens roller innstillinger for å konfigurere enhetsgodkjenninger.",
    "approvalsEmptyStateStep2Title": "Aktiver enhetsgodkjenninger",
@@ -459,13 +459,13 @@
    "searchApiKeys": "API sleutels zoeken...",
    "apiKeysAdd": "API sleutel genereren",
    "apiKeysErrorDelete": "Fout bij verwijderen API sleutel",
-    "apiKeysErrorDeleteMessage": "Fout bij verwijderen API sleutel",
+    "apiKeysErrorDeleteMessage": "Fout bij verwijderen API- leutel",
    "apiKeysQuestionRemove": "Weet u zeker dat u de API sleutel van de organisatie wilt verwijderen?",
-    "apiKeysMessageRemove": "Eenmaal verwijderd, kan de API sleutel niet meer worden gebruikt.",
-    "apiKeysDeleteConfirm": "Bevestig Verwijderen API sleutel",
+    "apiKeysMessageRemove": "Eenmaal verwijderd, kan de APIsleutel niet meer worden gebruikt.",
+    "apiKeysDeleteConfirm": "Bevestig verwijderen API sleutel",
    "apiKeysDelete": "API sleutel verwijderen",
    "apiKeysManage": "API sleutels beheren",
-    "apiKeysDescription": "API sleutels worden gebruikt om toegang te verifiëren met de integratie API ",
+    "apiKeysDescription": "API sleutels worden gebruikt om te verifiëren met de integratie-API",
    "orgsManage": "Organisaties Beheren",
    "orgsDescription": "Bekijk en beheer alle organisaties op dit systeem",
    "provisioningKeysTitle": "Vertrekkende sleutel",
@@ -1118,8 +1118,10 @@
    "sitesNotFound": "Geen sites gevonden.",
    "pangolinServerAdmin": "Serverbeheer - Pangolin",
    "licenseTierProfessional": "Professionele licentie",
-    "licenseTierEnterprise": "Enterprise Licentie",
-    "licenseTierPersonal": "Persoonlijke licentie",
+    "licenseTierEnterprise": "Onderneming",
+    "licenseTierPersonal": "Persoonlijk",
+    "licenseTierTier1": "Beginner",
+    "licenseTierTier2": "Schaal",
    "licensed": "Gelicentieerd",
    "yes": "ja",
    "no": "Neen",
@@ -3205,7 +3207,7 @@
    "idpAzureClientIdDescription2": "Azure App registratie Client ID",
    "idpAzureClientSecretDescription2": "Azure App registratie client geheim",
    "idpGoogleDescription": "Algemene OAuth2/OIDC provider",
-    "idpAzureDescription": "Microsoft Azure OAuth2/OIDC provider",
+    "idpAzureDescription": "Microsoft Azure OAuth2/OIDC-provider",
    "subnet": "Subnet",
    "utilitySubnet": "Hulpmiddel Subnet",
    "subnetDescription": "Het subnet van de netwerkconfiguratie van deze organisatie.",
@@ -1118,8 +1118,10 @@
    "sitesNotFound": "Nie znaleziono witryn.",
    "pangolinServerAdmin": "Administrator serwera - Pangolin",
    "licenseTierProfessional": "Licencja Professional",
-    "licenseTierEnterprise": "Licencja Enterprise",
-    "licenseTierPersonal": "Licencja osobista",
+    "licenseTierEnterprise": "Przedsiębiorstwo",
+    "licenseTierPersonal": "Osobiste",
+    "licenseTierTier1": "Startowy",
+    "licenseTierTier2": "Skala",
    "licensed": "Licencjonowany",
    "yes": "Tak",
    "no": "Nie",
@@ -3791,7 +3793,7 @@
    "noData": "Brak danych",
    "machineClients": "Klienci maszyn",
    "install": "Zainstaluj",
-    "downloadInstaller": "Download Installer",
+    "downloadInstaller": "Pobierz instalator",
    "run": "Uruchom",
    "envFile": "Plik środowiska",
    "serviceFile": "Plik serwisu",
@@ -3999,7 +4001,7 @@
    "disconnected": "Rozłączony",
    "approvalsEmptyStateTitle": "Zatwierdzanie urządzenia nie włączone",
    "approvalsEmptyStateDescription": "Włącz zatwierdzanie urządzeń dla ról aby wymagać zgody administratora, zanim użytkownicy będą mogli podłączyć nowe urządzenia.",
-    "approvalsEmptyStateHowToTitle": "How to Enable",
+    "approvalsEmptyStateHowToTitle": "Jak włączyć",
    "approvalsEmptyStateStep1Title": "Przejdź do ról",
    "approvalsEmptyStateStep1Description": "Przejdź do ustawień ról swojej organizacji, aby skonfigurować zatwierdzenia urządzenia.",
    "approvalsEmptyStateStep2Title": "Włącz zatwierdzanie urządzenia",
@@ -1118,8 +1118,10 @@
    "sitesNotFound": "Nenhum site encontrado.",
    "pangolinServerAdmin": "Administrador do Servidor - Pangolin",
    "licenseTierProfessional": "Licença Profissional",
-    "licenseTierEnterprise": "Licença Empresarial",
-    "licenseTierPersonal": "Licença Pessoal",
+    "licenseTierEnterprise": "Empresa",
+    "licenseTierPersonal": "Pessoal",
+    "licenseTierTier1": "Iniciante",
+    "licenseTierTier2": "Escala",
    "licensed": "Licenciado",
    "yes": "Sim",
    "no": "Não",
@@ -1118,8 +1118,10 @@
    "sitesNotFound": "Сайты не найдены.",
    "pangolinServerAdmin": "Администратор сервера - Pangolin",
    "licenseTierProfessional": "Профессиональная лицензия",
-    "licenseTierEnterprise": "Корпоративная лицензия",
-    "licenseTierPersonal": "Личная лицензия",
+    "licenseTierEnterprise": "Предприятие",
+    "licenseTierPersonal": "Личное",
+    "licenseTierTier1": "Старт",
+    "licenseTierTier2": "Масштаб",
    "licensed": "Лицензировано",
    "yes": "Да",
    "no": "Нет",
@@ -1118,8 +1118,10 @@
    "sitesNotFound": "Site bulunamadı.",
    "pangolinServerAdmin": "Sunucu Yöneticisi - Pangolin",
    "licenseTierProfessional": "Profesyonel Lisans",
-    "licenseTierEnterprise": "Kurumsal Lisans",
-    "licenseTierPersonal": "Kişisel Lisans",
+    "licenseTierEnterprise": "Kurumsal",
+    "licenseTierPersonal": "Kişisel",
+    "licenseTierTier1": "Başlangıç",
+    "licenseTierTier2": "Ölçek",
    "licensed": "Lisanslı",
    "yes": "Evet",
    "no": "Hayır",
@@ -1118,8 +1118,10 @@
    "sitesNotFound": "未找到站点。",
    "pangolinServerAdmin": "服务器管理 - Pangolin",
    "licenseTierProfessional": "专业许可证",
-    "licenseTierEnterprise": "企业许可证",
-    "licenseTierPersonal": "个人许可证",
+    "licenseTierEnterprise": "企业",
+    "licenseTierPersonal": "个人",
+    "licenseTierTier1": "启动器",
+    "licenseTierTier2": "扩展",
    "licensed": "已授权",
    "yes": "是",
    "no": "否",
@@ -33,13 +33,13 @@
    },
    "dependencies": {
        "@asteasolutions/zod-to-openapi": "9.1.0",
-        "@aws-sdk/client-s3": "3.1121.0",
+        "@aws-sdk/client-s3": "3.1136.0",
        "@devolutions/iron-remote-desktop": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-0.0.0.tgz",
        "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
        "@headlessui/react": "2.2.10",
        "@hookform/resolvers": "5.9.1",
        "@monaco-editor/react": "4.7.0",
-        "@node-rs/argon2": "2.2.0",
+        "@node-rs/argon2": "2.2.1",
        "@novnc/novnc": "^1.7.0",
        "@oslojs/crypto": "1.0.1",
        "@oslojs/encoding": "1.1.0",
@@ -65,11 +65,11 @@
        "@react-email/components": "1.0.12",
        "@react-email/render": "2.1.0",
        "@react-email/tailwind": "2.0.7",
-        "@simplewebauthn/browser": "13.3.0",
-        "@simplewebauthn/server": "13.3.3",
+        "@simplewebauthn/browser": "14.0.0",
+        "@simplewebauthn/server": "14.0.2",
        "@tailwindcss/forms": "0.5.11",
-        "@tanstack/react-query": "5.102.8",
-        "@tanstack/react-table": "8.21.3",
+        "@tanstack/react-query": "5.103.1",
+        "@tanstack/react-table": "9.2.4",
        "@xterm/addon-fit": "^0.11.0",
        "@xterm/addon-web-links": "^0.12.0",
        "@xterm/xterm": "^6.0.0",
@@ -96,34 +96,34 @@
        "input-otp": "1.5.0",
        "ioredis": "6.0.0",
        "jmespath": "0.16.0",
-        "js-yaml": "5.4.1",
+        "js-yaml": "5.4.2",
        "jsonwebtoken": "9.0.3",
-        "lru-cache": "11.5.2",
-        "lucide-react": "1.38.0",
+        "lru-cache": "11.5.3",
+        "lucide-react": "1.47.0",
        "maxmind": "5.0.7",
-        "moment": "2.30.1",
-        "next": "16.3.3",
-        "next-intl": "4.14.1",
+        "moment": "2.31.0",
+        "next": "16.3.5",
+        "next-intl": "4.14.5",
        "next-themes": "0.4.6",
        "nextjs-toploader": "3.9.17",
-        "nodemailer": "9.1.0",
+        "nodemailer": "10.0.10",
        "oslo": "1.2.1",
        "pg": "8.23.0",
-        "posthog-node": "5.51.4",
+        "posthog-node": "5.52.4",
        "qrcode.react": "4.2.0",
-        "react": "19.2.8",
-        "react-day-picker": "9.14.0",
-        "react-dom": "19.2.8",
+        "react": "19.3.0",
+        "react-day-picker": "10.0.1",
+        "react-dom": "19.3.0",
        "react-easy-sort": "1.8.0",
-        "react-hook-form": "7.87.0",
+        "react-hook-form": "7.88.0",
        "react-icons": "5.7.0",
        "recharts": "3.10.1",
        "reodotdev": "1.1.0",
        "semver": "7.8.5",
        "sshpk": "1.18.0",
-        "stripe": "22.6.0",
+        "stripe": "22.6.2",
        "swagger-ui-express": "5.0.1",
-        "tailwind-merge": "3.6.0",
+        "tailwind-merge": "3.7.0",
        "topojson-client": "3.1.0",
        "tw-animate-css": "1.4.0",
        "use-debounce": "10.1.1",
@@ -133,17 +133,17 @@
        "winston": "3.19.0",
        "winston-daily-rotate-file": "5.0.0",
        "ws": "8.21.3",
-        "yaml": "2.9.0",
+        "yaml": "2.9.1",
        "yargs": "18.1.0",
-        "zod": "4.5.4",
+        "zod": "4.6.5",
        "zod-validation-error": "5.0.0"
    },
    "devDependencies": {
-        "@dotenvx/dotenvx": "2.23.0",
+        "@dotenvx/dotenvx": "2.28.0",
        "@esbuild-plugins/tsconfig-paths": "0.1.2",
-        "@react-email/ui": "^6.9.3",
+        "@react-email/ui": "^6.9.5",
        "@tailwindcss/postcss": "4.3.3",
-        "@tanstack/react-query-devtools": "5.102.8",
+        "@tanstack/react-query-devtools": "5.103.1",
        "@types/better-sqlite3": "7.6.13",
        "@types/cookie-parser": "1.4.10",
        "@types/cors": "2.8.19",
@@ -155,12 +155,12 @@
        "@types/jmespath": "0.15.2",
        "@types/js-yaml": "4.0.9",
        "@types/jsonwebtoken": "9.0.10",
-        "@types/node": "26.4.0",
-        "@types/nodemailer": "8.0.1",
+        "@types/node": "26.6.2",
+        "@types/nodemailer": "8.0.2",
        "@types/nprogress": "0.2.3",
        "@types/pg": "8.23.1",
-        "@types/react": "19.2.18",
-        "@types/react-dom": "19.2.5",
+        "@types/react": "19.3.0",
+        "@types/react-dom": "19.3.0",
        "@types/semver": "7.8.0",
        "@types/sshpk": "1.17.5",
        "@types/swagger-ui-express": "4.1.8",
@@ -171,20 +171,20 @@
        "drizzle-kit": "0.31.10",
        "esbuild": "0.28.2",
        "esbuild-node-externals": "2.0.0",
-        "eslint": "10.9.1",
-        "eslint-config-next": "16.3.3",
-        "postcss": "8.5.26",
-        "prettier": "3.9.6",
-        "react-email": "6.9.3",
+        "eslint": "10.11.0",
+        "eslint-config-next": "16.3.5",
+        "postcss": "8.5.28",
+        "prettier": "3.9.8",
+        "react-email": "6.9.5",
        "tailwindcss": "4.3.3",
-        "tsc-alias": "1.9.2",
+        "tsc-alias": "1.9.5",
        "tsx": "4.23.13",
-        "typescript": "6.0.3",
-        "typescript-eslint": "8.68.0"
+        "typescript": "7.0.2",
+        "typescript-eslint": "8.70.0"
    },
    "overrides": {
        "esbuild": "0.28.2",
        "dompurify": "3.4.0",
-        "postcss": "8.5.26"
+        "postcss": "8.5.28"
    }
 }
@@ -1,5 +1,6 @@
 import { drizzle as DrizzlePostgres } from "drizzle-orm/node-postgres";
 import { readConfigFile } from "@server/lib/readConfigFile";
+import { readEnvOrFile } from "@server/lib/getEnvOrYaml";
 import { withReplicas } from "drizzle-orm/pg-core";
 import { createPool } from "./poolConfig";

@@ -7,17 +8,20 @@ function createDb() {
    const config = readConfigFile();

    // check the environment variables for postgres config first before the config file
-    if (process.env.POSTGRES_CONNECTION_STRING) {
+    const envConnectionString = readEnvOrFile("POSTGRES_CONNECTION_STRING");
+    if (envConnectionString) {
        config.postgres = {
-            connection_string: process.env.POSTGRES_CONNECTION_STRING
+            connection_string: envConnectionString
        };
-        if (process.env.POSTGRES_REPLICA_CONNECTION_STRINGS) {
-            const replicas =
-                process.env.POSTGRES_REPLICA_CONNECTION_STRINGS.split(",").map(
-                    (conn) => ({
-                        connection_string: conn.trim()
-                    })
-                );
+        const replicaConnectionStrings = readEnvOrFile(
+            "POSTGRES_REPLICA_CONNECTION_STRINGS"
+        );
+        if (replicaConnectionStrings) {
+            const replicas = replicaConnectionStrings
+                .split(",")
+                .map((conn) => ({
+                    connection_string: conn.trim()
+                }));
            config.postgres.replicas = replicas;
        }
    }
@@ -1,5 +1,6 @@
 import { drizzle as DrizzlePostgres } from "drizzle-orm/node-postgres";
 import { readConfigFile } from "@server/lib/readConfigFile";
+import { readEnvOrFile } from "@server/lib/getEnvOrYaml";
 import { withReplicas } from "drizzle-orm/pg-core";
 import { build } from "@server/build";
 import { db as mainDb } from "./driver";
@@ -17,7 +18,7 @@ function createLogsDb() {
    const logsConfig = config.postgres_logs;

    // Check environment variable first
-    let connectionString = process.env.POSTGRES_LOGS_CONNECTION_STRING;
+    let connectionString = readEnvOrFile("POSTGRES_LOGS_CONNECTION_STRING");
    let replicaConnections: Array<{ connection_string: string }> = [];

    if (!connectionString && logsConfig) {
@@ -26,13 +27,15 @@ function createLogsDb() {
    }

    // If POSTGRES_LOGS_REPLICA_CONNECTION_STRINGS is set, use it
-    if (process.env.POSTGRES_LOGS_REPLICA_CONNECTION_STRINGS) {
-        replicaConnections =
-            process.env.POSTGRES_LOGS_REPLICA_CONNECTION_STRINGS.split(",").map(
-                (conn) => ({
-                    connection_string: conn.trim()
-                })
-            );
+    const replicaConnectionStrings = readEnvOrFile(
+        "POSTGRES_LOGS_REPLICA_CONNECTION_STRINGS"
+    );
+    if (replicaConnectionStrings) {
+        replicaConnections = replicaConnectionStrings
+            .split(",")
+            .map((conn) => ({
+                connection_string: conn.trim()
+            }));
    }

    // If no logs database is configured, fall back to main database
@@ -6,6 +6,7 @@ import fs from "fs";
 import { APP_PATH } from "@server/lib/consts";
 import { existsSync, mkdirSync } from "fs";
 import logger from "@server/logger";
+import { readEnvOrFile } from "@server/lib/getEnvOrYaml";

 export const location = path.join(APP_PATH, "db", "db.sqlite");
 export const exists = checkFileExists(location);
@@ -19,7 +20,7 @@ function createDb() {
            : undefined;
    const sqlite = new Database(location, { verbose });

-    if (process.env.ENABLE_SQLITE_WAL_MODE == "true") {
+    if (readEnvOrFile("ENABLE_SQLITE_WAL_MODE") == "true") {
        // Enable WAL mode — allows concurrent readers + single writer, preventing
        // contention across subsystems (verifySession, Traefik, audit, ping).
        // NOTE: journal_mode persists in the DB file once set; unsetting this
@@ -93,9 +93,8 @@ export const EnterpriseEditionKeyGenerated = ({
                        </EmailSection>

                        <EmailText>
-                            If you need to purchase additional license keys or
-                            modify your existing license, please reach out to
-                            our support team at{" "}
+                            For any questions or concerns regarding your license
+                            or billing, please reach out to support at{" "}
                            <a
                                href="mailto:support@pangolin.net"
                                className="text-primary font-medium"
@@ -0,0 +1,138 @@
+import { formatBackupFileName, formatBackupTimestamp } from "./backupFileName";
+import { assertEquals } from "@test/assert";
+
+// Local-time constructors are used throughout, matching formatBackupTimestamp,
+// so these cases do not depend on the machine's timezone.
+
+function testMonthIsOneIndexed() {
+    console.log("Running month indexing tests...");
+
+    // The case from the report: a backup taken on 12 September 2026 was named
+    // db_2026-8-12_... because Date#getMonth is zero-indexed.
+    {
+        const result = formatBackupTimestamp(new Date(2026, 8, 12, 20, 35, 56));
+        assertEquals(
+            result,
+            "2026-09-12_20-35-56",
+            "September must render as 09, not 8"
+        );
+    }
+
+    // The other reported name, db_2026-0-23_..., was a January backup.
+    {
+        const result = formatBackupTimestamp(new Date(2026, 0, 23, 20, 25, 49));
+        assertEquals(
+            result,
+            "2026-01-23_20-25-49",
+            "January must render as 01, not 0"
+        );
+    }
+
+    {
+        const result = formatBackupTimestamp(
+            new Date(2026, 11, 31, 23, 59, 59)
+        );
+        assertEquals(
+            result,
+            "2026-12-31_23-59-59",
+            "December must render as 12"
+        );
+    }
+}
+
+function testEveryFieldIsZeroPadded() {
+    console.log("Running zero padding tests...");
+
+    // db_2026-8-12_20-36-2 in the report: a single-digit second was not padded.
+    {
+        const result = formatBackupTimestamp(new Date(2026, 8, 12, 20, 36, 2));
+        assertEquals(
+            result,
+            "2026-09-12_20-36-02",
+            "Single-digit seconds must be padded"
+        );
+    }
+
+    {
+        const result = formatBackupTimestamp(new Date(2026, 0, 1, 0, 0, 0));
+        assertEquals(
+            result,
+            "2026-01-01_00-00-00",
+            "Midnight on the first of the month must pad every field"
+        );
+    }
+}
+
+function testNamesSortChronologically() {
+    console.log("Running sort order tests...");
+
+    // Zero padding means a plain lexicographic sort of the backups directory
+    // lists the backups in the order they were taken.
+    const taken = [
+        new Date(2026, 8, 12, 20, 36, 2),
+        new Date(2026, 0, 23, 20, 25, 49),
+        new Date(2026, 8, 12, 20, 35, 56),
+        new Date(2026, 11, 31, 23, 59, 59)
+    ];
+
+    const sorted = taken.map((date) => formatBackupTimestamp(date)).sort();
+
+    assertEquals(
+        sorted.join(","),
+        [
+            "2026-01-23_20-25-49",
+            "2026-09-12_20-35-56",
+            "2026-09-12_20-36-02",
+            "2026-12-31_23-59-59"
+        ].join(","),
+        "Backup names must sort into the order the backups were taken"
+    );
+}
+
+function testFormatBackupFileName() {
+    console.log("Running backup file name formatting tests...");
+
+    const date = new Date(2026, 8, 12, 20, 35, 56);
+
+    // With semver version string without leading 'v'
+    assertEquals(
+        formatBackupFileName("1.22.0", date),
+        "db_2026-09-12_20-35-56_v1.22.0.sqlite",
+        "Filename must include timestamp and prefixed version tag"
+    );
+
+    // With version string already containing 'v'
+    assertEquals(
+        formatBackupFileName("v1.22.0", date),
+        "db_2026-09-12_20-35-56_v1.22.0.sqlite",
+        "Filename must not duplicate 'v' prefix if already present"
+    );
+
+    // Without version (fallback/default)
+    assertEquals(
+        formatBackupFileName(undefined, date),
+        "db_2026-09-12_20-35-56.sqlite",
+        "Filename without version must match default timestamped format"
+    );
+
+    // Distinct versions within the exact same second do not collide
+    const sameSecondFile1 = formatBackupFileName("1.21.0", date);
+    const sameSecondFile2 = formatBackupFileName("1.22.0", date);
+    if (sameSecondFile1 === sameSecondFile2) {
+        throw new Error(
+            "Backup file names for different versions in the same second must not collide"
+        );
+    }
+}
+
+// Run all tests
+try {
+    testMonthIsOneIndexed();
+    testEveryFieldIsZeroPadded();
+    testNamesSortChronologically();
+    testFormatBackupFileName();
+    console.log("All tests passed successfully!");
+} catch (error) {
+    console.error("Test failed:", error);
+    process.exit(1);
+}
@@ -0,0 +1,51 @@
+/**
+ * Builds the timestamp segment of a database backup file name.
+ *
+ * `Date#getMonth` is zero-indexed, so building this inline produced names like
+ * `db_2026-8-12_...` for a backup taken on 12 September 2026. Every field is
+ * also zero-padded, which keeps the names unambiguous and makes them sort
+ * lexicographically in the order they were taken.
+ *
+ * @param date The moment the backup is being taken. Defaults to now.
+ * @returns A timestamp of the form `YYYY-MM-DD_HH-MM-SS`.
+ */
+export function formatBackupTimestamp(date: Date = new Date()): string {
+    const pad = (value: number): string => String(value).padStart(2, "0");
+
+    const datePart = [
+        date.getFullYear(),
+        pad(date.getMonth() + 1),
+        pad(date.getDate())
+    ].join("-");
+
+    const timePart = [
+        pad(date.getHours()),
+        pad(date.getMinutes()),
+        pad(date.getSeconds())
+    ].join("-");
+
+    return `${datePart}_${timePart}`;
+}
+
+/**
+ * Builds the full database backup file name, including timestamp and optional version tag.
+ *
+ * When a migration version is provided, the filename includes `_v<version>`,
+ * preventing collisions between multiple migrations running in the same second and making it easy
+ * to identify the migration state contained in the backup.
+ *
+ * @param version Optional migration version being run.
+ * @param date The moment the backup is being taken. Defaults to now.
+ * @returns A filename of the form `db_YYYY-MM-DD_HH-MM-SS_v<version>.sqlite` or `db_YYYY-MM-DD_HH-MM-SS.sqlite`.
+ */
+export function formatBackupFileName(
+    version?: string,
+    date: Date = new Date()
+): string {
+    const timestamp = formatBackupTimestamp(date);
+    if (version) {
+        const versionTag = version.startsWith("v") ? version : `v${version}`;
+        return `db_${timestamp}_${versionTag}.sqlite`;
+    }
+    return `db_${timestamp}.sqlite`;
+}
@@ -1,6 +1,6 @@
 export enum LicenseId {
-    SMALL_LICENSE = "small_license",
-    BIG_LICENSE = "big_license"
+    TIER1 = "tier1",
+    TIER2 = "tier2"
 }

 export type LicensePriceSet = {
@@ -9,15 +9,15 @@ export type LicensePriceSet = {

 export const licensePriceSet: LicensePriceSet = {
    // Free license matches the freeLimitSet
-    [LicenseId.SMALL_LICENSE]: "price_1TMJzmD3Ee2Ir7Wm05NlGImT",
-    [LicenseId.BIG_LICENSE]: "price_1TMJzzD3Ee2Ir7WmzJw9TerS"
+    [LicenseId.TIER1]: "price_1TMJzmD3Ee2Ir7Wm05NlGImT",
+    [LicenseId.TIER2]: "price_1TMJzzD3Ee2Ir7WmzJw9TerS"
 };

 export const licensePriceSetSandbox: LicensePriceSet = {
    // Free license matches the freeLimitSet
    // when matching license the keys closer to 0 index are matched first so list the licenses in descending order of value
-    [LicenseId.SMALL_LICENSE]: "price_1SxDwuDCpkOb237Bz0yTiOgN",
-    [LicenseId.BIG_LICENSE]: "price_1SxDy0DCpkOb237BWJxrxYkl"
+    [LicenseId.TIER1]: "price_1SxDwuDCpkOb237Bz0yTiOgN",
+    [LicenseId.TIER2]: "price_1SxDy0DCpkOb237BWJxrxYkl"
 };

 export function getLicensePriceSet(
@@ -1,3 +1,37 @@
-export const getEnvOrYaml = (envVar: string) => (valFromYaml: any) => {
-    return process.env[envVar] ?? valFromYaml;
+import fs from "fs";
+
+// Resolves an environment variable, also honoring a `<envVar>_FILE` variant
+// that points to a file whose (trimmed) contents should be used as the
+// value. This is the common convention for consuming Docker/Swarm secrets
+// (e.g. mounted at /run/secrets/...) without putting the raw value in the
+// container's environment.
+export const readEnvOrFile = (envVar: string): string | undefined => {
+    const fileEnvVar = `${envVar}_FILE`;
+    const filePath = process.env[fileEnvVar];
+
+    if (filePath) {
+        if (process.env[envVar]) {
+            throw new Error(
+                `Both ${envVar} and ${fileEnvVar} are set. Please set only one.`
+            );
+        }
+
+        try {
+            return fs.readFileSync(filePath, "utf8").trim();
+        } catch (error) {
+            throw new Error(
+                `Failed to read ${fileEnvVar} (${filePath}): ${
+                    error instanceof Error ? error.message : error
+                }`
+            );
+        }
+    }
+
+    return process.env[envVar];
 };
+
+export const getEnvOrYaml =
+    (envVar: string) =>
+    (valFromYaml: string | undefined): string | undefined => {
+        return readEnvOrFile(envVar) ?? valFromYaml;
+    };
@@ -20,6 +20,11 @@ function getSegmentRegex(patternPart: string): RegExp {
 // resolves `.` / `..` segments, so a request like `/public%2F..%2Fadmin/`
 // or `/public/../admin/` is matched as `/admin/`, not as a literal segment
 // or a wildcard-swallowed sequence under `/public/*`.
+//
+// Applied to both the request path and the rule pattern: the pattern
+// validator only accepts spaces / non-ASCII in percent-encoded form, so a
+// rule like `/my%20docs/*` must be compared against the decoded segment
+// `my docs`, not the literal text `my%20docs`.
 function decodeAndResolvePath(p: string): string[] {
    const rawParts = p.split("/").filter(Boolean);

@@ -48,7 +53,7 @@ function decodeAndResolvePath(p: string): string[] {
 }

 export function isPathAllowed(pattern: string, path: string): boolean {
-    const patternParts = pattern.split("/").filter(Boolean);
+    const patternParts = decodeAndResolvePath(pattern);
    const pathParts = decodeAndResolvePath(path);

    function matchSegments(
@@ -3,7 +3,7 @@ import * as yaml from "js-yaml";
 import { configFilePath1, configFilePath2 } from "./consts";
 import { z } from "zod";
 import stoi from "./stoi";
-import { getEnvOrYaml } from "./getEnvOrYaml";
+import { getEnvOrYaml, readEnvOrFile } from "./getEnvOrYaml";

 const portSchema = z.number().positive().gt(0).lte(65535);

@@ -26,14 +26,12 @@ export const configSchema = z
                    .object({
                        anonymous_usage: z.boolean().optional().default(true)
                    })
-                    .optional()
                    .prefault({}),
                notifications: z
                    .object({
                        product_updates: z.boolean().optional().default(true),
                        new_releases: z.boolean().optional().default(true)
                    })
-                    .optional()
                    .prefault({})
            })
            .optional()
@@ -109,7 +107,6 @@ export const configSchema = z
                        id: z.string().optional().default("P-Access-Token-Id"),
                        token: z.string().optional().default("P-Access-Token")
                    })
-                    .optional()
                    .prefault({}),
                remote_headers: z
                    .object({
@@ -126,7 +123,6 @@ export const configSchema = z
                        name: z.string().optional().default("Remote-Name"),
                        role: z.string().optional().default("Remote-Role")
                    })
-                    .optional()
                    .prefault({}),
                resource_session_request_param: z
                    .string()
@@ -164,14 +160,17 @@ export const configSchema = z
                    .boolean()
                    .optional()
                    .default(false)
-                    .transform((val) =>
-                        process.env.ENABLE_AI_GATEWAY_CLIENT_IP_HEADER !==
-                        undefined
-                            ? process.env.ENABLE_AI_GATEWAY_CLIENT_IP_HEADER ===
-                              "true"
-                            : val
-                    ),
-                secret: z.string().pipe(z.string().min(8)).optional(),
+                    .transform((val) => {
+                        const envVal = readEnvOrFile(
+                            "ENABLE_AI_GATEWAY_CLIENT_IP_HEADER"
+                        );
+                        return envVal !== undefined ? envVal === "true" : val;
+                    }),
+                secret: z
+                    .string()
+                    .pipe(z.string().min(8))
+                    .optional()
+                    .transform(getEnvOrYaml("SERVER_SECRET")),
                maxmind_db_path: z.string().optional(),
                maxmind_asn_path: z.string().optional()
            })
@@ -202,7 +201,8 @@ export const configSchema = z
                dashboard_session_length_hours: 720,
                resource_session_length_hours: 720,
                trust_proxy: 1,
-                enable_ai_gateway_client_ip_header: false
+                enable_ai_gateway_client_ip_header: false,
+                secret: undefined
            }),
        postgres: z
            .object({
@@ -238,7 +238,6 @@ export const configSchema = z
                            .default(5000),
                        jit_mode: z.boolean().default(true)
                    })
-                    .optional()
                    .prefault({})
            })
            .optional(),
@@ -278,7 +277,6 @@ export const configSchema = z
                            .optional()
                            .default(5000)
                    })
-                    .optional()
                    .prefault({})
            })
            .optional(),
@@ -325,10 +323,8 @@ export const configSchema = z
                            .optional()
                            .default(50)
                    })
-                    .optional()
                    .prefault({})
            })
-            .optional()
            .prefault({}),
        gerbil: z
            .object({
@@ -357,7 +353,6 @@ export const configSchema = z
                    .optional()
                    .default(30)
            })
-            .optional()
            .prefault({}),
        orgs: z
            .object({
@@ -391,7 +386,6 @@ export const configSchema = z
                            .optional()
                            .default(500)
                    })
-                    .optional()
                    .prefault({}),
                auth: z
                    .object({
@@ -408,10 +402,8 @@ export const configSchema = z
                            .optional()
                            .default(500)
                    })
-                    .optional()
                    .prefault({})
            })
-            .optional()
            .prefault({}),
        email: z
            .object({
@@ -489,10 +481,8 @@ export const configSchema = z
                            .optional()
                            .default(12)
                    })
-                    .optional()
                    .prefault({})
            })
-            .optional()
            .prefault({})
    })
    .refine(
@@ -513,10 +503,7 @@ export const configSchema = z
    )
    .refine(
        (data) => {
-            // If hybrid is not defined, server secret must be defined. If its not defined already then pull it from env
-            if (data.server?.secret === undefined) {
-                data.server.secret = process.env.SERVER_SECRET;
-            }
+            // If hybrid is not defined, server secret must be defined
            return (
                data.server?.secret !== undefined &&
                data.server.secret.length > 0
@@ -14,6 +14,7 @@ import { getTraefikConfig } from "#dynamic/lib/traefik";
 import { getValidCertificatesForDomains } from "@server/lib/certificates";
 import { sendToExitNode } from "#dynamic/lib/exitNodes";
 import { build } from "@server/build";
+import license from "#dynamic/license/license";

 export class TraefikConfigManager {
    private intervalId: NodeJS.Timeout | null = null;
@@ -357,7 +358,11 @@ export class TraefikConfigManager {
                this.lastActiveDomains = new Set(domains);
            }

-            if (process.env.CERT_MODE === "pangolin" && build != "oss") {
+            if (
+                process.env.CERT_MODE === "pangolin" &&
+                build != "oss" &&
+                (await license.hasTier(["personal", "tier2", "enterprise"]))
+            ) {
                // Scan current local certificate state
                this.lastLocalCertificateState =
                    await this.scanLocalCertificateState();
@@ -717,10 +722,9 @@ export class TraefikConfigManager {
        }
        if (shouldWrite) {
            try {
-                fs.writeFileSync(
+                this.atomicWriteFileSync(
                    traefikDynamicConfigPath,
-                    yaml.dump(traefikConfig, { noRefs: true }),
-                    "utf8"
+                    yaml.dump(traefikConfig, { noRefs: true })
                );
                logger.info("Traefik dynamic config updated");
            } catch (err) {
@@ -822,7 +826,7 @@ export class TraefikConfigManager {
        // Only write the config if it has changed
        const newConfigYaml = yaml.dump(dynamicConfig, { noRefs: true });
        if (newConfigYaml !== originalConfigYaml) {
-            fs.writeFileSync(dynamicConfigPath, newConfigYaml, "utf8");
+            this.atomicWriteFileSync(dynamicConfigPath, newConfigYaml);
            logger.info("Dynamic cert config updated from local certificates");
        }
    }
@@ -900,26 +904,23 @@ export class TraefikConfigManager {
                        `Processing certificate for domain: ${cert.domain}`
                    );

-                    fs.writeFileSync(certPath, cert.certFile, "utf8");
-                    fs.writeFileSync(keyPath, cert.keyFile, "utf8");
-
-                    // Set appropriate permissions (readable by owner only for key file)
-                    fs.chmodSync(certPath, 0o644);
-                    fs.chmodSync(keyPath, 0o600);
+                    // Write atomically (temp file + rename) so Traefik's
+                    // file watcher never observes a partially written
+                    // cert/key and fails with "failed to find any PEM data".
+                    this.atomicWriteFileSync(certPath, cert.certFile, 0o644);
+                    this.atomicWriteFileSync(keyPath, cert.keyFile, 0o600);

                    // Write/update .last_update file with current timestamp
-                    fs.writeFileSync(
+                    this.atomicWriteFileSync(
                        lastUpdatePath,
-                        new Date().toISOString(),
-                        "utf8"
+                        new Date().toISOString()
                    );

                    // Check if this is a wildcard certificate and store it
                    const wildcardPath = path.join(domainDir, ".wildcard");
-                    fs.writeFileSync(
+                    this.atomicWriteFileSync(
                        wildcardPath,
-                        cert.wildcard ? "true" : "false",
-                        "utf8"
+                        cert.wildcard ? "true" : "false"
                    );

                    logger.info(
@@ -931,10 +932,9 @@ export class TraefikConfigManager {
                // even if the cert content didn't change
                if (cert.expiresAt) {
                    const expiresAtPath = path.join(domainDir, ".expires_at");
-                    fs.writeFileSync(
+                    this.atomicWriteFileSync(
                        expiresAtPath,
-                        cert.expiresAt.toString(),
-                        "utf8"
+                        cert.expiresAt.toString()
                    );
                }

@@ -970,7 +970,7 @@ export class TraefikConfigManager {
        // Only write the config if it has changed
        const newConfigYaml = yaml.dump(dynamicConfig, { noRefs: true });
        if (newConfigYaml !== originalConfigYaml) {
-            fs.writeFileSync(dynamicConfigPath, newConfigYaml, "utf8");
+            this.atomicWriteFileSync(dynamicConfigPath, newConfigYaml);
            logger.info("Dynamic cert config updated");
        }
    }
@@ -1141,10 +1141,9 @@ export class TraefikConfigManager {

            if (configChanged) {
                try {
-                    fs.writeFileSync(
+                    this.atomicWriteFileSync(
                        dynamicConfigPath,
-                        yaml.dump(dynamicConfig, { noRefs: true }),
-                        "utf8"
+                        yaml.dump(dynamicConfig, { noRefs: true })
                    );
                    logger.info("Dynamic config updated after cleanup");
                } catch (err) {
@@ -1171,6 +1170,36 @@ export class TraefikConfigManager {
        }
    }

+    /**
+     * Write a file atomically by writing to a temp file in the same
+     * directory and renaming it into place. This avoids Traefik (which
+     * watches these files/directories) picking up a partially written
+     * file and failing to parse it (e.g. "failed to find any PEM data").
+     */
+    private atomicWriteFileSync(
+        filePath: string,
+        data: string,
+        mode?: number
+    ): void {
+        const dir = path.dirname(filePath);
+        const tmpPath = path.join(
+            dir,
+            `.${path.basename(filePath)}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`
+        );
+        try {
+            fs.writeFileSync(tmpPath, data, "utf8");
+            if (mode !== undefined) {
+                fs.chmodSync(tmpPath, mode);
+            }
+            fs.renameSync(tmpPath, filePath);
+        } catch (error) {
+            try {
+                fs.rmSync(tmpPath, { force: true });
+            } catch {}
+            throw error;
+        }
+    }
+
    /**
     * Check if file exists
     */
@@ -4,7 +4,7 @@ import { setHostMeta } from "@server/lib/hostMeta";
 const keyTypes = ["host"] as const;
 export type LicenseKeyType = (typeof keyTypes)[number];

-const keyTiers = ["personal", "enterprise"] as const;
+const keyTiers = ["personal", "enterprise", "tier1", "tier2"] as const;
 export type LicenseKeyTier = (typeof keyTiers)[number];

 export type LicenseStatus = {
@@ -33,7 +33,7 @@ export type LicenseKeyCache = {
 export class License {
    private serverSecret!: string;

-    constructor(private hostMeta: HostMeta) { }
+    constructor(private hostMeta: HostMeta) {}

    public async check(): Promise<LicenseStatus> {
        return {
@@ -50,6 +50,10 @@ export class License {
    public async isUnlocked() {
        return false;
    }
+
+    public async hasTier(tier: LicenseKeyTier[]) {
+        return false;
+    }
 }

 await setHostMeta();
@@ -70,13 +70,8 @@ export async function verifyApiKeyAccess(
            );
        }

-        if (!apiKeyOrg.orgId) {
-            return next(
-                createHttpError(
-                    HttpCode.INTERNAL_SERVER_ERROR,
-                    `API key with ID ${apiKeyId} does not have an organization ID`
-                )
-            );
+        if (!apiKey.apiKeyOrg?.orgId) {
+            return next(createHttpError(HttpCode.INTERNAL_SERVER_ERROR, `API key with ID ${apiKeyId} does not have an organization ID`));
        }

        if (!req.userOrg) {
@@ -86,7 +81,7 @@ export async function verifyApiKeyAccess(
                .where(
                    and(
                        eq(userOrgs.userId, userId),
-                        eq(userOrgs.orgId, apiKeyOrg.orgId)
+                        eq(userOrgs.orgId, apiKey.apiKeyOrg.orgId)
                    )
                )
                .limit(1);
@@ -45,9 +45,9 @@ export class JobScheduler {
        label: string
    ): () => Promise<void> {
        return async () => {
-            if (!(await license.isUnlocked())) {
+            if (!(await license.hasTier(["personal", "tier2", "enterprise"]))) {
                logger.debug(
-                    `Skipping ${label} tick - license is not subscribed`
+                    `Skipping ${label} tick - requires a tier2 license`
                );
                return;
            }
@@ -63,10 +63,11 @@ export class AuthoritativeDNSServer {
    private allDomains: Set<string> = new Set();
    private domainRefreshInterval: NodeJS.Timeout | null = null;

-    // Cached license/subscription status. license.isUnlocked() does a DB
-    // round-trip on every call, so it can't be checked per-query on a UDP
-    // server that may see very high query volume - instead it's polled on
-    // the same cadence as the domain set refresh and read from memory here.
+    // Cached license/plan status - only a tier2 license unlocks the DNS
+    // server. license.hasPlan() does a DB round-trip on every call, so it
+    // can't be checked per-query on a UDP server that may see very high
+    // query volume - instead it's polled on the same cadence as the domain
+    // set refresh and read from memory here.
    private isLicensed: boolean = false;
    private licenseRefreshInterval: NodeJS.Timeout | null = null;

@@ -128,7 +129,7 @@ export class AuthoritativeDNSServer {
        }

        if (!this.isLicensed) {
-            logger.debug("Refusing DNS query - license is not subscribed");
+            logger.debug("Refusing DNS query - requires a tier2 license");
            // REFUSED (rcode=5) indicates a policy refusal by this nameserver.
            this.sendResponse(packet, [], rinfo, false, 5, []);
            return;
@@ -1042,7 +1043,11 @@ export class AuthoritativeDNSServer {

    private async refreshLicenseStatus(): Promise<void> {
        try {
-            this.isLicensed = await license.isUnlocked();
+            this.isLicensed = await license.hasTier([
+                "personal",
+                "tier2",
+                "enterprise"
+            ]);
        } catch (error) {
            logger.error("Failed to refresh license status:", error);
            this.isLicensed = false;
@@ -48,7 +48,6 @@ export const privateConfigSchema = z
                    .optional()
                    .transform(getEnvOrYaml("FOSSORIAL_API_KEY"))
            })
-            .optional()
            .prefault({}),
        redis: z
            .object({
@@ -166,7 +165,6 @@ export const privateConfigSchema = z
                    .optional()
                    .default("http://gerbil:3004")
            })
-            .optional()
            .prefault({}),
        flags: z
            .object({
@@ -187,7 +185,6 @@ export const privateConfigSchema = z
                // (server/private/lib/config.ts).
                disable_private_http_placeholder: z.boolean().optional()
            })
-            .optional()
            .prefault({}),
        acme: z
            .object({
@@ -54,6 +54,7 @@ import {
    getValidCertificatesForDomains
 } from "@server/lib/certificates";
 import { build } from "@server/build";
+import license from "#private/license/license";
 import regionalCache from "#private/lib/cache";
 import { TargetWithSite } from "@server/lib/traefik/types";
 import { buildWildcardTls } from "@server/lib/traefik/certResolver";
@@ -395,8 +396,15 @@ export async function getTraefikConfig(
            )
        );

+    // Pangolin-managed DNS-01/ACME cert mode requires either a tier1
+    // license (self-hosted) or a saas build - otherwise fall back to
+    // Traefik's own cert resolvers (buildWildcardTls) throughout.
+    const pangolinCertModeEnabled =
+        privateConfig.getRawPrivateConfig().acme?.cert_mode == "pangolin" &&
+        (await license.hasTier(["personal", "tier2", "enterprise"]));
+
    let validCerts: CertificateResult[] = [];
-    if (privateConfig.getRawPrivateConfig().acme?.cert_mode == "pangolin") {
+    if (pangolinCertModeEnabled) {
        // create a list of all domains to get certs for
        const domains = new Set<string>();
        for (const resource of resourcesMap.values()) {
@@ -522,10 +530,7 @@ export async function getTraefikConfig(
            );

            let tls = {};
-            if (
-                privateConfig.getRawPrivateConfig().acme?.cert_mode !=
-                "pangolin"
-            ) {
+            if (!pangolinCertModeEnabled) {
                tls = buildWildcardTls({
                    fullDomain,
                    hasSubdomain: !!resource.subdomain,
@@ -546,6 +551,30 @@ export async function getTraefikConfig(
                }
            }

+            config_output.http.services![serviceName] = {
+                loadBalancer: {
+                    servers: buildHttpLoadBalancerServers(targets),
+                    ...(resource.stickySession
+                        ? buildStickySessionCookie(resource.ssl)
+                        : {})
+                }
+            };
+
+            if (resource.tlsServerName) {
+                if (!config_output.http.serversTransports) {
+                    config_output.http.serversTransports = {};
+                }
+                config_output.http.serversTransports![transportName] = {
+                    serverName: resource.tlsServerName,
+                    //unfortunately the following needs to be set. traefik doesn't merge the default serverTransport settings
+                    // if defined in the static config and here. if not set, self-signed certs won't work
+                    insecureSkipVerify: true
+                };
+                config_output.http.services![
+                    serviceName
+                ].loadBalancer.serversTransport = transportName;
+            }
+
            if (resource.ssl) {
                config_output.http.routers![routerName + "-redirect"] = {
                    entryPoints: [
@@ -710,31 +739,6 @@ export async function getTraefikConfig(
                priority: priority,
                ...(resource.ssl ? { tls } : {})
            };
-
-            config_output.http.services![serviceName] = {
-                loadBalancer: {
-                    servers: buildHttpLoadBalancerServers(targets),
-                    ...(resource.stickySession
-                        ? buildStickySessionCookie(resource.ssl)
-                        : {})
-                }
-            };
-
-            // Add the serversTransport if TLS server name is provided
-            if (resource.tlsServerName) {
-                if (!config_output.http.serversTransports) {
-                    config_output.http.serversTransports = {};
-                }
-                config_output.http.serversTransports![transportName] = {
-                    serverName: resource.tlsServerName,
-                    //unfortunately the following needs to be set. traefik doesn't merge the default serverTransport settings
-                    // if defined in the static config and here. if not set, self-signed certs won't work
-                    insecureSkipVerify: true
-                };
-                config_output.http.services![
-                    serviceName
-                ].loadBalancer.serversTransport = transportName;
-            }
        } else if (resource.mode == "tcp" || resource.mode == "udp") {
            // Non-HTTP (TCP/UDP) configuration
            if (!resource.enableProxy) {
@@ -791,10 +795,7 @@ export async function getTraefikConfig(
                domainCertResolver,
                preferWildcardCert
            }) => {
-                if (
-                    privateConfig.getRawPrivateConfig().acme?.cert_mode !=
-                    "pangolin"
-                ) {
+                if (!pangolinCertModeEnabled) {
                    return buildWildcardTls({
                        fullDomain,
                        hasSubdomain,
@@ -835,10 +836,7 @@ export async function getTraefikConfig(
            maintenancePageUiUrl,
            redirectHttpsMiddlewareName,
            resolveTls: (fullDomain) => {
-                if (
-                    privateConfig.getRawPrivateConfig().acme?.cert_mode !=
-                    "pangolin"
-                ) {
+                if (!pangolinCertModeEnabled) {
                    // siteResource aliases don't have a per-domain cert
                    // resolver stored, so always fall back to the global
                    // defaults.
@@ -929,10 +927,7 @@ export async function getTraefikConfig(
            const rule = buildHostRule(fullDomain, ir.wildcard);

            let tls: any = {};
-            if (
-                privateConfig.getRawPrivateConfig().acme?.cert_mode !=
-                "pangolin"
-            ) {
+            if (!pangolinCertModeEnabled) {
                tls = buildWildcardTls({
                    fullDomain,
                    hasSubdomain: !!ir.subdomain,
@@ -1012,10 +1007,7 @@ export async function getTraefikConfig(
                const rule = `Host(\`${fullDomain}\`) && ClientIP(\`${exitNode.address}\`)`; // restrict to coming from the exit node ip range that the client is connected to

                let tls: any = {};
-                if (
-                    privateConfig.getRawPrivateConfig().acme?.cert_mode !=
-                    "pangolin"
-                ) {
+                if (!pangolinCertModeEnabled) {
                    // siteResource aliases don't have a per-domain cert
                    // resolver stored, so always fall back to the global
                    // defaults.
@@ -1089,7 +1081,7 @@ export async function getTraefikConfig(
            .where(eq(exitNodes.exitNodeId, exitNodeId));

        let validCertsLoginPages: CertificateResult[] = [];
-        if (privateConfig.getRawPrivateConfig().acme?.cert_mode == "pangolin") {
+        if (pangolinCertModeEnabled) {
            // create a list of all domains to get certs for
            const domains = new Set<string>();
            for (const lp of exitNodeLoginPages) {
@@ -1134,10 +1126,7 @@ export async function getTraefikConfig(
                }

                const tls = {};
-                if (
-                    privateConfig.getRawPrivateConfig().acme?.cert_mode !=
-                    "pangolin"
-                ) {
+                if (!pangolinCertModeEnabled) {
                    // TODO: we need to add the wildcard logic here too
                } else {
                    // find a cert that matches the full domain, if not continue
@@ -26,6 +26,7 @@ import {
    LicenseStatus
 } from "@server/license/license";
 import { setHostMeta } from "@server/lib/hostMeta";
+import { build } from "@server/build";

 type ActivateLicenseKeyAPIResponse = {
    data: {
@@ -119,6 +120,9 @@ LQIDAQAB
    }

    public async isUnlocked(): Promise<boolean> {
+        if (build == "saas") {
+            return true;
+        }
        const status = await this.check();
        if (status.isHostLicensed) {
            if (status.isLicenseValid) {
@@ -128,6 +132,20 @@ LQIDAQAB
        return false;
    }

+    public async hasTier(tier: LicenseKeyTier[]): Promise<boolean> {
+        if (build == "saas") {
+            return true;
+        }
+        const status = await this.check();
+        if (status.isHostLicensed && status.isLicenseValid) {
+            return (
+                status.tier !== undefined &&
+                tier.includes(status.tier as LicenseKeyTier)
+            );
+        }
+        return false;
+    }
+
    public async check(): Promise<LicenseStatus> {
        // If a check is already in progress, return the last known status
        if (this.checkInProgress) {
@@ -135,8 +153,7 @@ LQIDAQAB
                "License check already in progress, returning last known status"
            );
            const lastStatus = this.statusCache.get(this.statusKey) as
-                | LicenseStatus
-                | undefined;
+                LicenseStatus | undefined;
            if (lastStatus) {
                return lastStatus;
            }
@@ -97,7 +97,7 @@ export async function exportConnectionAuditLogs(

        const baseQuery = queryConnection(data);

-        const log = await baseQuery.limit(data.limit).offset(data.offset);
+        const log = await baseQuery.limit(MAX_EXPORT_LIMIT);

        const csvData = generateCSV(log);

@@ -54,7 +54,6 @@ export const queryAccessAuditLogsQuery = z.object({
            error: "timeEnd must be a valid ISO date string"
        })
        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
-        .optional()
        .prefault(() => new Date().toISOString())
        .openapi({
            type: "string",
@@ -47,7 +47,6 @@ export const queryActionAuditLogsQuery = z.object({
            error: "timeEnd must be a valid ISO date string"
        })
        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
-        .optional()
        .prefault(() => new Date().toISOString())
        .openapi({
            type: "string",
@@ -55,7 +55,6 @@ export const queryConnectionAuditLogsQuery = z.object({
            error: "timeEnd must be a valid ISO date string"
        })
        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
-        .optional()
        .prefault(() => new Date().toISOString())
        .openapi({
            type: "string",
@@ -222,15 +222,16 @@ export async function handleSubscriptionCreated(

                let numUsers: number;
                let numSites: number;
+                let tier = "enterprise";

-                if (subscriptionPriceId === priceSet[LicenseId.SMALL_LICENSE]) {
+                if (subscriptionPriceId === priceSet[LicenseId.TIER1]) {
                    numUsers = 25;
                    numSites = 25;
-                } else if (
-                    subscriptionPriceId === priceSet[LicenseId.BIG_LICENSE]
-                ) {
+                    tier = "tier1";
+                } else if (subscriptionPriceId === priceSet[LicenseId.TIER2]) {
                    numUsers = 50;
                    numSites = 100;
+                    tier = "tier2";
                } else {
                    logger.error(
                        `Unknown price ID ${subscriptionPriceId} for subscription ${subscription.id}`
@@ -242,6 +243,14 @@ export async function handleSubscriptionCreated(
                    `License type determined: ${numUsers} users, ${numSites} sites for subscription ${subscription.id}`
                );

+                // Grace period of 5 days added on top of the current billing
+                // period end (usually ~1 year out) before the license expires
+                const currentPeriodEnd =
+                    fullSubscription.items.data[0]?.current_period_end;
+                const expiresAt =
+                    (currentPeriodEnd ?? subscription.created) +
+                    5 * 24 * 60 * 60;
+
                const response = await fetch(
                    `${privateConfig.getRawPrivateConfig().server.fossorial_api}/api/v1/license-internal/enterprise/paid-for`,
                    {
@@ -256,7 +265,9 @@ export async function handleSubscriptionCreated(
                            licenseId: parseInt(licenseId),
                            paidFor: true,
                            users: numUsers,
-                            sites: numSites
+                            sites: numSites,
+                            tier: tier,
+                            expiresAt: expiresAt
                        })
                    }
                );
@@ -265,6 +276,13 @@ export async function handleSubscriptionCreated(

                logger.debug(`Fossorial API response: ${JSON.stringify(data)}`);

+                if (!response.ok || !data.success) {
+                    logger.error(
+                        `Fossorial API returned ${response.status} when setting paid-for for orgId ${customer.orgId} and subscription ID ${subscription.id}: ${JSON.stringify(data)}`
+                    );
+                    return;
+                }
+
                if (customer.email) {
                    logger.debug(
                        `Sending license key email to ${customer.email} for subscription ${subscription.id}`
@@ -125,9 +125,7 @@ export async function handleSubscriptionDeleted(
                `Handling license subscription deletion for orgId ${customer.orgId} and subscription ID ${subscription.id}`
            );
            try {
-                // WARNING:
-                // this invalidates ALL OF THE ENTERPRISE LICENSES for this orgId
-                await fetch(
+                const invalidateResponse = await fetch(
                    `${privateConfig.getRawPrivateConfig().server.fossorial_api}/api/v1/license-internal/enterprise/invalidate`,
                    {
                        method: "POST",
@@ -139,9 +137,18 @@ export async function handleSubscriptionDeleted(
                        },
                        body: JSON.stringify({
                            orgId: customer.orgId,
+                            licenseKeyId: parseInt(
+                                subscription.metadata.licenseKeyId
+                            )
                        })
                    }
                );
+
+                if (!invalidateResponse.ok) {
+                    logger.error(
+                        `Fossorial API returned ${invalidateResponse.status} when invalidating license for orgId ${customer.orgId} and subscription ID ${subscription.id}: ${await invalidateResponse.text()}`
+                    );
+                }
            } catch (error) {
                logger.error(
                    `Error notifying Fossorial API of license subscription deletion for orgId ${customer.orgId} and subscription ID ${subscription.id}:`,
@@ -23,7 +23,10 @@ import {
 } from "@server/db";
 import { eq, and } from "drizzle-orm";
 import logger from "@server/logger";
-import { getFeatureIdByMetricId, getFeatureIdByPriceId } from "@server/lib/billing/features";
+import {
+    getFeatureIdByMetricId,
+    getFeatureIdByPriceId
+} from "@server/lib/billing/features";
 import stripe from "#private/lib/stripe";
 import { handleSubscriptionLifesycle } from "../subscriptionLifecycle";
 import { getSubType, SubscriptionType } from "./getSubType";
@@ -66,7 +69,8 @@ export async function handleSubscriptionUpdated(
            .limit(1);

        const type = getSubType(fullSubscription);
-        const previousType = existingSubscription.type as SubscriptionType | null;
+        const previousType =
+            existingSubscription.type as SubscriptionType | null;

        // If the subscription has been manually overridden, we lock the
        // status down so Stripe webhooks can no longer change it.
@@ -100,7 +104,11 @@ export async function handleSubscriptionUpdated(
            logger.info(
                `Tier change detected for org ${customer.orgId}: ${previousType} -> ${type}`
            );
-            await handleTierChange(customer.orgId, type, previousType ?? undefined);
+            await handleTierChange(
+                customer.orgId,
+                type,
+                previousType ?? undefined
+            );
        }

        // Upsert subscription items
@@ -113,7 +121,8 @@ export async function handleSubscriptionUpdated(

            const itemsToUpsert = fullSubscription.items.data.map((item) => {
                // Try to get featureId from price
-                let featureId: string | null = getFeatureIdByPriceId(item.price.id) || null;
+                let featureId: string | null =
+                    getFeatureIdByPriceId(item.price.id) || null;

                // If no match, try to preserve existing featureId
                if (!featureId) {
@@ -302,14 +311,20 @@ export async function handleSubscriptionUpdated(
                    logger.info(
                        `Subscription ${subscription.id} for org ${customer.orgId} is ${effectiveStatus}, disabling paid features`
                    );
-                    await handleTierChange(customer.orgId, null, previousType ?? undefined);
+                    await handleTierChange(
+                        customer.orgId,
+                        null,
+                        previousType ?? undefined
+                    );
                }
            } else if (type === "license") {
-                if (effectiveStatus === "canceled" || effectiveStatus == "unpaid" || effectiveStatus == "incomplete_expired") {
+                if (
+                    effectiveStatus === "canceled" ||
+                    effectiveStatus == "unpaid" ||
+                    effectiveStatus == "incomplete_expired"
+                ) {
                    try {
-                        // WARNING:
-                        // this invalidates ALL OF THE ENTERPRISE LICENSES for this orgId
-                        await fetch(
+                        const invalidateResponse = await fetch(
                            `${privateConfig.getRawPrivateConfig().server.fossorial_api}/api/v1/license-internal/enterprise/invalidate`,
                            {
                                method: "POST",
@@ -320,16 +335,95 @@ export async function handleSubscriptionUpdated(
                                    "Content-Type": "application/json"
                                },
                                body: JSON.stringify({
-                                    orgId: customer.orgId
+                                    orgId: customer.orgId,
+                                    licenseKeyId: parseInt(
+                                        subscription.metadata.licenseKeyId
+                                    )
                                })
                            }
                        );
+
+                        if (!invalidateResponse.ok) {
+                            logger.error(
+                                `Fossorial API returned ${invalidateResponse.status} when invalidating license for orgId ${customer.orgId} and subscription ID ${subscription.id}: ${await invalidateResponse.text()}`
+                            );
+                        }
                    } catch (error) {
                        logger.error(
                            `Error notifying Fossorial API of license subscription deletion for orgId ${customer.orgId} and subscription ID ${subscription.id}:`,
                            error
                        );
                    }
+                } else if (effectiveStatus === "active" && previousAttributes) {
+                    // Detect a successful renewal: the billing period rolled
+                    // forward (the invoice was paid and the new period began
+                    // right where the previous one ended).
+                    const currentItem = fullSubscription.items.data[0];
+                    const prevItems = previousAttributes.items?.data;
+                    const prevItem = Array.isArray(prevItems)
+                        ? prevItems.find(
+                              (pi: any) => pi.id === currentItem?.id
+                          )
+                        : undefined;
+
+                    const renewed =
+                        currentItem &&
+                        prevItem?.current_period_end &&
+                        currentItem.current_period_start ===
+                            prevItem.current_period_end &&
+                        currentItem.current_period_start >
+                            prevItem.current_period_start;
+
+                    if (renewed) {
+                        const licenseKeyId =
+                            subscription.metadata.licenseKeyId;
+
+                        if (!licenseKeyId) {
+                            logger.error(
+                                `No licenseKeyId in metadata for subscription ${subscription.id}, cannot extend license.`
+                            );
+                        } else {
+                            // Grace period of 5 days added on top of the new
+                            // billing period end (usually ~1 year out)
+                            const expiresAt =
+                                currentItem.current_period_end +
+                                5 * 24 * 60 * 60;
+
+                            try {
+                                const extendResponse = await fetch(
+                                    `${privateConfig.getRawPrivateConfig().server.fossorial_api}/api/v1/license-internal/enterprise/extend`,
+                                    {
+                                        method: "POST",
+                                        headers: {
+                                            "api-key":
+                                                privateConfig.getRawPrivateConfig()
+                                                    .server.fossorial_api_key!,
+                                            "Content-Type": "application/json"
+                                        },
+                                        body: JSON.stringify({
+                                            licenseId: parseInt(licenseKeyId),
+                                            expiresAt: expiresAt
+                                        })
+                                    }
+                                );
+
+                                if (!extendResponse.ok) {
+                                    logger.error(
+                                        `Fossorial API returned ${extendResponse.status} when extending license ${licenseKeyId} for subscription ${subscription.id}: ${await extendResponse.text()}`
+                                    );
+                                } else {
+                                    logger.info(
+                                        `Extended license ${licenseKeyId} for subscription ${subscription.id} to expire at ${expiresAt}.`
+                                    );
+                                }
+                            } catch (error) {
+                                logger.error(
+                                    `Error notifying Fossorial API of license renewal for subscription ${subscription.id}:`,
+                                    error
+                                );
+                            }
+                        }
+                    }
                }
            }
        }
@@ -64,14 +64,11 @@ export async function generateNewEnterpriseLicense(

        const licenseData = req.body;

-        if (
-            licenseData.tier != "big_license" &&
-            licenseData.tier != "small_license"
-        ) {
+        if (licenseData.tier != "tier2" && licenseData.tier != "tier1") {
            return next(
                createHttpError(
                    HttpCode.BAD_REQUEST,
-                    "Invalid tier specified. Must be either 'big_license' or 'small_license'."
+                    "Invalid tier specified. Must be either 'tier2' or 'tier1'."
                )
            );
        }
@@ -99,6 +96,8 @@ export async function generateNewEnterpriseLicense(
            );
        }

+        const licenseKeyValue = apiResponse?.data?.licenseKey?.licenseKey;
+
        // check if we already have a customer for this org
        const [customer] = await db
            .select()
@@ -118,9 +117,7 @@ export async function generateNewEnterpriseLicense(
        }

        const tier =
-            licenseData.tier === "big_license"
-                ? LicenseId.BIG_LICENSE
-                : LicenseId.SMALL_LICENSE;
+            licenseData.tier === "tier2" ? LicenseId.TIER2 : LicenseId.TIER1;
        const tierPrice = getLicensePriceSet()[tier];

        const session = await stripe!.checkout.sessions.create({
@@ -134,6 +131,16 @@ export async function generateNewEnterpriseLicense(
            ], // Start with the standard feature set that matches the free limits
            customer: customer.customerId,
            mode: "subscription",
+            subscription_data: {
+                description: licenseKeyValue
+                    ? `License ${licenseKeyValue}`
+                    : `License key ID ${keyId}`,
+                metadata: {
+                    licenseKeyId: keyId.toString(),
+                    licenseKey: licenseKeyValue ?? "",
+                    tier: licenseData.tier
+                }
+            },
            allow_promotion_codes: true,
            success_url: `${config.getRawConfig().app.dashboard_url}/${orgId}/settings/license?success=true&session_id={CHECKOUT_SESSION_ID}`,
            cancel_url: `${config.getRawConfig().app.dashboard_url}/${orgId}/settings/license?canceled=true`
@@ -47,7 +47,6 @@ export const queryAiSessionLogsQuery = z.strictObject({
            error: "timeEnd must be a valid ISO date string"
        })
        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
-        .optional()
        .prefault(() => new Date().toISOString())
        .openapi({
            type: "string",
@@ -20,7 +20,6 @@ const queryAccessAuditLogsQuery = z.object({
            error: "timeStart must be a valid ISO date string"
        })
        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
-        .optional()
        .prefault(() => getSevenDaysAgo().toISOString())
        .openapi({
            type: "string",
@@ -34,7 +33,6 @@ const queryAccessAuditLogsQuery = z.object({
            error: "timeEnd must be a valid ISO date string"
        })
        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
-        .optional()
        .prefault(() => new Date().toISOString())
        .openapi({
            type: "string",
@@ -41,7 +41,6 @@ export const queryAccessAuditLogsQuery = z.strictObject({
            error: "timeEnd must be a valid ISO date string"
        })
        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
-        .optional()
        .prefault(() => new Date().toISOString())
        .openapi({
            type: "string",
@@ -17,7 +17,7 @@ import {
 import type {
    GenerateRegistrationOptionsOpts,
    GenerateAuthenticationOptionsOpts,
-    AuthenticatorTransportFuture
+    AuthenticatorTransport
 } from "@simplewebauthn/server";
 import { isoBase64URL } from "@simplewebauthn/server/helpers";
 import config from "@server/lib/config";
@@ -221,7 +221,7 @@ export async function startRegistration(
        const excludeCredentials = existingSecurityKeys.map((key) => ({
            id: key.credentialId,
            transports: key.transports
-                ? (JSON.parse(key.transports) as AuthenticatorTransportFuture[])
+                ? (JSON.parse(key.transports) as AuthenticatorTransport[])
                : undefined
        }));

@@ -571,7 +571,7 @@ export async function startAuthentication(
                transports: key.transports
                    ? (JSON.parse(
                          key.transports
-                      ) as AuthenticatorTransportFuture[])
+                      ) as AuthenticatorTransport[])
                    : undefined
            }));
        }
@@ -702,7 +702,7 @@ export async function verifyAuthentication(
                transports: securityKey.transports
                    ? (JSON.parse(
                          securityKey.transports
-                      ) as AuthenticatorTransportFuture[])
+                      ) as AuthenticatorTransport[])
                    : undefined
            },
            requireUserVerification: false
@@ -386,6 +386,38 @@ function runSpecialCharacterTests() {
    console.log("All special character tests passed!");
 }

+function runEncodedPatternTests() {
+    console.log("\nRunning percent-encoded pattern tests...");
+
+    // isValidUrlGlobPattern accepts percent-encoded sequences and rejects
+    // raw spaces / non-ASCII, so `%20` and `%C3%A9` are the only way to write
+    // a PATH rule for such a path. Badger sends the request path already
+    // decoded (Go's req.URL.Path), and isPathAllowed decodes it again, so the
+    // rule pattern must be decoded the same way or it can never match.
+    assertEquals(
+        isPathAllowed("/my%20docs/*", "/my docs/report.pdf"),
+        true,
+        "Percent-encoded space in pattern should match decoded request path"
+    );
+    assertEquals(
+        isPathAllowed("/my%20docs/*", "/my%20docs/report.pdf"),
+        true,
+        "Percent-encoded space in pattern should match raw-encoded request path"
+    );
+    assertEquals(
+        isPathAllowed("/caf%C3%A9", "/café"),
+        true,
+        "Percent-encoded UTF-8 in pattern should match decoded request path"
+    );
+    assertEquals(
+        isPathAllowed("/my%20docs/*", "/my-docs/report.pdf"),
+        false,
+        "Decoded pattern must still reject a different path"
+    );
+
+    console.log("All percent-encoded pattern tests passed!");
+}
+
 function runRegionTests() {
    console.log("\nRunning isIpInRegion tests...");

@@ -446,6 +478,7 @@ function runRegionTests() {
 try {
    runTests();
    runSpecialCharacterTests();
+    runEncodedPatternTests();
    runRegionTests();
    console.log("\n✅ All tests passed!");
 } catch (error) {
@@ -31,7 +31,7 @@ export async function addPeer(
            .where(eq(newts.siteId, siteId))
            .limit(1);
        if (!newt) {
-            throw new Error(`Site found for site ${siteId}`);
+            throw new Error(`Newt not found for site ${siteId}`);
        }
        newtId = newt.newtId;
    }
@@ -500,7 +500,8 @@ async function updateHttpResource(
    }

    // catch when the resource policy changes or gets cleared
-    if (resource.resourcePolicyId != updateData.resourcePolicyId) {
+    if (updateData.resourcePolicyId !== undefined && 
+        resource.resourcePolicyId !== updateData.resourcePolicyId) {
        await clearResourceSpecificSettings(
            resource.resourceId,
            resource.orgId,
@@ -263,7 +263,7 @@ export async function createSite(
            const { value: newClientAddress, release } =
                await getNextAvailableClientSubnet(orgId);
            releaseSubnetLock = release;
-            updatedAddress = newClientAddress.split("/")[0];
+            updatedAddress = `${newClientAddress.split("/")[0]}/${org.subnet ? org.subnet.split("/")[1] : "32"}`;
        }

        let newSite: Site | undefined;
@@ -113,7 +113,7 @@ export async function updateSite(
                .where(
                    and(
                        eq(sites.niceId, updateData.niceId),
-                        eq(sites.orgId, sites.orgId),
+                        eq(sites.orgId, existingSite.orgId),
                        ne(sites.siteId, siteId)
                    )
                )
@@ -0,0 +1,58 @@
+import { assertEquals } from "@test/assert";
+import { getSiteResourceParamsSchema } from "./getSiteResource";
+
+function testSiteResourceIdOnlyParams() {
+    const result = getSiteResourceParamsSchema.safeParse({
+        siteResourceId: "42"
+    });
+
+    assertEquals(
+        result.success,
+        true,
+        "siteResourceId-only integration routes should pass validation"
+    );
+
+    if (result.success) {
+        assertEquals(
+            result.data.siteResourceId,
+            42,
+            "siteResourceId should be parsed as a number"
+        );
+        assertEquals(
+            result.data.orgId,
+            undefined,
+            "orgId should remain optional"
+        );
+    }
+}
+
+function testOrgScopedParamsRemainSupported() {
+    const result = getSiteResourceParamsSchema.safeParse({
+        siteResourceId: "42",
+        orgId: "org-id"
+    });
+
+    assertEquals(
+        result.success,
+        true,
+        "org-scoped routes should continue to pass validation"
+    );
+}
+
+function testInvalidSiteResourceId() {
+    const result = getSiteResourceParamsSchema.safeParse({
+        siteResourceId: "not-a-number"
+    });
+
+    assertEquals(
+        result.success,
+        false,
+        "non-numeric siteResourceIds should fail validation"
+    );
+}
+
+testSiteResourceIdOnlyParams();
+testOrgScopedParamsRemainSupported();
+testInvalidSiteResourceId();
+
+console.log("All getSiteResource parameter validation tests passed.");
@@ -10,7 +10,7 @@ import { fromError } from "zod-validation-error";
 import logger from "@server/logger";
 import { OpenAPITags, registry } from "@server/openApi";

-const getSiteResourceParamsSchema = z.strictObject({
+export const getSiteResourceParamsSchema = z.strictObject({
    siteResourceId: z
        .string()
        .optional()
@@ -22,15 +22,17 @@ const getSiteResourceParamsSchema = z.strictObject({
 });

 async function query(siteResourceId?: number, niceId?: string, orgId?: string) {
-    if (siteResourceId && orgId) {
+    if (siteResourceId) {
        const [siteResource] = await db
            .select()
            .from(siteResources)
            .where(
-                and(
-                    eq(siteResources.siteResourceId, siteResourceId),
-                    eq(siteResources.orgId, orgId)
-                )
+                orgId
+                    ? and(
+                          eq(siteResources.siteResourceId, siteResourceId),
+                          eq(siteResources.orgId, orgId)
+                      )
+                    : eq(siteResources.siteResourceId, siteResourceId)
            )
            .limit(1);
        return siteResource;
@@ -43,7 +43,7 @@ export const handleHealthcheckStatusMessage: MessageHandler = async (
    const { message, client: c } = context;
    const newt = c as Newt;

-    logger.info("Handling healthcheck status message");
+    logger.debug("Handling healthcheck status message");

    if (!newt) {
        logger.warn("Newt not found");
@@ -0,0 +1,342 @@
+import { execFileSync } from "child_process";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { fileURLToPath } from "url";
+import Database from "better-sqlite3";
+import { assertEquals } from "@test/assert";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(here, "..", "..");
+const migrationsScript = path.join(here, "migrationsSqlite.ts");
+
+const SEED_STATEMENTS = [
+    `CREATE TABLE versionMigrations (version TEXT PRIMARY KEY, executedAt INTEGER NOT NULL)`,
+    `INSERT INTO versionMigrations (version, executedAt) VALUES ('1.21.0', 1750000000000)`,
+    `CREATE TABLE sites (siteId INTEGER PRIMARY KEY AUTOINCREMENT, subnet TEXT)`,
+    `INSERT INTO sites (subnet) VALUES ('10.0.0.0/24')`,
+    `CREATE TABLE roles (roleId INTEGER PRIMARY KEY AUTOINCREMENT, orgId TEXT, isAdmin INTEGER DEFAULT 0, sshSudoMode TEXT DEFAULT 'none')`,
+    `INSERT INTO roles (orgId, isAdmin, sshSudoMode) VALUES ('org1', 0, 'none')`,
+    `CREATE TABLE licenseKey (licenseKeyId INTEGER PRIMARY KEY AUTOINCREMENT)`,
+    `CREATE TABLE targets (targetId INTEGER PRIMARY KEY AUTOINCREMENT, resourceId INTEGER, siteId INTEGER NOT NULL, ip TEXT NOT NULL, method TEXT, port INTEGER NOT NULL, internalPort INTEGER, enabled INTEGER DEFAULT 1, path TEXT, pathMatchType TEXT, rewritePath TEXT, rewritePathType TEXT, priority INTEGER DEFAULT 100, mode TEXT DEFAULT 'http', authToken TEXT)`,
+    `CREATE TABLE subscriptions (subscriptionId INTEGER PRIMARY KEY AUTOINCREMENT)`,
+    `CREATE TABLE clients (clientId INTEGER PRIMARY KEY AUTOINCREMENT)`,
+    `CREATE TABLE orgs (orgId TEXT PRIMARY KEY)`,
+    `INSERT INTO orgs (orgId) VALUES ('org1')`,
+    `CREATE TABLE siteResources (siteResourceId INTEGER PRIMARY KEY AUTOINCREMENT)`,
+    `CREATE TABLE eventStreamingDestinations (destinationId INTEGER PRIMARY KEY AUTOINCREMENT)`,
+    `CREATE TABLE roleActions (roleId INTEGER, actionId TEXT, orgId TEXT)`,
+    `CREATE TABLE newt (newtId INTEGER PRIMARY KEY AUTOINCREMENT)`
+];
+
+function seedDatabase(dbPath: string) {
+    const db = new Database(dbPath);
+    try {
+        for (const statement of SEED_STATEMENTS) {
+            db.exec(statement);
+        }
+    } finally {
+        db.close();
+    }
+}
+
+function tableColumns(dbPath: string, tableName: string): string[] {
+    const db = new Database(dbPath, { readonly: true });
+    try {
+        return (
+            db.prepare(`PRAGMA table_info(${tableName})`).all() as Array<{
+                name: unknown;
+            }>
+        ).map((row) => String(row.name));
+    } finally {
+        db.close();
+    }
+}
+
+function executedMigrationVersions(dbPath: string): string[] {
+    const db = new Database(dbPath, { readonly: true });
+    try {
+        return (
+            db.prepare(`SELECT version FROM versionMigrations`).all() as Array<{
+                version: unknown;
+            }>
+        ).map((row) => String(row.version));
+    } finally {
+        db.close();
+    }
+}
+
+function runMigrations(
+    workdir: string,
+    env: Record<string, string> = {}
+): {
+    exitCode: number;
+    output: string;
+} {
+    const tsconfig = ["tsconfig.json", "tsconfig.oss.json"]
+        .map((file) => path.join(repoRoot, file))
+        .find((file) => fs.existsSync(file));
+    if (!tsconfig) {
+        throw new Error("No tsconfig found for @server path aliases");
+    }
+    const tsxCli = path.join(
+        repoRoot,
+        "node_modules",
+        "tsx",
+        "dist",
+        "cli.mjs"
+    );
+    if (!fs.existsSync(tsxCli)) {
+        throw new Error("tsx is not installed; run npm ci first");
+    }
+    try {
+        const output = execFileSync(
+            process.execPath,
+            [tsxCli, "--tsconfig", tsconfig, migrationsScript],
+            {
+                cwd: workdir,
+                timeout: 120000,
+                encoding: "utf8",
+                env: { ...process.env, NODE_ENV: "test", ...env }
+            }
+        );
+        return { exitCode: 0, output };
+    } catch (error) {
+        const output =
+            error instanceof Error
+                ? (error as Error & { stdout?: unknown }).stdout
+                : "";
+        return { exitCode: 1, output: String(output ?? "") };
+    }
+}
+
+function createTestEnvironment(): string {
+    for (const generated of ["server/build.ts", "server/db/index.ts"]) {
+        if (!fs.existsSync(path.join(repoRoot, generated))) {
+            throw new Error(
+                `Missing ${generated}; run npm run set:oss && npm run set:sqlite first`
+            );
+        }
+    }
+    const workdir = fs.mkdtempSync(
+        path.join(os.tmpdir(), "pangolin-backup-test-")
+    );
+    fs.mkdirSync(path.join(workdir, "config", "db"), { recursive: true });
+    fs.copyFileSync(
+        path.join(repoRoot, "config", "config.example.yml"),
+        path.join(workdir, "config", "config.yml")
+    );
+    const traefikSrc = path.join(repoRoot, "config", "traefik");
+    if (fs.existsSync(traefikSrc)) {
+        fs.cpSync(traefikSrc, path.join(workdir, "config", "traefik"), {
+            recursive: true
+        });
+    }
+    fs.symlinkSync(
+        path.join(repoRoot, "server"),
+        path.join(workdir, "server"),
+        process.platform === "win32" ? "junction" : "dir"
+    );
+    return workdir;
+}
+
+function testMultipleSequentialMigrations() {
+    console.log("Running multiple sequential migrations test...");
+    const workdir = createTestEnvironment();
+    try {
+        seedDatabase(path.join(workdir, "config", "db", "db.sqlite"));
+        const result = runMigrations(workdir);
+        assertEquals(result.exitCode, 0, "Seeded migrations must run cleanly");
+        if (!result.output.includes("All migrations completed successfully")) {
+            throw new Error(
+                "Seeded migrations did not complete; the backup assertions below would be vacuous"
+            );
+        }
+
+        const backupsDir = path.join(workdir, "config", "db", "backups");
+        const backups = fs.existsSync(backupsDir)
+            ? fs
+                  .readdirSync(backupsDir)
+                  .filter((file) => file.endsWith(".sqlite"))
+            : [];
+
+        // Upgrading from 1.21.0 runs 1.22.0 and 1.23.0 -> produces 2 distinct backups
+        assertEquals(
+            backups.length,
+            2,
+            "Each migration must have its own distinct backup snapshot"
+        );
+
+        const v122Backup = backups.find((file) =>
+            file.includes("_v1.22.0.sqlite")
+        );
+        const v123Backup = backups.find((file) =>
+            file.includes("_v1.23.0.sqlite")
+        );
+
+        if (!v122Backup || !v123Backup) {
+            throw new Error(
+                `Expected backups for v1.22.0 and v1.23.0, found: ${backups.join(", ")}`
+            );
+        }
+
+        // Verify pre-1.22.0 snapshot state: sites has 'subnet' (not exitNodeSubnet), versions = [1.21.0]
+        const v122Columns = tableColumns(
+            path.join(backupsDir, v122Backup),
+            "sites"
+        );
+        assertEquals(
+            v122Columns.includes("subnet") &&
+                !v122Columns.includes("exitNodeSubnet"),
+            true,
+            "Backup before 1.22.0 must retain pre-1.22.0 schema (sites.subnet)"
+        );
+        const v122Versions = executedMigrationVersions(
+            path.join(backupsDir, v122Backup)
+        );
+        assertEquals(
+            v122Versions.includes("1.21.0") && !v122Versions.includes("1.22.0"),
+            true,
+            "Backup before 1.22.0 must only record version 1.21.0"
+        );
+
+        // Verify pre-1.23.0 snapshot state: sites has 'exitNodeSubnet' (1.22.0 applied), newt has no agent
+        const v123Columns = tableColumns(
+            path.join(backupsDir, v123Backup),
+            "sites"
+        );
+        assertEquals(
+            v123Columns.includes("exitNodeSubnet"),
+            true,
+            "Backup before 1.23.0 must contain successfully applied 1.22.0 schema (sites.exitNodeSubnet)"
+        );
+        const v123NewtCols = tableColumns(
+            path.join(backupsDir, v123Backup),
+            "newt"
+        );
+        assertEquals(
+            !v123NewtCols.includes("agent"),
+            true,
+            "Backup before 1.23.0 must not contain 1.23.0 schema changes yet"
+        );
+        const v123Versions = executedMigrationVersions(
+            path.join(backupsDir, v123Backup)
+        );
+        assertEquals(
+            v123Versions.includes("1.21.0") && v123Versions.includes("1.22.0"),
+            true,
+            "Backup before 1.23.0 must record both 1.21.0 and 1.22.0"
+        );
+    } finally {
+        fs.rmSync(workdir, { recursive: true, force: true });
+    }
+}
+
+function testFailureInLaterMigrationPreservesRestorePoints() {
+    console.log("Running failure in later migration test...");
+    const workdir = createTestEnvironment();
+    try {
+        const dbPath = path.join(workdir, "config", "db", "db.sqlite");
+        seedDatabase(dbPath);
+
+        // Intentionally drop table 'newt' so migration 1.23.0 fails on ALTER TABLE newt ADD COLUMN agent
+        const db = new Database(dbPath);
+        db.exec("DROP TABLE newt;");
+        db.close();
+
+        const result = runMigrations(workdir);
+        assertEquals(
+            result.exitCode,
+            1,
+            "Migration suite must fail when 1.23.0 errors"
+        );
+
+        const backupsDir = path.join(workdir, "config", "db", "backups");
+        const backups = fs.existsSync(backupsDir)
+            ? fs
+                  .readdirSync(backupsDir)
+                  .filter((file) => file.endsWith(".sqlite"))
+            : [];
+
+        // Both pre-1.22.0 and pre-1.23.0 backups must exist
+        assertEquals(
+            backups.length,
+            2,
+            "Backups for earlier successful migration and the failed migration must both exist"
+        );
+
+        const v122Backup = backups.find((file) =>
+            file.includes("_v1.22.0.sqlite")
+        );
+        const v123Backup = backups.find((file) =>
+            file.includes("_v1.23.0.sqlite")
+        );
+
+        if (!v122Backup || !v123Backup) {
+            throw new Error(
+                `Expected restore points for v1.22.0 and v1.23.0, found: ${backups.join(", ")}`
+            );
+        }
+
+        // Verify pre-1.23.0 backup is a valid restore point with 1.22.0 changes applied
+        const v123SitesCols = tableColumns(
+            path.join(backupsDir, v123Backup),
+            "sites"
+        );
+        assertEquals(
+            v123SitesCols.includes("exitNodeSubnet"),
+            true,
+            "Pre-failure restore point must have 1.22.0 changes intact"
+        );
+        const v123Versions = executedMigrationVersions(
+            path.join(backupsDir, v123Backup)
+        );
+        assertEquals(
+            v123Versions.includes("1.22.0"),
+            true,
+            "Pre-failure restore point must record successful 1.22.0 migration"
+        );
+    } finally {
+        fs.rmSync(workdir, { recursive: true, force: true });
+    }
+}
+
+function testDisableBackupOnMigration() {
+    console.log("Running DISABLE_BACKUP_ON_MIGRATION test...");
+    const workdir = createTestEnvironment();
+    try {
+        seedDatabase(path.join(workdir, "config", "db", "db.sqlite"));
+        const result = runMigrations(workdir, {
+            DISABLE_BACKUP_ON_MIGRATION: "1"
+        });
+        assertEquals(
+            result.exitCode,
+            0,
+            "Migrations must succeed with backups disabled"
+        );
+
+        const backupsDir = path.join(workdir, "config", "db", "backups");
+        const backups = fs.existsSync(backupsDir)
+            ? fs
+                  .readdirSync(backupsDir)
+                  .filter((file) => file.endsWith(".sqlite"))
+            : [];
+        assertEquals(
+            backups.length,
+            0,
+            "No backup files should be created when DISABLE_BACKUP_ON_MIGRATION is set"
+        );
+    } finally {
+        fs.rmSync(workdir, { recursive: true, force: true });
+    }
+}
+
+try {
+    testMultipleSequentialMigrations();
+    testFailureInLaterMigrationPreservesRestorePoints();
+    testDisableBackupOnMigration();
+    console.log("All backup migration regression tests passed successfully!");
+} catch (error) {
+    console.error("Test failed:", error);
+    process.exit(1);
+}
@@ -5,6 +5,7 @@ import path from "path";
 import semver from "semver";
 import { versionMigrations } from "../db/sqlite";
 import { __DIRNAME, APP_PATH, APP_VERSION } from "@server/lib/consts";
+import { formatBackupFileName } from "@server/lib/backupFileName";
 import { SqliteError } from "better-sqlite3";
 import fs from "fs";
 import { build } from "@server/build";
@@ -106,7 +107,7 @@ async function run() {
    await runMigrations();
 }

-function backupDb() {
+function backupDb(version?: string) {
    // make dir config/db/backups
    const appPath = APP_PATH;
    const dbDir = path.join(appPath, "db");
@@ -119,11 +120,10 @@ function backupDb() {
    }

    // copy the db.sqlite file to backups
-    // add the date to the filename
-    const date = new Date();
-    const dateString = `${date.getFullYear()}-${date.getMonth()}-${date.getDate()}_${date.getHours()}-${date.getMinutes()}-${date.getSeconds()}`;
+    // add the date and migration version to the filename
+    const fileName = formatBackupFileName(version);
    const dbPath = path.join(dbDir, "db.sqlite");
-    const backupPath = path.join(backupsDir, `db_${dateString}.sqlite`);
+    const backupPath = path.join(backupsDir, fileName);
    fs.copyFileSync(dbPath, backupPath);
 }

@@ -162,6 +162,12 @@ export async function runMigrations() {
        }
    } catch (e) {
        console.error("Error running migrations:", e);
+        if (
+            process.env.NODE_ENV === "test" ||
+            process.env.ENVIRONMENT === "test"
+        ) {
+            throw e;
+        }
        await new Promise((resolve) =>
            setTimeout(resolve, 1000 * 60 * 60 * 24 * 1)
        );
@@ -196,7 +202,7 @@ async function executeScripts() {
            try {
                if (!process.env.DISABLE_BACKUP_ON_MIGRATION) {
                    // Backup the database before running the migration
-                    backupDb();
+                    backupDb(migration.version);
                }

                await migration.run();
@@ -3,8 +3,6 @@ import { sql } from "drizzle-orm";

 const version = "1.23.0";

-await migration();
-
 export default async function migration() {
    console.log(`Running setup script ${version}...`);

@@ -12,11 +10,11 @@ export default async function migration() {
        await db.execute(sql`BEGIN`);

        await db.execute(sql`
-            ALTER TABLE "newt" ADD COLUMN "agent" varchar;
+            ALTER TABLE "newt" ADD COLUMN IF NOT EXISTS "agent" varchar;
        `);

        await db.execute(sql`
-            ALTER TABLE "newt" ADD COLUMN "agentVersion" varchar;
+            ALTER TABLE "newt" ADD COLUMN IF NOT EXISTS "agentVersion" varchar;
        `);

        await db.execute(sql`COMMIT`);
@@ -20,25 +20,6 @@ import { fromZodError } from "zod-validation-error";
 export default async function migration() {
    console.log("Running setup script 1.0.0-beta.9...");

-    // make dir config/db/backups
-    const appPath = APP_PATH;
-    const dbDir = path.join(appPath, "db");
-
-    const backupsDir = path.join(dbDir, "backups");
-
-    // check if the backups directory exists and create it if it doesn't
-    if (!fs.existsSync(backupsDir)) {
-        fs.mkdirSync(backupsDir, { recursive: true });
-    }
-
-    // copy the db.sqlite file to backups
-    // add the date to the filename
-    const date = new Date();
-    const dateString = `${date.getFullYear()}-${date.getMonth()}-${date.getDate()}_${date.getHours()}-${date.getMinutes()}-${date.getSeconds()}`;
-    const dbPath = path.join(dbDir, "db.sqlite");
-    const backupPath = path.join(backupsDir, `db_${dateString}.sqlite`);
-    fs.copyFileSync(dbPath, backupPath);
-
    await db.transaction(async (trx) => {
        try {
            // Determine which config file exists
@@ -16,13 +16,13 @@ export default async function migration() {
        db.transaction(() => {
            db.prepare(
                `
-            ALTER TABLE 'newt' ADD 'agent' text;
+            ALTER TABLE 'newt' ADD COLUMN 'agent' text;
                `
            ).run();

            db.prepare(
                `
-            ALTER TABLE 'newt' ADD 'agentVersion' text;
+            ALTER TABLE 'newt' ADD COLUMN 'agentVersion' text;
                `
            ).run();
        })();
@@ -749,12 +749,6 @@ export default function BillingPage() {
        return 0;
    };

-    // Get license key count
-    const getLicenseKeyCount = (): number => {
-        if (!licenseSubscription?.items) return 0;
-        return licenseSubscription.items.length;
-    };
-
    // Check if downgrading to a tier would violate current usage limits
    const checkLimitViolations = (
        targetTier: Tier | "basic"
@@ -1545,7 +1539,7 @@ export default function BillingPage() {
            </SettingsSection>

            {/* Paid License Keys Section */}
-            {(licenseSubscription || getLicenseKeyCount() > 0) && (
+            {licenseSubscription && (
                <SettingsSection>
                    <SettingsSectionHeader>
                        <SettingsSectionTitle>
@@ -1561,22 +1555,6 @@ export default function BillingPage() {
                            <SettingsFormGrid>
                                <SettingsFormCell span="full">
                                    <div className="flex flex-col md:flex-row items-start md:items-center justify-between gap-4 border rounded-lg p-4">
-                                        <div>
-                                            <div className="text-sm text-muted-foreground mb-1">
-                                                {t("billingCurrentKeys") ||
-                                                    "Current Keys"}
-                                            </div>
-                                            <div className="flex items-baseline gap-2">
-                                                <span className="text-3xl font-semibold">
-                                                    {getLicenseKeyCount()}
-                                                </span>
-                                                <span className="text-lg">
-                                                    {getLicenseKeyCount() === 1
-                                                        ? "key"
-                                                        : "keys"}
-                                                </span>
-                                            </div>
-                                        </div>
                                        <Button
                                            variant="outline"
                                            onClick={handleModifySubscription}
@@ -1,4 +1,5 @@
 import GenerateLicenseKeysTable from "@app/components/GenerateLicenseKeysTable";
+import LicenseBillingBanner from "@app/components/LicenseBillingBanner";
 import { internal } from "@app/lib/api";
 import { authCookieHeader } from "@app/lib/api/cookies";
 import { ListGeneratedLicenseKeysResponse } from "@server/routers/generatedLicense/types";
@@ -26,5 +27,16 @@ export default async function Page({ params }: Props) {
        licenseKeys = data.data.data;
    } catch {}

-    return <GenerateLicenseKeysTable licenseKeys={licenseKeys} orgId={orgId} />;
+    const hasNonPersonalLicenseKey = licenseKeys.some(
+        (key) => key.tier !== "personal"
+    );
+
+    return (
+        <>
+            {hasNonPersonalLicenseKey && (
+                <LicenseBillingBanner orgId={orgId} />
+            )}
+            <GenerateLicenseKeysTable licenseKeys={licenseKeys} orgId={orgId} />
+        </>
+    );
 }
@@ -76,11 +76,13 @@ export default function PrivateResourceInferencePage() {
                    })
                ),
                httpConfigSubdomain: z.string().nullish(),
-                httpConfigDomainId: z.string().nullish(),
+                httpConfigDomainId: z
+                    .string()
+                    .min(1, { message: t("domainRequired") }),
                httpConfigFullDomain: z.string().nullish(),
                ssl: z.boolean().optional()
            }),
-        []
+        [t]
    );
    type FormValues = z.infer<typeof formSchema>;

@@ -103,7 +105,7 @@ export default function PrivateResourceInferencePage() {
        defaultValues: {
            providers: [],
            httpConfigSubdomain: siteResource.subdomain ?? null,
-            httpConfigDomainId: siteResource.domainId ?? null,
+            httpConfigDomainId: siteResource.domainId ?? "",
            httpConfigFullDomain: siteResource.fullDomain ?? null,
            ssl: siteResource.ssl ?? false
        }
@@ -289,50 +291,74 @@ export default function PrivateResourceInferencePage() {
                                        </SettingsSubsectionHeader>
                                    </SettingsFormCell>
                                    <SettingsFormCell span="full">
-                                        <DomainPicker
-                                            key={`inference-domain-${siteResource.id}`}
-                                            orgId={siteResource.orgId}
-                                            cols={2}
-                                            hideFreeDomain
-                                            defaultSubdomain={
-                                                httpConfigSubdomain ?? undefined
-                                            }
-                                            defaultDomainId={
-                                                httpConfigDomainId ?? undefined
-                                            }
-                                            defaultFullDomain={
-                                                httpConfigFullDomain ??
-                                                undefined
-                                            }
-                                            onDomainChange={(res) => {
-                                                if (res === null) {
-                                                    form.setValue(
-                                                        "httpConfigSubdomain",
-                                                        null
-                                                    );
-                                                    form.setValue(
-                                                        "httpConfigDomainId",
-                                                        null
-                                                    );
-                                                    form.setValue(
-                                                        "httpConfigFullDomain",
-                                                        null
-                                                    );
-                                                    return;
-                                                }
-                                                form.setValue(
-                                                    "httpConfigSubdomain",
-                                                    res.subdomain ?? null
-                                                );
-                                                form.setValue(
-                                                    "httpConfigDomainId",
-                                                    res.domainId
-                                                );
-                                                form.setValue(
-                                                    "httpConfigFullDomain",
-                                                    res.fullDomain
-                                                );
-                                            }}
+                                        <FormField
+                                            control={form.control}
+                                            name="httpConfigDomainId"
+                                            render={() => (
+                                                <FormItem>
+                                                    <DomainPicker
+                                                        key={`inference-domain-${siteResource.id}`}
+                                                        orgId={
+                                                            siteResource.orgId
+                                                        }
+                                                        cols={2}
+                                                        hideFreeDomain
+                                                        defaultSubdomain={
+                                                            httpConfigSubdomain ??
+                                                            undefined
+                                                        }
+                                                        defaultDomainId={
+                                                            httpConfigDomainId ??
+                                                            undefined
+                                                        }
+                                                        defaultFullDomain={
+                                                            httpConfigFullDomain ??
+                                                            undefined
+                                                        }
+                                                        onDomainChange={(
+                                                            res
+                                                        ) => {
+                                                            if (res === null) {
+                                                                form.setValue(
+                                                                    "httpConfigSubdomain",
+                                                                    null
+                                                                );
+                                                                form.setValue(
+                                                                    "httpConfigDomainId",
+                                                                    "",
+                                                                    {
+                                                                        shouldValidate:
+                                                                            true
+                                                                    }
+                                                                );
+                                                                form.setValue(
+                                                                    "httpConfigFullDomain",
+                                                                    null
+                                                                );
+                                                                return;
+                                                            }
+                                                            form.setValue(
+                                                                "httpConfigSubdomain",
+                                                                res.subdomain ??
+                                                                    null
+                                                            );
+                                                            form.setValue(
+                                                                "httpConfigDomainId",
+                                                                res.domainId,
+                                                                {
+                                                                    shouldValidate:
+                                                                        true
+                                                                }
+                                                            );
+                                                            form.setValue(
+                                                                "httpConfigFullDomain",
+                                                                res.fullDomain
+                                                            );
+                                                        }}
+                                                    />
+                                                    <FormMessage />
+                                                </FormItem>
+                                            )}
                                        />
                                    </SettingsFormCell>
                                    <SettingsFormCell span="half">
@@ -139,6 +139,22 @@ export default function GeneralForm() {
                    : "Port number should not be set for HTTP resources",
                path: ["proxyPort"]
            }
+        )
+        .refine(
+            (data) => {
+                if (
+                    ["http", "ssh", "rdp", "vnc", "inference"].includes(
+                        resource.mode
+                    )
+                ) {
+                    return !!data.domainId;
+                }
+                return true;
+            },
+            {
+                message: t("domainRequired"),
+                path: ["domainId"]
+            }
        );

    type GeneralFormValues = z.infer<typeof GeneralFormSchema>;
@@ -434,63 +450,87 @@ export default function GeneralForm() {
                                            resource.mode
                                        ) && (
                                            <SettingsFormCell span="full">
-                                                <div id="resource-domain-picker">
-                                                    <DomainPicker
-                                                        allowWildcard={
-                                                            resource.mode !==
-                                                            "inference"
-                                                        }
-                                                        key={
-                                                            resource.resourceId
-                                                        }
-                                                        orgId={orgId as string}
-                                                        cols={2}
-                                                        defaultSubdomain={
-                                                            form.watch(
-                                                                "subdomain"
-                                                            ) ?? undefined
-                                                        }
-                                                        defaultDomainId={
-                                                            form.watch(
-                                                                "domainId"
-                                                            ) ?? undefined
-                                                        }
-                                                        defaultFullDomain={
-                                                            resourceFullDomainName ||
-                                                            undefined
-                                                        }
-                                                        onDomainChange={(
-                                                            res
-                                                        ) => {
-                                                            if (res === null) {
-                                                                form.setValue(
-                                                                    "domainId",
-                                                                    undefined
-                                                                );
-                                                                form.setValue(
-                                                                    "subdomain",
-                                                                    undefined
-                                                                );
-                                                                setResourceFullDomain(
-                                                                    `${resource.ssl ? "https" : "http"}://`
-                                                                );
-                                                                return;
-                                                            }
-                                                            form.setValue(
-                                                                "domainId",
-                                                                res.domainId
-                                                            );
-                                                            form.setValue(
-                                                                "subdomain",
-                                                                res.subdomain ??
-                                                                    undefined
-                                                            );
-                                                            setResourceFullDomain(
-                                                                `${resource.ssl ? "https" : "http"}://${toUnicode(res.fullDomain)}`
-                                                            );
-                                                        }}
-                                                    />
-                                                </div>
+                                                <FormField
+                                                    control={form.control}
+                                                    name="domainId"
+                                                    render={() => (
+                                                        <FormItem>
+                                                            <div id="resource-domain-picker">
+                                                                <DomainPicker
+                                                                    allowWildcard={
+                                                                        resource.mode !==
+                                                                        "inference"
+                                                                    }
+                                                                    key={
+                                                                        resource.resourceId
+                                                                    }
+                                                                    orgId={
+                                                                        orgId as string
+                                                                    }
+                                                                    cols={2}
+                                                                    defaultSubdomain={
+                                                                        form.watch(
+                                                                            "subdomain"
+                                                                        ) ??
+                                                                        undefined
+                                                                    }
+                                                                    defaultDomainId={
+                                                                        form.watch(
+                                                                            "domainId"
+                                                                        ) ??
+                                                                        undefined
+                                                                    }
+                                                                    defaultFullDomain={
+                                                                        resourceFullDomainName ||
+                                                                        undefined
+                                                                    }
+                                                                    onDomainChange={(
+                                                                        res
+                                                                    ) => {
+                                                                        if (
+                                                                            res ===
+                                                                            null
+                                                                        ) {
+                                                                            form.setValue(
+                                                                                "domainId",
+                                                                                undefined,
+                                                                                {
+                                                                                    shouldValidate:
+                                                                                        true
+                                                                                }
+                                                                            );
+                                                                            form.setValue(
+                                                                                "subdomain",
+                                                                                undefined
+                                                                            );
+                                                                            setResourceFullDomain(
+                                                                                `${resource.ssl ? "https" : "http"}://`
+                                                                            );
+                                                                            return;
+                                                                        }
+                                                                        form.setValue(
+                                                                            "domainId",
+                                                                            res.domainId,
+                                                                            {
+                                                                                shouldValidate:
+                                                                                    true
+                                                                            }
+                                                                        );
+                                                                        form.setValue(
+                                                                            "subdomain",
+                                                                            res.subdomain ??
+                                                                                undefined
+                                                                        );
+                                                                        setResourceFullDomain(
+                                                                            `${resource.ssl ? "https" : "http"}://${toUnicode(res.fullDomain)}`
+                                                                        );
+                                                                    }}
+                                                                />
+                                                            </div>
+                                                            <FormMessage />
+                                                        </FormItem>
+                                                    )}
+                                                />
                                            </SettingsFormCell>
                                        )}
                                        {!["tcp", "udp", "inference"].includes(
@@ -252,9 +252,10 @@ export default function GenerateLicenseKeyForm({
        try {
            // Check if this is a business/enterprise license request
            if (payload.useCaseType === "business") {
-                const response = await api.put<
-                    AxiosResponse<string>
-                    >(`/org/${orgId}/license/enterprise`, { ...payload, tier: "big_license" } );
+                const response = await api.put<AxiosResponse<string>>(
+                    `/org/${orgId}/license/enterprise`,
+                    { ...payload, tier: "tier2" }
+                );

                console.log("Checkout session response:", response.data);
                const checkoutUrl = response.data.data;
@@ -1087,16 +1088,16 @@ export default function GenerateLicenseKeyForm({
                    )}

                    {!generatedKey && useCaseType === "business" && (
-                            <Button
-                                type="submit"
-                                form="generate-license-business-form"
-                                disabled={loading}
-                                loading={loading}
-                            >
-                                {t(
-                                    "generateLicenseKeyForm.buttons.generateLicenseKey"
-                                )}
-                            </Button>
+                        <Button
+                            type="submit"
+                            form="generate-license-business-form"
+                            disabled={loading}
+                            loading={loading}
+                        >
+                            {t(
+                                "generateLicenseKeyForm.buttons.generateLicenseKey"
+                            )}
+                        </Button>
                    )}
                </CredenzaFooter>
            </CredenzaContent>
@@ -201,9 +201,16 @@ export default function GenerateLicenseKeysTable({
            },
            cell: ({ row }) => {
                const tier = row.original.tier;
-                return tier === "enterprise"
-                    ? t("licenseTierEnterprise")
-                    : t("licenseTierPersonal");
+                switch (tier) {
+                    case "enterprise":
+                        return t("licenseTierEnterprise");
+                    case "tier1":
+                        return t("licenseTierTier1");
+                    case "tier2":
+                        return t("licenseTierTier2");
+                    default:
+                        return t("licenseTierPersonal");
+                }
            }
        },
        {
@@ -0,0 +1,39 @@
+"use client";
+
+import { Globe, CreditCard, ArrowRight } from "lucide-react";
+import { useTranslations } from "next-intl";
+import Link from "next/link";
+import { Button } from "@app/components/ui/button";
+import DismissableBanner from "./DismissableBanner";
+
+type LicenseBillingBannerProps = {
+    orgId: string;
+};
+
+export const LicenseBillingBanner = ({ orgId }: LicenseBillingBannerProps) => {
+    const t = useTranslations();
+
+    return (
+        <DismissableBanner
+            storageKey="license-billing-banner-dismissed"
+            version={1}
+            title={t("licenseBillingBannerTitle")}
+            titleIcon={<Globe className="w-5 h-5 text-primary" />}
+            description={t("licenseBillingBannerDescription")}
+        >
+            <Link href={`/${orgId}/settings/billing`}>
+                <Button
+                    variant="outline"
+                    size="sm"
+                    className="gap-2 hover:bg-primary/10 hover:border-primary/50 transition-colors"
+                >
+                    <CreditCard className="w-4 h-4" />
+                    {t("licenseBillingBannerButton")}
+                    <ArrowRight className="w-4 h-4" />
+                </Button>
+            </Link>
+        </DismissableBanner>
+    );
+};
+
+export default LicenseBillingBanner;
@@ -100,9 +100,16 @@ export function LicenseKeysDataTable({
            },
            cell: ({ row }) => {
                const tier = row.original.tier;
-                return tier === "enterprise"
-                    ? t("licenseTierEnterprise")
-                    : t("licenseTierPersonal");
+                switch (tier) {
+                    case "enterprise":
+                        return t("licenseTierEnterprise");
+                    case "tier1":
+                        return t("licenseTierTier1");
+                    case "tier2":
+                        return t("licenseTierTier2");
+                    default:
+                        return t("licenseTierPersonal");
+                }
            }
        },
        {
@@ -40,8 +40,8 @@ import { InfoIcon } from "lucide-react";
 import { useUserContext } from "@app/hooks/useUserContext";

 const TIER_TO_LICENSE_ID = {
-    starter: "small_license",
-    scale: "big_license"
+    starter: "tier1",
+    scale: "tier2"
 } as const;

 type FormProps = {
@@ -330,7 +330,7 @@ export default function NewPricingLicenseForm({
                                            cols={2}
                                        />
                                        <a
-                                            href="https://pangolin.net/pricing"
+                                            href="https://pangolin.net/pricing#Self-Hosted"
                                            target="_blank"
                                            rel="noopener noreferrer"
                                            className="text-sm text-primary hover:underline"
@@ -63,6 +63,12 @@ export default function SiteInfoCard({}: SiteInfoCardProps) {
    ) : null;

    if (site.type === "newt") {
+        // agent and agentVersion were added after newtVersion, so a
+        // site still running an older Newt reports only newtVersion.
+        // Without these fallbacks the badge renders with no label and
+        // no version at all.
+        const agentLabel = site.agent == "cli" ? "Pangolin CLI" : "Newt";
+        const agentVersion = site.agentVersion ?? site.newtVersion;
        return (
            <Alert>
                <AlertDescription>
@@ -79,13 +85,12 @@ export default function SiteInfoCard({}: SiteInfoCardProps) {
                        <InfoSection>
                            <InfoSectionTitle>{t("agent")}</InfoSectionTitle>
                            <InfoSectionContent>
-                                {site.agent == "newt" ? "Newt" : null}
-                                {site.agent == "cli"
-                                    ? "Pangolin CLI"
-                                    : null}{" "}
-                                {site.agentVersion
-                                    ? `v${site.agentVersion}`
-                                    : "-"}
+                                <div className="flex items-center space-x-1">
+                                    <span>{agentLabel}</span>
+                                    {agentVersion && (
+                                        <span>v{agentVersion}</span>
+                                    )}
+                                </div>
                            </InfoSectionContent>
                        </InfoSection>
                        {endpointSection}
@@ -373,7 +373,7 @@ export default function SitesTable({
                accessorKey: "type",
                friendlyName: t("agent"),
                header: () => {
-                    return <span className="p-3">{t("type")}</span>;
+                    return <span className="p-3">{t("agent")}</span>;
                },
                cell: ({ row }) => {
                    const originalRow = row.original;
@@ -386,25 +386,27 @@ export default function SitesTable({
                    );

                    if (originalRow.type === "newt") {
-                        if (!originalRow.agent) {
+                        if (!originalRow.agent && !originalRow.newtVersion) {
+                            // it has not checked in yet
                            return <span>-</span>;
                        }
+                        // agent and agentVersion were added after newtVersion, so a
+                        // site still running an older Newt reports only newtVersion.
+                        // Without these fallbacks the badge renders with no label and
+                        // no version at all.
+                        const agentLabel =
+                            originalRow.agent == "cli"
+                                ? "Pangolin CLI"
+                                : "Newt";
+                        const agentVersion =
+                            originalRow.agentVersion ?? originalRow.newtVersion;
                        return (
                            <div className="flex items-center space-x-1">
                                <Badge variant="secondary">
                                    <div className="flex items-center space-x-1">
-                                        <span>
-                                            {originalRow.agent == "newt"
-                                                ? "Newt"
-                                                : null}
-                                            {originalRow.agent == "cli"
-                                                ? "Pangolin CLI"
-                                                : null}
-                                        </span>
-                                        {originalRow.agentVersion && (
-                                            <span>
-                                                v{originalRow.agentVersion}
-                                            </span>
+                                        <span>{agentLabel}</span>
+                                        {agentVersion && (
+                                            <span>v{agentVersion}</span>
                                        )}
                                    </div>
                                </Badge>
@@ -150,7 +150,7 @@ Type=simple
 User=root
 Group=root
 EnvironmentFile=/etc/pangolin/pangolin-site.env
-ExecStart=/home/owen/fossorial/cli/bin/pangolin up site
+ExecStart=/usr/local/bin/pangolin up site
 Restart=always
 RestartSec=2
 UMask=0077
@@ -87,7 +87,7 @@ function Calendar({
                        : "[&>svg]:text-muted-foreground flex h-8 items-center gap-1 rounded-md pl-2 pr-1 text-sm [&>svg]:size-3.5",
                    defaultClassNames.caption_label
                ),
-                table: "w-full border-collapse",
+                month_grid: "w-full border-collapse",
                weekdays: cn("flex", defaultClassNames.weekdays),
                weekday: cn(
                    "text-muted-foreground flex-1 select-none rounded-md text-[0.8rem] font-normal",
@@ -523,6 +523,13 @@ export function createCreateFormSchema(t: TranslateFn) {
                    });
                }
            }
+            if (data.mode === "inference" && !data.httpConfigDomainId) {
+                ctx.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    message: t("domainRequired"),
+                    path: ["httpConfigDomainId"]
+                });
+            }
        });
 }