Bump actions/setup-go in the github-actions-dependencies group

Bumps the github-actions-dependencies group with 1 update: [actions/setup-go](https://github.com/actions/setup-go). Updates `actions/setup-go` from 6.4.0 to 6.5.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](4a3601121d...924ae3a1cd) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 6.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
Merge pull request #3350 from fosrl/dev
2026-06-29 18:49:53 +00:00 · 2026-06-29 01:33:48 +00:00 · 2026-06-26 09:28:12 -04:00 · 2026-06-26 09:26:43 -04:00 · 2026-06-25 13:05:32 -07:00 · 2026-06-25 15:39:04 -04:00
141 changed files with 7160 additions and 2303 deletions
--- a/.github/workflows/cicd.yml
+++ b/.github/workflows/cicd.yml
@@ -62,7 +62,7 @@ jobs:

        steps:
            - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

            - name: Monitor storage space
              run: |
@@ -134,7 +134,7 @@ jobs:

        steps:
            - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

            - name: Monitor storage space
              run: |
@@ -201,7 +201,7 @@ jobs:
        timeout-minutes: 30
        steps:
            - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

            - name: Log in to Docker Hub
              uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
@@ -256,7 +256,7 @@ jobs:

        steps:
            - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

            - name: Extract tag name
              id: get-tag
@@ -264,7 +264,7 @@ jobs:
              shell: bash

            - name: Install Go
-              uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+              uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
              with:
                  go-version: 1.25

--- a/.github/workflows/linting.yml
+++ b/.github/workflows/linting.yml
@@ -21,7 +21,7 @@ jobs:
        runs-on: ubuntu-latest
        steps:
            - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

            - name: Set up Node.js
              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -14,7 +14,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Install Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -62,7 +62,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Build Docker image sqlite
        run: make dev-build-sqlite
@@ -71,7 +71,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Build Docker image pg
        run: make dev-build-pg
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -18,5 +18,8 @@
    "[json]": {
        "editor.defaultFormatter": "esbenp.prettier-vscode"
    },
-    "editor.formatOnSave": true
+    "editor.formatOnSave": true,
+    "cSpell.words": [
+        "nessicary"
+    ]
 }
--- a/docker-compose.drizzle.yml
+++ b/docker-compose.drizzle.yml
--- a/docker-compose.example.yml
+++ b/docker-compose.example.yml
--- a/docker-compose.mailpit.yml
+++ b/docker-compose.mailpit.yml
--- a/docker-compose.pgr.yml
+++ b/docker-compose.pgr.yml
--- a/docker-compose.yml
+++ b/docker-compose.yml
--- a/install/go.mod
+++ b/install/go.mod
@@ -5,7 +5,7 @@ go 1.25.0
 require (
 	github.com/charmbracelet/huh v1.0.0
 	github.com/charmbracelet/lipgloss v1.1.0
-	golang.org/x/term v0.43.0
+	golang.org/x/term v0.44.0
 	gopkg.in/yaml.v3 v3.0.1
 )

@@ -33,6 +33,6 @@ require (
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	golang.org/x/sync v0.15.0 // indirect
-	golang.org/x/sys v0.44.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
 	golang.org/x/text v0.23.0 // indirect
 )
--- a/install/go.sum
+++ b/install/go.sum
@@ -69,10 +69,10 @@ golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
 golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
-golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
-golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
+golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
 golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
 golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
--- a/messages/bg-BG.json
+++ b/messages/bg-BG.json
@@ -66,9 +66,15 @@
    "local": "Локална",
    "edit": "Редактиране",
    "siteConfirmDelete": "Потвърждение на изтриване на сайта",
+    "siteConfirmDeleteAndResources": "Потвърдете изтриването на сайта и ресурсите",
    "siteDelete": "Изтриване на сайта",
+    "siteDeleteAndResources": "Изтриване на сайта и ресурсите",
    "siteMessageRemove": "След премахване, сайтът вече няма да бъде достъпен. Всички цели, свързани със сайта, също ще бъдат премахнати.",
+    "siteMessageRemoveAndResources": "Това ще изтрие окончателно всички публични и частни ресурси, свързани с този сайт, дори ако ресурсът е асоцииран и с други сайтове.",
    "siteQuestionRemove": "Сигурни ли сте, че искате да премахнете сайта от организацията?",
+    "siteQuestionRemoveAndResources": "Наистина ли желаете да изтриете този сайт и всички свързани ресурси?",
+    "sitesTableDeleteSite": "Изтриване на сайта",
+    "sitesTableDeleteSiteAndResources": "Изтриване на сайта и ресурсите",
    "siteManageSites": "Управление на сайтове",
    "siteDescription": "Създайте и управлявайте сайтове, за да осигурите свързаност със частни мрежи",
    "sitesBannerTitle": "Свържете се с мрежа.",
@@ -2338,6 +2344,7 @@
    "createInternalResourceDialogDestinationCidrDescription": "CIDR диапазонът на ресурса в мрежата на сайта.",
    "createInternalResourceDialogAlias": "Псевдоним",
    "createInternalResourceDialogAliasDescription": "По избор вътрешен DNS псевдоним за този ресурс.",
+    "internalResourceAliasLocalWarning": "Синоними с окончание .local могат да причинят проблеми с резолюцията поради mDNS в някои мрежи.",
    "internalResourceDownstreamSchemeRequired": "Методът е задължителен за HTTP ресурси",
    "internalResourceHttpPortRequired": "Портът към целта е задължителен за HTTP ресурси",
    "siteConfiguration": "Конфигурация",
@@ -2967,6 +2974,7 @@
    "orgOrDomainIdMissing": "Липсва идентификатор на организация или домейн",
    "loadingDNSRecords": "Зареждане на DNS записи...",
    "olmUpdateAvailableInfo": "Налична е актуализирана версия на Olm. Моля, актуализирайте до най-новата версия за най-добро преживяване.",
+    "updateAvailableInfo": "На разположение е обновена версия. Моля, обновете до най-новата версия за най-добър опит.",
    "client": "Клиент",
    "proxyProtocol": "Настройки на прокси протокол",
    "proxyProtocolDescription": "Конфигурирайте Proxy Protocol, за да запазите IP адресите на клиентите за TCP услуги.",
--- a/messages/cs-CZ.json
+++ b/messages/cs-CZ.json
@@ -66,9 +66,15 @@
    "local": "Místní",
    "edit": "Upravit",
    "siteConfirmDelete": "Potvrdit odstranění lokality",
+    "siteConfirmDeleteAndResources": "Potvrdit odstranění lokality a zdrojů",
    "siteDelete": "Odstranění lokality",
+    "siteDeleteAndResources": "Odstranit lokalitu a zdroje",
    "siteMessageRemove": "Po odstranění webu již nebude přístupný. Všechny cíle spojené s webem budou také odstraněny.",
+    "siteMessageRemoveAndResources": "Toto trvale odstraní všechny veřejné a soukromé zdroje spojené s touto lokalitou, i když je zdroj také přiřazen k jiným lokalitám.",
    "siteQuestionRemove": "Jste si jisti, že chcete odstranit tuto stránku z organizace?",
+    "siteQuestionRemoveAndResources": "Opravdu chcete odstranit tuto lokalitu a všechny přidružené zdroje?",
+    "sitesTableDeleteSite": "Odstranění lokality",
+    "sitesTableDeleteSiteAndResources": "Odstranit lokalitu a zdroje",
    "siteManageSites": "Správa lokalit",
    "siteDescription": "Vytvořte a spravujte stránky pro povolení připojení k soukromým sítím",
    "sitesBannerTitle": "Připojit jakoukoli síť",
@@ -2338,6 +2344,7 @@
    "createInternalResourceDialogDestinationCidrDescription": "Rozsah zdrojů CIDR v síti webu.",
    "createInternalResourceDialogAlias": "Alias",
    "createInternalResourceDialogAliasDescription": "Volitelný interní DNS alias pro tento dokument.",
+    "internalResourceAliasLocalWarning": "Aliasy končící na .local mohou způsobit problémy s vyřešením díky mDNS v některých sítích.",
    "internalResourceDownstreamSchemeRequired": "HTTP metoda je vyžadována pro HTTP zdroje",
    "internalResourceHttpPortRequired": "Přípoječný port je nutný pro HTTP zdroj",
    "siteConfiguration": "Konfigurace",
@@ -2967,6 +2974,7 @@
    "orgOrDomainIdMissing": "Chybí ID organizace nebo domény",
    "loadingDNSRecords": "Načítání DNS záznamů...",
    "olmUpdateAvailableInfo": "Je k dispozici aktualizovaná verze Olm. Pro nejlepší zážitek prosím aktualizujte na nejnovější verzi.",
+    "updateAvailableInfo": "Je k dispozici aktualizovaná verze. Aktualizujte prosím na nejnovější verzi pro nejlepší zážitek.",
    "client": "Zákazník",
    "proxyProtocol": "Nastavení proxy protokolu",
    "proxyProtocolDescription": "Konfigurace Proxy protokolu pro zachování klientských IP adres pro služby TCP.",
--- a/messages/da-DK.json
+++ b/messages/da-DK.json
--- a/messages/de-DE.json
+++ b/messages/de-DE.json
@@ -66,9 +66,15 @@
    "local": "Lokal",
    "edit": "Bearbeiten",
    "siteConfirmDelete": "Löschen des Standorts bestätigen",
+    "siteConfirmDeleteAndResources": "Löschen von Standort und Ressourcen bestätigen",
    "siteDelete": "Standort löschen",
+    "siteDeleteAndResources": "Standort und Ressourcen löschen",
    "siteMessageRemove": "Sobald der Standort entfernt ist, wird er nicht mehr zugänglich sein. Alle mit dem Standort verbundenen Ziele werden ebenfalls entfernt.",
+    "siteMessageRemoveAndResources": "Dies wird dauerhaft alle öffentlichen und privaten Ressourcen, die mit diesem Standort verknüpft sind, löschen, selbst wenn eine Ressource auch mit anderen Standorten verbunden ist.",
    "siteQuestionRemove": "Sind Sie sicher, dass Sie den Standort aus der Organisation entfernen möchten?",
+    "siteQuestionRemoveAndResources": "Sind Sie sicher, dass Sie diesen Standort und alle zugehörigen Ressourcen löschen möchten?",
+    "sitesTableDeleteSite": "Standort löschen",
+    "sitesTableDeleteSiteAndResources": "Standort und Ressourcen löschen",
    "siteManageSites": "Standorte verwalten",
    "siteDescription": "Erstellen und Verwalten von Standorten, um die Verbindung zu privaten Netzwerken zu ermöglichen",
    "sitesBannerTitle": "Verbinde ein beliebiges Netzwerk",
@@ -2338,6 +2344,7 @@
    "createInternalResourceDialogDestinationCidrDescription": "Der CIDR-Bereich der Ressource im Netzwerk der Website.",
    "createInternalResourceDialogAlias": "Alias",
    "createInternalResourceDialogAliasDescription": "Ein optionaler interner DNS-Alias für diese Ressource.",
+    "internalResourceAliasLocalWarning": "Aliasse, die auf .local enden, können aufgrund von mDNS in einigen Netzwerken zu Auflösungsproblemen führen.",
    "internalResourceDownstreamSchemeRequired": "Schema ist für HTTP-Ressourcen erforderlich",
    "internalResourceHttpPortRequired": "Zielport ist für HTTP-Ressourcen erforderlich",
    "siteConfiguration": "Konfiguration",
@@ -2967,6 +2974,7 @@
    "orgOrDomainIdMissing": "Organisation oder Domänen-ID fehlt",
    "loadingDNSRecords": "Lade DNS-Einträge...",
    "olmUpdateAvailableInfo": "Eine aktualisierte Version von Olm ist verfügbar. Bitte aktualisieren Sie auf die neueste Version für die beste Erfahrung.",
+    "updateAvailableInfo": "Eine aktualisierte Version ist verfügbar. Bitte aktualisieren Sie auf die neueste Version für das beste Erlebnis.",
    "client": "Client",
    "proxyProtocol": "Proxy-Protokoll-Einstellungen",
    "proxyProtocolDescription": "Konfigurieren Sie das Proxy-Protokoll, um die IP-Adressen des Clients für TCP-Dienste zu erhalten.",
--- a/messages/en-US.json
+++ b/messages/en-US.json
@@ -66,9 +66,15 @@
    "local": "Local",
    "edit": "Edit",
    "siteConfirmDelete": "Confirm Delete Site",
+    "siteConfirmDeleteAndResources": "Confirm Delete Site and Resources",
    "siteDelete": "Delete Site",
-    "siteMessageRemove": "Once removed the site will no longer be accessible. All targets associated with the site will also be removed.",
+    "siteDeleteAndResources": "Delete Site and Resources",
+    "siteMessageRemove": "Once removed the site will no longer be accessible. Targets associated with this site will be removed, but resources will remain.",
+    "siteMessageRemoveAndResources": "This will permanently delete all public and private resources linked to this site, even if a resource is also associated with other sites.",
    "siteQuestionRemove": "Are you sure you want to remove the site from the organization?",
+    "siteQuestionRemoveAndResources": "Are you sure you want to delete this site and all associated resources?",
+    "sitesTableDeleteSite": "Delete Site",
+    "sitesTableDeleteSiteAndResources": "Delete Site and Resources",
    "siteManageSites": "Manage Sites",
    "siteDescription": "Create and manage sites to enable connectivity to private networks",
    "sitesBannerTitle": "Connect Any Network",
@@ -204,7 +210,7 @@
    "proxyResourceTitle": "Manage Public Resources",
    "proxyResourceDescription": "Create and manage resources that are publicly accessible through a web browser",
    "publicResourcesBannerTitle": "Web-based Public Access",
-    "publicResourcesBannerDescription": "Public resources are HTTPS proxies accessible to anyone on the internet through a web browser. Unlike private resources, they do not require client-side software and can include identity and context-aware access policies.",
+    "publicResourcesBannerDescription": "Public resources are proxies accessible to anyone on the internet through a web browser and include identity and context-aware access policies. Unlike private resources, they do not require client-side software.",
    "clientResourceTitle": "Manage Private Resources",
    "clientResourceDescription": "Create and manage resources that are only accessible through a connected client",
    "privateResourcesBannerTitle": "Zero-Trust Private Access",
@@ -1638,7 +1644,7 @@
    "alertingActionType": "Action type",
    "alertingNotifyUsers": "Users",
    "alertingNotifyRoles": "Roles",
-    "alertingNotifyEmails": "Email addresses",
+    "alertingNotifyEmails": "Email Addresses",
    "alertingEmailPlaceholder": "Add email and press Enter",
    "alertingWebhookMethod": "HTTP method",
    "alertingWebhookSecret": "Signing secret (optional)",
@@ -2171,10 +2177,10 @@
    "sshSudoModeCommandsDescription": "User can run only the specified commands with sudo.",
    "sshSudo": "Allow sudo",
    "sshSudoCommands": "Sudo Commands",
-    "sshSudoCommandsDescription": "List of commands the user is allowed to run with sudo, separated by commas, spaces, or new lines. Absolute paths must be used.",
+    "sshSudoCommandsDescription": "List of commands the user is allowed to run with sudo, one per line. Absolute paths must be used.",
    "sshCreateHomeDir": "Create Home Directory",
    "sshUnixGroups": "Unix Groups",
-    "sshUnixGroupsDescription": "Unix groups to add the user to on the target host, separated by commas, spaces, or new lines.",
+    "sshUnixGroupsDescription": "Unix groups to add the user to on the target host, one per line.",
    "roleTextFieldPlaceholder": "Enter values, or drop a .txt or .csv file",
    "roleTextImportTitle": "Import from File",
    "roleTextImportDescription": "Importing {fileName} into {fieldLabel}.",
@@ -2338,6 +2344,7 @@
    "createInternalResourceDialogDestinationCidrDescription": "The CIDR range of the resource on the site's network.",
    "createInternalResourceDialogAlias": "Alias",
    "createInternalResourceDialogAliasDescription": "An optional internal DNS alias for this resource.",
+    "internalResourceAliasLocalWarning": "Aliases ending in .local can cause resolution issues due to mDNS on some networks.",
    "internalResourceDownstreamSchemeRequired": "Scheme is required for HTTP resources",
    "internalResourceHttpPortRequired": "Destination port is required for HTTP resources",
    "siteConfiguration": "Configuration",
@@ -2549,6 +2556,7 @@
    "idpGoogleDescription": "Google OAuth2/OIDC provider",
    "idpAzureDescription": "Microsoft Azure OAuth2/OIDC provider",
    "subnet": "Subnet",
+    "utilitySubnet": "Utility Subnet",
    "subnetDescription": "The subnet for this organization's network configuration.",
    "customDomain": "Custom Domain",
    "authPage": "Authentication Pages",
@@ -2967,6 +2975,7 @@
    "orgOrDomainIdMissing": "Organization or Domain ID is missing",
    "loadingDNSRecords": "Loading DNS records...",
    "olmUpdateAvailableInfo": "An updated version of Olm is available. Please update to the latest version for the best experience.",
+    "updateAvailableInfo": "An updated version is available. Please update to the latest version for the best experience.",
    "client": "Client",
    "proxyProtocol": "Proxy Protocol Settings",
    "proxyProtocolDescription": "Configure Proxy Protocol to preserve client IP addresses for TCP services.",
--- a/messages/es-ES.json
+++ b/messages/es-ES.json
@@ -66,9 +66,15 @@
    "local": "Local",
    "edit": "Editar",
    "siteConfirmDelete": "Confirmar Borrar Sitio",
+    "siteConfirmDeleteAndResources": "Confirmar eliminación del sitio y recursos",
    "siteDelete": "Eliminar sitio",
+    "siteDeleteAndResources": "Eliminar sitio y recursos",
    "siteMessageRemove": "Una vez eliminado, el sitio ya no será accesible. Todos los objetivos asociados con el sitio también serán eliminados.",
+    "siteMessageRemoveAndResources": "Esto eliminará permanentemente todos los recursos públicos y privados vinculados a este sitio, incluso si un recurso también está asociado con otros sitios.",
    "siteQuestionRemove": "¿Está seguro que desea eliminar el sitio de la organización?",
+    "siteQuestionRemoveAndResources": "¿Está seguro de que desea eliminar este sitio y todos los recursos asociados?",
+    "sitesTableDeleteSite": "Eliminar sitio",
+    "sitesTableDeleteSiteAndResources": "Eliminar sitio y recursos",
    "siteManageSites": "Administrar Sitios",
    "siteDescription": "Crear y administrar sitios para permitir la conectividad a redes privadas",
    "sitesBannerTitle": "Conectar cualquier red",
@@ -2338,6 +2344,7 @@
    "createInternalResourceDialogDestinationCidrDescription": "El rango CIDR del recurso en la red del sitio.",
    "createInternalResourceDialogAlias": "Alias",
    "createInternalResourceDialogAliasDescription": "Un alias DNS interno opcional para este recurso.",
+    "internalResourceAliasLocalWarning": "Los alias que terminan en .local pueden causar problemas de resolución debido a mDNS en algunas redes.",
    "internalResourceDownstreamSchemeRequired": "Se requiere el método para recursos HTTP",
    "internalResourceHttpPortRequired": "Se requiere el puerto de destino para recursos HTTP",
    "siteConfiguration": "Configuración",
@@ -2967,6 +2974,7 @@
    "orgOrDomainIdMissing": "Falta el ID de organización o dominio",
    "loadingDNSRecords": "Cargando registros DNS...",
    "olmUpdateAvailableInfo": "Una versión actualizada de Olm está disponible. Por favor, actualice a la última versión para obtener la mejor experiencia.",
+    "updateAvailableInfo": "Hay una versión actualizada disponible. Actualice a la última versión para obtener la mejor experiencia.",
    "client": "Cliente",
    "proxyProtocol": "Configuración del Protocolo Proxy",
    "proxyProtocolDescription": "Configurar el protocolo de proxy para preservar las direcciones IP del cliente para los servicios TCP.",
--- a/messages/fr-FR.json
+++ b/messages/fr-FR.json
@@ -66,9 +66,15 @@
    "local": "Locale",
    "edit": "Modifier",
    "siteConfirmDelete": "Confirmer la suppression du nœud",
+    "siteConfirmDeleteAndResources": "Confirmer la suppression du site et des ressources",
    "siteDelete": "Supprimer le nœud",
+    "siteDeleteAndResources": "Supprimer le site et les ressources",
    "siteMessageRemove": "Une fois supprimé, le nœud ne sera plus accessible. Toutes les cibles associées au nœud seront également supprimées.",
+    "siteMessageRemoveAndResources": "Cela supprimera définitivement toutes les ressources publiques et privées liées à ce site, même si une ressource est également associée à d'autres sites.",
    "siteQuestionRemove": "Êtes-vous sûr de vouloir supprimer ce nœud de l'organisation ?",
+    "siteQuestionRemoveAndResources": "Êtes-vous sûr de vouloir supprimer ce site et toutes les ressources associées?",
+    "sitesTableDeleteSite": "Supprimer le site",
+    "sitesTableDeleteSiteAndResources": "Supprimer le site et les ressources",
    "siteManageSites": "Gérer les nœuds",
    "siteDescription": "Créer et gérer des sites pour activer la connectivité aux réseaux privés",
    "sitesBannerTitle": "Se connecter à n'importe quel réseau",
@@ -2338,6 +2344,7 @@
    "createInternalResourceDialogDestinationCidrDescription": "La gamme CIDR de la ressource sur le réseau du site.",
    "createInternalResourceDialogAlias": "Alias",
    "createInternalResourceDialogAliasDescription": "Un alias DNS interne optionnel pour cette ressource.",
+    "internalResourceAliasLocalWarning": "Les alias se terminant par .local peuvent causer des problèmes de résolution dus au mDNS sur certains réseaux.",
    "internalResourceDownstreamSchemeRequired": "Un schéma est requis pour les ressources HTTP",
    "internalResourceHttpPortRequired": "Le port de destination est requis pour les ressources HTTP",
    "siteConfiguration": "Configuration",
@@ -2967,6 +2974,7 @@
    "orgOrDomainIdMissing": "L'organisation ou l'identifiant de domaine est manquant",
    "loadingDNSRecords": "Chargement des enregistrements DNS...",
    "olmUpdateAvailableInfo": "Une version mise à jour de Olm est disponible. Veuillez mettre à jour vers la dernière version pour la meilleure expérience.",
+    "updateAvailableInfo": "Une version mise à jour est disponible. Veuillez mettre à jour vers la dernière version pour une meilleure expérience.",
    "client": "Client",
    "proxyProtocol": "Paramètres du protocole proxy",
    "proxyProtocolDescription": "Configurer le protocole Proxy pour préserver les adresses IP du client pour les services TCP.",
--- a/messages/it-IT.json
+++ b/messages/it-IT.json
@@ -66,9 +66,15 @@
    "local": "Locale",
    "edit": "Modifica",
    "siteConfirmDelete": "Conferma Eliminazione Sito",
+    "siteConfirmDeleteAndResources": "Conferma Eliminazione Sito e Risorse",
    "siteDelete": "Elimina Sito",
+    "siteDeleteAndResources": "Elimina Sito e Risorse",
    "siteMessageRemove": "Una volta rimosso il sito non sarà più accessibile. Tutti gli oggetti associati al sito verranno rimossi.",
+    "siteMessageRemoveAndResources": "Questo eliminerà permanentemente tutte le risorse pubbliche e private collegate a questo sito, anche se una risorsa è anche associata ad altri siti.",
    "siteQuestionRemove": "Sei sicuro di voler rimuovere il sito dall'organizzazione?",
+    "siteQuestionRemoveAndResources": "Sei sicuro di voler eliminare questo sito e tutte le risorse associate?",
+    "sitesTableDeleteSite": "Elimina Sito",
+    "sitesTableDeleteSiteAndResources": "Elimina Sito e Risorse",
    "siteManageSites": "Gestisci Siti",
    "siteDescription": "Creare e gestire siti per abilitare la connettività a reti private",
    "sitesBannerTitle": "Connetti Qualsiasi Rete",
@@ -2338,6 +2344,7 @@
    "createInternalResourceDialogDestinationCidrDescription": "La gamma CIDR della risorsa sulla rete del sito.",
    "createInternalResourceDialogAlias": "Alias",
    "createInternalResourceDialogAliasDescription": "Un alias DNS interno opzionale per questa risorsa.",
+    "internalResourceAliasLocalWarning": "Gli alias che terminano in .local possono causare problemi di risoluzione a causa di mDNS su alcune reti.",
    "internalResourceDownstreamSchemeRequired": "Il metodo è richiesto per risorse HTTP",
    "internalResourceHttpPortRequired": "Porta di destinazione richiesta per risorse HTTP",
    "siteConfiguration": "Configurazione",
@@ -2967,6 +2974,7 @@
    "orgOrDomainIdMissing": "Manca l'ID dell'organizzazione o del dominio",
    "loadingDNSRecords": "Caricamento record DNS...",
    "olmUpdateAvailableInfo": "È disponibile una versione aggiornata di Olm. Si prega di aggiornare all'ultima versione per la migliore esperienza.",
+    "updateAvailableInfo": "È disponibile una versione aggiornata. Si prega di aggiornare all'ultima versione per la migliore esperienza.",
    "client": "Client",
    "proxyProtocol": "Impostazioni Protocollo Proxy",
    "proxyProtocolDescription": "Configurare il protocollo proxy per preservare gli indirizzi IP client per i servizi TCP.",
--- a/messages/ko-KR.json
+++ b/messages/ko-KR.json
@@ -66,9 +66,15 @@
    "local": "로컬",
    "edit": "편집",
    "siteConfirmDelete": "사이트 삭제 확인",
+    "siteConfirmDeleteAndResources": "사이트 및 리소스 삭제 확인",
    "siteDelete": "사이트 삭제",
+    "siteDeleteAndResources": "사이트 및 리소스 삭제",
    "siteMessageRemove": "삭제되면 사이트에 더 이상 액세스할 수 없습니다. 사이트와 연결된 모든 대상도 삭제됩니다.",
+    "siteMessageRemoveAndResources": "이 사이트와 연결된 모든 공용 및 개인 리소스는 다른 사이트에도 연결되어 있더라도 영구적으로 삭제됩니다.",
    "siteQuestionRemove": "조직에서 사이트를 제거하시겠습니까?",
+    "siteQuestionRemoveAndResources": "이 사이트와 모든 관련 리소스를 삭제하시겠습니까?",
+    "sitesTableDeleteSite": "사이트 삭제",
+    "sitesTableDeleteSiteAndResources": "사이트 및 리소스 삭제",
    "siteManageSites": "사이트 관리",
    "siteDescription": "프라이빗 네트워크로의 연결을 활성화하려면 사이트를 생성하고 관리하세요.",
    "sitesBannerTitle": "모든 네트워크 연결",
@@ -2338,6 +2344,7 @@
    "createInternalResourceDialogDestinationCidrDescription": "사이트 네트워크의 자원 IP 주소입니다.",
    "createInternalResourceDialogAlias": "별칭",
    "createInternalResourceDialogAliasDescription": "이 리소스에 대한 선택적 내부 DNS 별칭입니다.",
+    "internalResourceAliasLocalWarning": ".local로 끝나는 별칭은 일부 네트워크에서 mDNS로 인해 해결 문제가 발생할 수 있습니다.",
    "internalResourceDownstreamSchemeRequired": "HTTP 리소스에 스킴이 필요합니다",
    "internalResourceHttpPortRequired": "HTTP 리소스에 목적지 포트가 필요합니다",
    "siteConfiguration": "설정",
@@ -2967,6 +2974,7 @@
    "orgOrDomainIdMissing": "조직 ID 또는 도메인 ID가 누락되었습니다",
    "loadingDNSRecords": "DNS 레코드를 로드하는 중...",
    "olmUpdateAvailableInfo": "올름의 새 버전이 이용 가능합니다. 최상의 경험을 위해 최신 버전으로 업데이트하세요.",
+    "updateAvailableInfo": "업데이트된 버전이 있습니다. 최상의 경험을 위해 최신 버전으로 업데이트하세요.",
    "client": "클라이언트",
    "proxyProtocol": "프록시 프로토콜 설정",
    "proxyProtocolDescription": "TCP 서비스에 대한 클라이언트 IP 주소를 유지하도록 프록시 프로토콜을 구성하세요.",
--- a/messages/nb-NO.json
+++ b/messages/nb-NO.json
@@ -66,9 +66,15 @@
    "local": "Lokal",
    "edit": "Rediger",
    "siteConfirmDelete": "Bekreft Sletting av Område",
+    "siteConfirmDeleteAndResources": "Bekreft sletting av nettsted og ressurser",
    "siteDelete": "Slett Område",
+    "siteDeleteAndResources": "Slett nettsted og ressurser",
    "siteMessageRemove": "Når nettstedet er fjernet, vil det ikke lenger være tilgjengelig. Alle målene for nettstedet vil også bli fjernet.",
+    "siteMessageRemoveAndResources": "Dette vil permanent slette alle offentlige og private ressurser tilknyttet dette nettstedet, selv om en ressurs også er tilknyttet andre nettsteder.",
    "siteQuestionRemove": "Er du sikker på at du vil fjerne nettstedet fra organisasjonen?",
+    "siteQuestionRemoveAndResources": "Er du sikker på at du vil slette dette nettstedet og alle tilknyttede ressurser?",
+    "sitesTableDeleteSite": "Slett nettsted",
+    "sitesTableDeleteSiteAndResources": "Slett nettsted og ressurser",
    "siteManageSites": "Administrer Områder",
    "siteDescription": "Opprette og administrere nettsteder for å aktivere tilkobling til private nettverk",
    "sitesBannerTitle": "Koble til alle nettverk",
@@ -2338,6 +2344,7 @@
    "createInternalResourceDialogDestinationCidrDescription": "CIDR-rekkevidden til ressursen på nettstedets nettverk.",
    "createInternalResourceDialogAlias": "Alias",
    "createInternalResourceDialogAliasDescription": "Et valgfritt internt DNS-alias for denne ressursen.",
+    "internalResourceAliasLocalWarning": "Alias som slutter på .local kan forårsake oppløsningsproblemer på grunn av mDNS på enkelte nettverk.",
    "internalResourceDownstreamSchemeRequired": "Skjema er påkrevd for HTTP-ressurser",
    "internalResourceHttpPortRequired": "Destinasjonsport er nødvendig for HTTP-ressurser",
    "siteConfiguration": "Konfigurasjon",
@@ -2967,6 +2974,7 @@
    "orgOrDomainIdMissing": "ID for organisasjon eller domene mangler",
    "loadingDNSRecords": "Laster DNS-poster...",
    "olmUpdateAvailableInfo": "En oppdatert versjon av Olm er tilgjengelig. Oppdater til den nyeste versjonen for å få den beste opplevelsen.",
+    "updateAvailableInfo": "En oppdatert versjon er tilgjengelig. Vennligst oppdater til den nyeste versjonen for den beste opplevelsen.",
    "client": "Klient",
    "proxyProtocol": "Protokoll innstillinger for Protokoll",
    "proxyProtocolDescription": "Konfigurer Proxy-protokoll for å bevare klientens IP-adresser til TCP-tjenester.",
--- a/messages/nl-NL.json
+++ b/messages/nl-NL.json
@@ -66,9 +66,15 @@
    "local": "Lokaal",
    "edit": "Bewerken",
    "siteConfirmDelete": "Verwijderen van site bevestigen",
+    "siteConfirmDeleteAndResources": "Bevestig Verwijderen van Site en Bronnen",
    "siteDelete": "Site verwijderen",
+    "siteDeleteAndResources": "Site en Bronnen verwijderen",
    "siteMessageRemove": "Eenmaal verwijderd zal de site niet langer toegankelijk zijn. Alle aan de site gekoppelde doelen zullen ook worden verwijderd.",
+    "siteMessageRemoveAndResources": "Dit zal permanent alle publieke en private resources gekoppeld aan deze site verwijderen, zelfs als een resource ook aan andere sites is gekoppeld.",
    "siteQuestionRemove": "Weet u zeker dat u de site wilt verwijderen uit de organisatie?",
+    "siteQuestionRemoveAndResources": "Weet u zeker dat u deze site en alle gekoppelde resources wilt verwijderen?",
+    "sitesTableDeleteSite": "Site verwijderen",
+    "sitesTableDeleteSiteAndResources": "Site en Bronnen verwijderen",
    "siteManageSites": "Sites beheren",
    "siteDescription": "Maak en beheer sites om verbinding met privénetwerken in te schakelen",
    "sitesBannerTitle": "Verbind elk netwerk",
@@ -2338,6 +2344,7 @@
    "createInternalResourceDialogDestinationCidrDescription": "Het CIDR-bereik van het document op het netwerk van de site.",
    "createInternalResourceDialogAlias": "Alias",
    "createInternalResourceDialogAliasDescription": "Een optionele interne DNS-alias voor dit document.",
+    "internalResourceAliasLocalWarning": "Aliassen die eindigen op .local kunnen resolutieproblemen veroorzaken vanwege mDNS op sommige netwerken.",
    "internalResourceDownstreamSchemeRequired": "Schema is vereist voor HTTP-bronnen",
    "internalResourceHttpPortRequired": "Bestemmingspoort is vereist voor HTTP-bronnen",
    "siteConfiguration": "Configuratie",
@@ -2967,6 +2974,7 @@
    "orgOrDomainIdMissing": "Organisatie of domein ID ontbreekt",
    "loadingDNSRecords": "DNS-records laden...",
    "olmUpdateAvailableInfo": "Er is een bijgewerkte versie van Olm beschikbaar. Update alstublieft naar de nieuwste versie voor de beste ervaring.",
+    "updateAvailableInfo": "Er is een bijgewerkte versie beschikbaar. Update naar de nieuwste versie voor de beste ervaring.",
    "client": "Klant",
    "proxyProtocol": "Proxy Protocol Instellingen",
    "proxyProtocolDescription": "Proxyprotocol configureren om de IP-adressen van de client voor TCP-diensten te bewaren.",
--- a/messages/pl-PL.json
+++ b/messages/pl-PL.json
@@ -66,9 +66,15 @@
    "local": "Lokalny",
    "edit": "Edytuj",
    "siteConfirmDelete": "Potwierdź usunięcie witryny",
+    "siteConfirmDeleteAndResources": "Potwierdź usunięcie witryny i zasobów",
    "siteDelete": "Usuń witrynę",
+    "siteDeleteAndResources": "Usuń witrynę i zasoby",
    "siteMessageRemove": "Po usunięciu witryna nie będzie już dostępna. Wszystkie cele związane z witryną zostaną również usunięte.",
+    "siteMessageRemoveAndResources": "To spowoduje trwałe usunięcie wszystkich zasobów publicznych i prywatnych powiązanych z tą witryną, nawet jeśli zasób jest także powiązany z innymi witrynami.",
    "siteQuestionRemove": "Czy na pewno chcesz usunąć witrynę z organizacji?",
+    "siteQuestionRemoveAndResources": "Czy na pewno chcesz usunąć tę witrynę i wszystkie powiązane zasoby?",
+    "sitesTableDeleteSite": "Usuń witrynę",
+    "sitesTableDeleteSiteAndResources": "Usuń witrynę i zasoby",
    "siteManageSites": "Zarządzaj stronami",
    "siteDescription": "Tworzenie stron i zarządzanie nimi, aby włączyć połączenia z prywatnymi sieciami",
    "sitesBannerTitle": "Połącz dowolną sieć",
@@ -2338,6 +2344,7 @@
    "createInternalResourceDialogDestinationCidrDescription": "Zakres CIDR zasobu w sieci witryny.",
    "createInternalResourceDialogAlias": "Alias",
    "createInternalResourceDialogAliasDescription": "Opcjonalny wewnętrzny alias DNS dla tego zasobu.",
+    "internalResourceAliasLocalWarning": "Alias kończący się na .local może powodować problemy z rozpoznawaniem z powodu mDNS w niektórych sieciach.",
    "internalResourceDownstreamSchemeRequired": "Schemat jest wymagany dla zasobów HTTP",
    "internalResourceHttpPortRequired": "Port docelowy jest wymagany dla zasobów HTTP",
    "siteConfiguration": "Konfiguracja",
@@ -2967,6 +2974,7 @@
    "orgOrDomainIdMissing": "Brakuje identyfikatora organizacji lub domeny",
    "loadingDNSRecords": "Ładowanie rekordów DNS...",
    "olmUpdateAvailableInfo": "Dostępna jest zaktualizowana wersja Olm. Zaktualizuj do najnowszej wersji, aby uzyskać najlepsze doświadczenia.",
+    "updateAvailableInfo": "Dostępna jest zaktualizowana wersja. Zaktualizuj do najnowszej wersji, aby uzyskać najlepsze wrażenia z użytkowania.",
    "client": "Klient",
    "proxyProtocol": "Ustawienia protokołu proxy",
    "proxyProtocolDescription": "Skonfiguruj protokół Proxy aby zachować adresy IP klienta dla usług TCP.",
--- a/messages/pt-PT.json
+++ b/messages/pt-PT.json
@@ -66,9 +66,15 @@
    "local": "Localização",
    "edit": "Alterar",
    "siteConfirmDelete": "Confirmar que pretende apagar o site",
+    "siteConfirmDeleteAndResources": "Confirmar Exclusão do Site e Recursos",
    "siteDelete": "Excluir site",
+    "siteDeleteAndResources": "Excluir Site e Recursos",
    "siteMessageRemove": "Uma vez removido, o site não estará mais acessível. Todas as metas associadas ao site também serão removidas.",
+    "siteMessageRemoveAndResources": "Isso excluirá permanentemente todos os recursos públicos e privados vinculados a este site, mesmo que um recurso também esteja associado a outros sites.",
    "siteQuestionRemove": "Você tem certeza que deseja remover este site da organização?",
+    "siteQuestionRemoveAndResources": "Tem certeza de que deseja excluir este site e todos os recursos associados?",
+    "sitesTableDeleteSite": "Excluir Site",
+    "sitesTableDeleteSiteAndResources": "Excluir Site e Recursos",
    "siteManageSites": "Gerir sites",
    "siteDescription": "Criar e gerenciar sites para ativar a conectividade a redes privadas",
    "sitesBannerTitle": "Conectar a Qualquer Rede",
@@ -2338,6 +2344,7 @@
    "createInternalResourceDialogDestinationCidrDescription": "A faixa CIDR do recurso na rede do site.",
    "createInternalResourceDialogAlias": "Alias",
    "createInternalResourceDialogAliasDescription": "Um alias de DNS interno opcional para este recurso.",
+    "internalResourceAliasLocalWarning": "Os aliases terminando em .local podem causar problemas de resolução devido ao mDNS em algumas redes.",
    "internalResourceDownstreamSchemeRequired": "Esquema é obrigatório para recursos HTTP",
    "internalResourceHttpPortRequired": "Porta de destino é obrigatória para recursos HTTP",
    "siteConfiguration": "Configuração",
@@ -2967,6 +2974,7 @@
    "orgOrDomainIdMissing": "ID da organização ou domínio está faltando",
    "loadingDNSRecords": "Carregando registros DNS...",
    "olmUpdateAvailableInfo": "Uma versão atualizada do Olm está disponível. Atualize para a versão mais recente para ter a melhor experiência.",
+    "updateAvailableInfo": "Uma versão atualizada está disponível. Por favor, atualize para a versão mais recente para uma melhor experiência.",
    "client": "Cliente",
    "proxyProtocol": "Configurações de Protocolo Proxy",
    "proxyProtocolDescription": "Configurar o protocolo proxy para preservar endereços IP do cliente para serviços TCP.",
--- a/messages/ru-RU.json
+++ b/messages/ru-RU.json
@@ -66,9 +66,15 @@
    "local": "Локальный",
    "edit": "Редактировать",
    "siteConfirmDelete": "Подтвердить удаление сайта",
+    "siteConfirmDeleteAndResources": "Подтвердите удаление сайта и ресурсов",
    "siteDelete": "Удалить сайт",
+    "siteDeleteAndResources": "Удалить сайт и ресурсы",
    "siteMessageRemove": "После удаления сайт больше не будет доступен. Все цели, связанные с сайтом, также будут удалены.",
+    "siteMessageRemoveAndResources": "Это навсегда удалит все общественные и частные ресурсы, связанные с этим сайтом, даже если ресурс также связан с другими сайтами.",
    "siteQuestionRemove": "Вы уверены, что хотите удалить сайт из организации?",
+    "siteQuestionRemoveAndResources": "Вы уверены, что хотите удалить этот сайт и все связанные с ним ресурсы?",
+    "sitesTableDeleteSite": "Удалить сайт",
+    "sitesTableDeleteSiteAndResources": "Удалить сайт и ресурсы",
    "siteManageSites": "Управление сайтами",
    "siteDescription": "Создание и управление сайтами, чтобы включить подключение к приватным сетям",
    "sitesBannerTitle": "Подключить любую сеть",
@@ -2338,6 +2344,7 @@
    "createInternalResourceDialogDestinationCidrDescription": "Диапазон CIDR ресурса в сети сайта.",
    "createInternalResourceDialogAlias": "Alias",
    "createInternalResourceDialogAliasDescription": "Дополнительный внутренний DNS псевдоним для этого ресурса.",
+    "internalResourceAliasLocalWarning": "Псевдонимы, оканчивающиеся на .local, могут вызывать проблемы с разрешением из-за mDNS в некоторых сетях.",
    "internalResourceDownstreamSchemeRequired": "Схема обязательна для HTTP ресурсов",
    "internalResourceHttpPortRequired": "Порт назначения обязателен для HTTP ресурсов",
    "siteConfiguration": "Конфигурация",
@@ -2967,6 +2974,7 @@
    "orgOrDomainIdMissing": "Отсутствует организация или ID домена",
    "loadingDNSRecords": "Загрузка записей DNS...",
    "olmUpdateAvailableInfo": "Доступна обновленная версия Олма. Пожалуйста, обновитесь до последней версии.",
+    "updateAvailableInfo": "Доступна обновленная версия. Пожалуйста, обновитесь до последней версии для получения лучшего опыта.",
    "client": "Клиент",
    "proxyProtocol": "Настройки протокола прокси",
    "proxyProtocolDescription": "Настроить Прокси-протокол для сохранения IP-адресов клиента для служб TCP.",
--- a/messages/tr-TR.json
+++ b/messages/tr-TR.json
@@ -66,9 +66,15 @@
    "local": "Yerel",
    "edit": "Düzenle",
    "siteConfirmDelete": "Site Silmeyi Onayla",
+    "siteConfirmDeleteAndResources": "Site ve Kaynakları Silmeyi Onayla",
    "siteDelete": "Siteyi Sil",
+    "siteDeleteAndResources": "Site ve Kaynakları Sil",
    "siteMessageRemove": "Kaldırıldıktan sonra site artık erişilebilir olmayacaktır. Siteyle ilişkilendirilmiş tüm hedefler de kaldırılacaktır.",
+    "siteMessageRemoveAndResources": "Bu işlem, diğer sitelerle de ilişkilendirilmiş olsa bile, bu siteye bağlı tüm genel ve özel kaynakları kalıcı olarak silecektir.",
    "siteQuestionRemove": "Siteyi organizasyondan kaldırmak istediğinizden emin misiniz?",
+    "siteQuestionRemoveAndResources": "Bu siteyi ve tüm ilişkili kaynakları silmek istediğinizden emin misiniz?",
+    "sitesTableDeleteSite": "Siteyi Sil",
+    "sitesTableDeleteSiteAndResources": "Site ve Kaynakları Sil",
    "siteManageSites": "Siteleri Yönet",
    "siteDescription": "Özel ağlara erişimi etkinleştirmek için siteler oluşturun ve yönetin",
    "sitesBannerTitle": "Herhangi Bir Ağa Bağlan",
@@ -2338,6 +2344,7 @@
    "createInternalResourceDialogDestinationCidrDescription": "Site ağındaki kaynağın CIDR aralığı.",
    "createInternalResourceDialogAlias": "Takma Ad",
    "createInternalResourceDialogAliasDescription": "Bu kaynak için isteğe bağlı dahili DNS takma adı.",
+    "internalResourceAliasLocalWarning": "Bazı ağlarda mDNS nedeniyle .local ile biten takma adlar çözümleme sorunlarına neden olabilir.",
    "internalResourceDownstreamSchemeRequired": "HTTP kaynakları için şema gereklidir",
    "internalResourceHttpPortRequired": "HTTP kaynakları için hedef bağlantı noktası gereklidir",
    "siteConfiguration": "Yapılandırma",
@@ -2967,6 +2974,7 @@
    "orgOrDomainIdMissing": "Organizasyon veya Alan Adı Kimliği eksik",
    "loadingDNSRecords": "DNS kayıtları yükleniyor...",
    "olmUpdateAvailableInfo": "Olm'nin güncellenmiş bir sürümü mevcut. En iyi deneyim için lütfen en son sürüme güncelleyin.",
+    "updateAvailableInfo": "Güncellenmiş bir sürüm mevcut. En iyi deneyim için lütfen en son sürüme güncelleyin.",
    "client": "İstemci",
    "proxyProtocol": "Proxy Protokol Ayarları",
    "proxyProtocolDescription": "TCP hizmetleri için istemci IP adreslerini korumak amacıyla Proxy Protokolünü yapılandırın.",
--- a/messages/zh-CN.json
+++ b/messages/zh-CN.json
@@ -17,7 +17,7 @@
    "componentsErrorNoMemberCreate": "您目前不是任何组织的成员。创建组织以开始操作。",
    "componentsErrorNoMember": "您目前不是任何组织的成员。",
    "welcome": "欢迎使用 Pangolin",
-    "welcomeTo": "欢迎来到",
+    "welcomeTo": "欢迎使用",
    "componentsCreateOrg": "创建组织",
    "componentsMember": "您属于{count, plural, =0 {没有组织} one {一个组织} other {# 个组织}}。",
    "componentsInvalidKey": "检测到无效或过期的许可证密钥。按照许可证条款操作以继续使用所有功能。",
@@ -35,7 +35,7 @@
    "trialDaysRemaining": "{count, plural, other {# 天剩余}}",
    "trialDaysLeftShort": "试用期剩余 {days} 天",
    "trialGoToBilling": "转到账单页面",
-    "subscriptionViolationViewBilling": "查看计费",
+    "subscriptionViolationViewBilling": "查看账单",
    "componentsLicenseViolation": "许可证超限：该服务器使用了 {usedSites} 个站点，已超过授权的 {maxSites} 个。请遵守许可证条款以继续使用全部功能。",
    "componentsSupporterMessage": "感谢您的支持！您现在是 Pangolin 的 {tier} 用户。",
    "inviteErrorNotValid": "很抱歉，但看起来你试图访问的邀请尚未被接受或不再有效。",
@@ -58,21 +58,27 @@
    "name": "名称",
    "online": "在线",
    "offline": "离线的",
-    "site": "站点",
+    "site": "节点",
    "dataIn": "数据输入",
    "dataOut": "数据输出",
    "connectionType": "连接类型",
    "tunnelType": "隧道类型",
    "local": "本地的",
    "edit": "编辑",
-    "siteConfirmDelete": "确认删除站点",
-    "siteDelete": "删除站点",
-    "siteMessageRemove": "一旦移除，站点将无法访问。与站点相关的所有目标也将被移除。",
-    "siteQuestionRemove": "您确定要从组织中删除该站点吗？",
+    "siteConfirmDelete": "确认删除节点",
+    "siteConfirmDeleteAndResources": "确认删除站点及资源",
+    "siteDelete": "删除节点",
+    "siteDeleteAndResources": "删除站点及资源",
+    "siteMessageRemove": "一旦移除，节点将无法访问。与节点相关的所有目标也将被移除。",
+    "siteMessageRemoveAndResources": "这将永久删除与该站点关联的所有公共和私人资源，即使资源也与其他站点相关联。",
+    "siteQuestionRemove": "您确定要从组织中删除该节点吗？",
+    "siteQuestionRemoveAndResources": "您确定要删除此站点及所有关联资源吗？",
+    "sitesTableDeleteSite": "删除站点",
+    "sitesTableDeleteSiteAndResources": "删除站点及资源",
    "siteManageSites": "管理站点",
    "siteDescription": "创建和管理站点，启用与私人网络的连接",
    "sitesBannerTitle": "连接任何网络",
-    "sitesBannerDescription": "站点是连接到远程网络的链接，允许Pangolin为用户提供资源访问，无论是公共还是私人。可以在任何可以运行二进制文件或容器的地方安装站点网络连接器（Newt）以建立连接。",
+    "sitesBannerDescription": "站点是到远程网络的连接，使 Pangolin 能够向任何位置的用户提提供公共或私有的资源访问。你可以在任何能够运行二进制文件或容器的地方安装站点网络连接器（Newt），以建立连接。",
    "sitesBannerButtonText": "安装站点",
    "approvalsBannerTitle": "批准或拒绝设备访问",
    "approvalsBannerDescription": "审核、批准或拒绝用户的设备访问请求。 当需要设备批准时，用户必须先获得管理员批准，然后他们的设备才能连接到您的组织资源。",
@@ -134,7 +140,7 @@
    "siteResourcesHowToAccess": "如何访问",
    "siteResourcesTargetsOnSite": "此站点上的目标",
    "siteSetting": "{siteName} 设置",
-    "siteNewtTunnel": "新站点 (推荐)",
+    "siteNewtTunnel": "新节点 (推荐)",
    "siteNewtTunnelDescription": "最简单的方式来创建任何网络的入口。没有额外的设置。",
    "siteWg": "基本 WireGuard",
    "siteWgDescription": "使用任何 WireGuard 客户端来建立隧道。需要手动配置 NAT。",
@@ -143,23 +149,23 @@
    "siteLocalDescriptionSaas": "仅本地资源。没有隧道。仅在远程节点上可用。",
    "siteSeeAll": "查看所有站点",
    "siteTunnelDescription": "确定如何连接到站点",
-    "siteNewtCredentials": "全权证书",
-    "siteNewtCredentialsDescription": "站点如何通过服务器进行身份验证",
+    "siteNewtCredentials": "凭证",
+    "siteNewtCredentialsDescription": "节点如何与服务器进行身份验证",
    "remoteNodeCredentialsDescription": "这是远程节点如何与服务器进行身份验证",
    "siteCredentialsSave": "保存证书",
    "siteCredentialsSaveDescription": "您只能看到一次。请确保将其复制并保存到一个安全的地方。",
    "siteInfo": "站点信息",
    "status": "状态",
-    "shareTitle": "管理可共享链接",
+    "shareTitle": "管理共享链接",
    "shareDescription": "创建可共享的链接，允许临时或永久访问代理资源",
-    "shareSearch": "搜索可共享链接……",
-    "shareCreate": "创建可共享链接",
+    "shareSearch": "搜索共享链接……",
+    "shareCreate": "创建共享链接",
    "shareErrorDelete": "删除链接失败",
    "shareErrorDeleteMessage": "删除链接时出错",
    "shareDeleted": "链接已删除",
    "shareDeletedDescription": "链接已删除",
-    "shareDelete": "删除可共享链接",
-    "shareDeleteConfirm": "确认删除可共享链接",
+    "shareDelete": "删除共享链接",
+    "shareDeleteConfirm": "确认删除共享链接",
    "shareQuestionRemove": "您确定要删除这个共享链接吗？",
    "shareMessageRemove": "删除后，该链接将不再可用，使用它的任何人将失去对资源的访问权限。",
    "shareTokenDescription": "访问令牌可以通过两种方式传递：作为查询参数或请求标题。 每次验证访问请求都必须从客户端传递。",
@@ -204,11 +210,11 @@
    "proxyResourceTitle": "管理公共资源",
    "proxyResourceDescription": "创建和管理可通过 Web 浏览器公开访问的资源",
    "publicResourcesBannerTitle": "基于 Web 的公共访问",
-    "publicResourcesBannerDescription": "公共资源是 HTTPS 代理，可以通过网络浏览器在互联网上的任何人访问。与私人资源不同，它们不需要客户端软件，并且可以包含身份和上下文感知的访问策略。",
+    "publicResourcesBannerDescription": "公共资源是 HTTPS 代理，可供互联网上的任何人通过 Web 浏览器访问。与私人资源不同，它们不需要客户端软件，并且可以包含身份和上下文感知的访问策略。",
    "clientResourceTitle": "管理私有资源",
    "clientResourceDescription": "创建和管理只能通过连接客户端访问的资源",
-    "privateResourcesBannerTitle": "零信任的私人访问",
-    "privateResourcesBannerDescription": "私人资源使用零信任安全性，确保只允许明确授予的用户和机器访问资源。可以连接用户设备或机器客户端，通过安全的虚拟专用网络访问这些资源。",
+    "privateResourcesBannerTitle": "零信任私有访问",
+    "privateResourcesBannerDescription": "私有资源采用零信任安全机制，确保只有获得明确授权的用户和机器才能访问。用户设备或机器客户端连接后，即可通过安全的虚拟专用网络访问这些资源。",
    "resourcesSearch": "搜索资源...",
    "resourceAdd": "添加资源",
    "resourceErrorDelte": "删除资源时出错",
@@ -327,7 +333,7 @@
    "passToAuth": "传递至认证",
    "orgSettingsDescription": "配置组织设置",
    "orgGeneralSettings": "组织设置",
-    "orgGeneralSettingsDescription": "管理机构的详细信息和配置",
+    "orgGeneralSettingsDescription": "管理组织的详细信息和配置",
    "saveGeneralSettings": "保存常规设置",
    "saveSettings": "保存设置",
    "orgDangerZone": "危险区域",
@@ -381,7 +387,7 @@
    "accessApprovalsDescription": "查看和管理待审批的组织访问权限",
    "description": "描述",
    "inviteTitle": "打开邀请",
-    "inviteDescription": "管理其他用户加入机构的邀请",
+    "inviteDescription": "管理其他用户加入组织的邀请",
    "inviteSearch": "搜索邀请...",
    "minutes": "分钟",
    "hours": "小时",
@@ -425,24 +431,24 @@
    "apiKeysDelete": "删除 API 密钥",
    "apiKeysManage": "管理 API 密钥",
    "apiKeysDescription": "API 密钥用于认证集成 API",
-    "provisioningKeysTitle": "置备密钥",
-    "provisioningKeysManage": "管理置备键",
+    "provisioningKeysTitle": "预配密钥",
+    "provisioningKeysManage": "管理预配密钥",
    "provisioningKeysDescription": "置备密钥用于验证您组织的自动站点配置。",
-    "provisioningManage": "置备中",
-    "provisioningDescription": "管理预配键和审查等待批准的站点。",
-    "pendingSites": "待定站点",
+    "provisioningManage": "预配",
+    "provisioningDescription": "管理预配密钥，并审核待批准的站点。",
+    "pendingSites": "待审批站点",
    "siteApproveSuccess": "站点批准成功",
    "siteApproveError": "批准站点出错",
    "provisioningKeys": "置备键",
    "searchProvisioningKeys": "搜索配备密钥...",
-    "provisioningKeysAdd": "生成置备键",
+    "provisioningKeysAdd": "生成预配密钥",
    "provisioningKeysErrorDelete": "删除预配键时出错",
    "provisioningKeysErrorDeleteMessage": "删除预配键时出错",
    "provisioningKeysQuestionRemove": "您确定要从组织中删除此预配键吗？",
    "provisioningKeysMessageRemove": "一旦移除，密钥不能再用于站点预配。",
    "provisioningKeysDeleteConfirm": "确认删除置备键",
    "provisioningKeysDelete": "删除置备键",
-    "provisioningKeysCreate": "生成置备键",
+    "provisioningKeysCreate": "生成预配密钥",
    "provisioningKeysCreateDescription": "为组织生成一个新的预置密钥",
    "provisioningKeysSeeAll": "查看所有预配键",
    "provisioningKeysSave": "保存预配键",
@@ -462,16 +468,16 @@
    "provisioningKeysNeverUsed": "永不过期",
    "provisioningKeysEdit": "编辑置备键",
    "provisioningKeysEditDescription": "更新此密钥的最大批量大小和过期时间。",
-    "provisioningKeysApproveNewSites": "批准新站点",
-    "provisioningKeysApproveNewSitesDescription": "自动批准使用此密钥注册的站点。",
+    "provisioningKeysApproveNewSites": "批准新节点",
+    "provisioningKeysApproveNewSitesDescription": "自动批准使用此密钥注册的节点。",
    "provisioningKeysUpdateError": "更新预配键时出错",
    "provisioningKeysUpdated": "置备密钥已更新",
    "provisioningKeysUpdatedDescription": "您的更改已保存。",
-    "provisioningKeysBannerTitle": "站点置备密钥",
-    "provisioningKeysBannerDescription": "生成一个供应密钥，并将其与 Newt 连接器一起使用，以在首次启动时自动创建站点 - 无需为每个站点设置单独的凭据。",
+    "provisioningKeysBannerTitle": "站点预配密钥",
+    "provisioningKeysBannerDescription": "生成预配密钥，并将其与 Newt 连接器配合使用，即可在首次启动时自动创建站点，无需为每个站点单独配置凭据。",
    "provisioningKeysBannerButtonText": "了解更多",
-    "pendingSitesBannerTitle": "待定站点",
-    "pendingSitesBannerDescription": "使用供应密钥连接的站点将在此显示以供审核。",
+    "pendingSitesBannerTitle": "待审批站点",
+    "pendingSitesBannerDescription": "使用预配密钥连接的网站会在这里以供审核。",
    "pendingSitesBannerButtonText": "了解更多",
    "apiKeysSettings": "{apiKeyName} 设置",
    "userTitle": "管理所有用户",
@@ -883,11 +889,11 @@
    "resourcesErrorUpdateDescription": "更新资源时出错",
    "access": "访问权限",
    "accessControl": "访问控制",
-    "shareLink": "{resource} 可共享链接",
+    "shareLink": "{resource} 的共享链接",
    "resourceSelect": "选择资源",
-    "shareLinks": "可共享链接",
+    "shareLinks": "共享链接",
    "share": "分享链接",
-    "shareDescription2": "创建资源的可共享链接。链接提供了对您资源的临时或无限制访问。 当您创建链接时，您可以配置链接的到期时间。",
+    "shareDescription2": "创建资源的共享链接。链接提供了对您资源的临时或无限制访问。 当您创建链接时，您可以配置链接的到期时间。",
    "shareEasyCreate": "轻松创建和分享",
    "shareConfigurableExpirationDuration": "可配置的过期时间",
    "shareSecureAndRevocable": "安全和可撤销的",
@@ -1059,7 +1065,7 @@
    "network": "网络",
    "manage": "管理",
    "sitesNotFound": "未找到站点。",
-    "pangolinServerAdmin": "服务器管理员 - Pangolin",
+    "pangolinServerAdmin": "服务器管理 - Pangolin",
    "licenseTierProfessional": "专业许可证",
    "licenseTierEnterprise": "企业许可证",
    "licenseTierPersonal": "个人许可证",
@@ -1366,7 +1372,7 @@
    "supportKeyBuy": "购买支持者密钥",
    "logoutError": "注销错误",
    "signingAs": "登录为",
-    "serverAdmin": "服务器管理员",
+    "serverAdmin": "服务器管理",
    "managedSelfhosted": "托管自托管",
    "otpEnable": "启用双因子认证",
    "otpDisable": "禁用双因子认证",
@@ -1536,8 +1542,8 @@
    "sidebarSites": "站点",
    "sidebarApprovals": "审批请求",
    "sidebarResources": "资源",
-    "sidebarProxyResources": "公开的",
-    "sidebarClientResources": "非公开的",
+    "sidebarProxyResources": "公开资源",
+    "sidebarClientResources": "私有资源",
    "sidebarPolicies": "共享策略",
    "sidebarResourcePolicies": "公共资源",
    "sidebarAccessControl": "访问控制",
@@ -1547,17 +1553,17 @@
    "sidebarAdmin": "管理员",
    "sidebarInvitations": "邀请",
    "sidebarRoles": "角色",
-    "sidebarShareableLinks": "可共享链接",
+    "sidebarShareableLinks": "共享链接",
    "sidebarApiKeys": "API密钥",
-    "sidebarProvisioning": "置备中",
+    "sidebarProvisioning": "预配",
    "sidebarSettings": "设置",
    "sidebarAllUsers": "所有用户",
    "sidebarIdentityProviders": "身份提供商",
    "sidebarLicense": "证书",
    "sidebarClients": "客户端",
    "sidebarUserDevices": "用户设备",
-    "sidebarMachineClients": "机",
-    "sidebarDomains": "域",
+    "sidebarMachineClients": "机器身份",
+    "sidebarDomains": "域名",
    "sidebarGeneral": "管理",
    "sidebarLogAndAnalytics": "日志与分析",
    "sidebarBluePrints": "蓝图",
@@ -1689,8 +1695,8 @@
    "alertingTabHealthChecks": "健康检查",
    "alertingRulesBannerTitle": "获取通知",
    "alertingRulesBannerDescription": "每条规则都连接要监视的对象（站点、健康检查或资源），触发时间（例如离线或不健康），以及如何通过电子邮件、Webhooks 或集成将通知发送给团队。使用此列表创建、启用和管理这些规则。",
-    "alertingHealthChecksBannerTitle": "监视健康和资源",
-    "alertingHealthChecksBannerDescription": "健康检查是您一次定义的 HTTP 或 TCP 监控。然后可以将它们用作告警规则中的来源，以便目标变得正常或不正常时得到通知。资源上的健康检查也会出现在此处。",
+    "alertingHealthChecksBannerTitle": "资源与健康监控",
+    "alertingHealthChecksBannerDescription": "通过 HTTP 或 TCP 检查目标状态，并在服务异常或恢复时发送通知。资源中配置的健康检查也会显示在这里。",
    "standaloneHcTableTitle": "健康检查",
    "standaloneHcSearchPlaceholder": "搜索健康检查…",
    "standaloneHcAddButton": "创建健康检查",
@@ -1791,17 +1797,17 @@
    "theme": "主题",
    "subnetRequired": "子网是必填项",
    "initialSetupTitle": "初始服务器设置",
-    "initialSetupDescription": "创建初始服务器管理员帐户。 只能存在一个服务器管理员。 您可以随时更改这些凭据。",
+    "initialSetupDescription": "创建初始的管理员帐户。 只能存在一个服务器管理员。 您可以随时更改这些凭据。",
    "createAdminAccount": "创建管理员帐户",
-    "setupErrorCreateAdmin": "创建服务器管理员账户时发生错误。",
+    "setupErrorCreateAdmin": "创建管理员账户时发生错误。",
    "certificateStatus": "证书",
    "certificateStatusAutoRefreshHint": "状态自动刷新。",
    "loading": "加载中",
    "loadingEllipsis": "加载中……",
    "loadingAnalytics": "加载分析",
    "restart": "重启",
-    "domains": "域",
-    "domainsDescription": "创建和管理组织中可用的域",
+    "domains": "域名",
+    "domainsDescription": "创建和管理组织中可用的域名",
    "domainsSearch": "搜索域...",
    "domainAdd": "添加域",
    "domainAddDescription": "注册一个新域名到组织",
@@ -2165,12 +2171,12 @@
    "sshSudoMode": "Sudo 访问",
    "sshSudoModeNone": "无",
    "sshSudoModeNoneDescription": "用户不能用sudo运行命令。",
-    "sshSudoModeFull": "全苏多",
+    "sshSudoModeFull": "完整 Sudo 权限",
    "sshSudoModeFullDescription": "用户可以用 sudo 运行任何命令。",
    "sshSudoModeCommands": "命令",
    "sshSudoModeCommandsDescription": "用户只能用 sudo 运行指定的命令。",
    "sshSudo": "允许Sudo",
-    "sshSudoCommands": "Sudo 命令",
+    "sshSudoCommands": "可用 Sudo 命令",
    "sshSudoCommandsDescription": "用户可以使用 sudo 运行的命令列表，以逗号、空格或新行分隔。必须使用绝对路径。",
    "sshCreateHomeDir": "创建主目录",
    "sshUnixGroups": "Unix 组",
@@ -2183,7 +2189,7 @@
    "roleTextImportAppend": "附加到现有",
    "roleTextImportMode": "导入模式",
    "roleTextImportPreview": "预览",
-    "roleTextImportItemCount": "{count, plural, =0 {No items to import} one {1 item to import} other {# items to import}}",
+    "roleTextImportItemCount": "{count, plural, =0 {没有可导入的项目} one {1 个可导入项目} other {# 个可导入项目}}",
    "roleTextImportTotalCount": "{existing} 个现有 + {imported} 个导入 = {total} 个总计",
    "roleTextImportConfirm": "导入",
    "roleTextImportInvalidFile": "不支持的文件类型",
@@ -2235,8 +2241,8 @@
    "resourceEditDomain": "编辑域名",
    "siteName": "站点名称",
    "proxyPort": "端口",
-    "resourcesTableProxyResources": "公开的",
-    "resourcesTableClientResources": "非公开的",
+    "resourcesTableProxyResources": "",
+    "resourcesTableClientResources": "私有资源",
    "resourcesTableNoProxyResourcesFound": "未找到代理资源。",
    "resourcesTableNoInternalResourcesFound": "未找到内部资源。",
    "resourcesTableDestination": "目标",
@@ -2338,6 +2344,7 @@
    "createInternalResourceDialogDestinationCidrDescription": "站点网络上资源的 CIDR 范围。",
    "createInternalResourceDialogAlias": "Alias",
    "createInternalResourceDialogAliasDescription": "此资源可选的内部DNS别名。",
+    "internalResourceAliasLocalWarning": "以 .local 结尾的别名可能会因某些网络上的 mDNS 而导致解析问题。",
    "internalResourceDownstreamSchemeRequired": "HTTP 资源需要方案",
    "internalResourceHttpPortRequired": "HTTP 资源需要目的端口",
    "siteConfiguration": "配置",
@@ -2925,7 +2932,7 @@
    "logRetentionRequestDescription": "保留请求日志的时间",
    "logRetentionAccessLabel": "访问日志保留",
    "logRetentionAccessDescription": "保留访问日志的时间",
-    "logRetentionActionLabel": "动作日志保留",
+    "logRetentionActionLabel": "审计日志保留",
    "logRetentionActionDescription": "保留操作日志的时间",
    "logRetentionConnectionLabel": "连接日志保留",
    "logRetentionConnectionDescription": "保留连接日志的时间",
@@ -2938,11 +2945,11 @@
    "logRetentionForever": "永远的",
    "logRetentionEndOfFollowingYear": "下一年结束",
    "actionLogsDescription": "查看此机构执行的操作历史",
-    "accessLogsDescription": "查看此机构资源的访问认证请求",
+    "accessLogsDescription": "查看此组织资源的访问认证请求",
    "connectionLogs": "连接日志",
    "connectionLogsDescription": "查看此机构隧道的连接日志",
    "sidebarLogsConnection": "连接日志",
-    "sidebarLogsStreaming": "流流",
+    "sidebarLogsStreaming": "事件流",
    "sourceAddress": "源地址",
    "destinationAddress": "目的地址",
    "duration": "期限",
@@ -2967,6 +2974,7 @@
    "orgOrDomainIdMissing": "缺少机构或域 ID",
    "loadingDNSRecords": "正在载入DNS记录...",
    "olmUpdateAvailableInfo": "有最新版本的 Olm 可用。请更新到最新版本以获取最佳体验。",
+    "updateAvailableInfo": "有新版本可用。请更新到最新版本以获得最佳体验。",
    "client": "客户端：",
    "proxyProtocol": "代理协议设置",
    "proxyProtocolDescription": "配置代理协议以保留TCP服务的客户端 IP 地址。",
--- a/package-lock.json
+++ b/package-lock.json
@@ -70,7 +70,7 @@
                "input-otp": "1.4.2",
                "ioredis": "5.11.0",
                "jmespath": "0.16.0",
-                "js-yaml": "4.1.1",
+                "js-yaml": "4.2.0",
                "jsonwebtoken": "9.0.3",
                "lucide-react": "1.17.0",
                "maxmind": "5.0.6",
@@ -80,7 +80,7 @@
                "next-themes": "0.4.6",
                "nextjs-toploader": "3.9.17",
                "node-cache": "5.1.2",
-                "nodemailer": "8.0.9",
+                "nodemailer": "9.0.1",
                "oslo": "1.2.1",
                "pg": "8.21.0",
                "posthog-node": "5.35.6",
@@ -142,7 +142,7 @@
                "@types/yargs": "17.0.35",
                "babel-plugin-react-compiler": "1.0.0",
                "drizzle-kit": "0.31.10",
-                "esbuild": "0.28.0",
+                "esbuild": "0.28.1",
                "esbuild-node-externals": "1.22.0",
                "eslint": "10.4.0",
                "eslint-config-next": "16.2.6",
@@ -1248,9 +1248,9 @@
            }
        },
        "node_modules/@esbuild/aix-ppc64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.0.tgz",
-            "integrity": "sha512-lhRUCeuOyJQURhTxl4WkpFTjIsbDayJHih5kZC1giwE+MhIzAb7mEsQMqMf18rHLsrb5qI1tafG20mLxEWcWlA==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz",
+            "integrity": "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==",
            "cpu": [
                "ppc64"
            ],
@@ -1265,9 +1265,9 @@
            }
        },
        "node_modules/@esbuild/android-arm": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.0.tgz",
-            "integrity": "sha512-wqh0ByljabXLKHeWXYLqoJ5jKC4XBaw6Hk08OfMrCRd2nP2ZQ5eleDZC41XHyCNgktBGYMbqnrJKq/K/lzPMSQ==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.1.tgz",
+            "integrity": "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==",
            "cpu": [
                "arm"
            ],
@@ -1282,9 +1282,9 @@
            }
        },
        "node_modules/@esbuild/android-arm64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.0.tgz",
-            "integrity": "sha512-+WzIXQOSaGs33tLEgYPYe/yQHf0WTU0X42Jca3y8NWMbUVhp7rUnw+vAsRC/QiDrdD31IszMrZy+qwPOPjd+rw==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.1.tgz",
+            "integrity": "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==",
            "cpu": [
                "arm64"
            ],
@@ -1299,9 +1299,9 @@
            }
        },
        "node_modules/@esbuild/android-x64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.0.tgz",
-            "integrity": "sha512-+VJggoaKhk2VNNqVL7f6S189UzShHC/mR9EE8rDdSkdpN0KflSwWY/gWjDrNxxisg8Fp1ZCD9jLMo4m0OUfeUA==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.1.tgz",
+            "integrity": "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==",
            "cpu": [
                "x64"
            ],
@@ -1316,9 +1316,9 @@
            }
        },
        "node_modules/@esbuild/darwin-arm64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.0.tgz",
-            "integrity": "sha512-0T+A9WZm+bZ84nZBtk1ckYsOvyA3x7e2Acj1KdVfV4/2tdG4fzUp91YHx+GArWLtwqp77pBXVCPn2We7Letr0Q==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.1.tgz",
+            "integrity": "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==",
            "cpu": [
                "arm64"
            ],
@@ -1333,9 +1333,9 @@
            }
        },
        "node_modules/@esbuild/darwin-x64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.0.tgz",
-            "integrity": "sha512-fyzLm/DLDl/84OCfp2f/XQ4flmORsjU7VKt8HLjvIXChJoFFOIL6pLJPH4Yhd1n1gGFF9mPwtlN5Wf82DZs+LQ==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.1.tgz",
+            "integrity": "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==",
            "cpu": [
                "x64"
            ],
@@ -1350,9 +1350,9 @@
            }
        },
        "node_modules/@esbuild/freebsd-arm64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.0.tgz",
-            "integrity": "sha512-l9GeW5UZBT9k9brBYI+0WDffcRxgHQD8ShN2Ur4xWq/NFzUKm3k5lsH4PdaRgb2w7mI9u61nr2gI2mLI27Nh3Q==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.1.tgz",
+            "integrity": "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==",
            "cpu": [
                "arm64"
            ],
@@ -1367,9 +1367,9 @@
            }
        },
        "node_modules/@esbuild/freebsd-x64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.0.tgz",
-            "integrity": "sha512-BXoQai/A0wPO6Es3yFJ7APCiKGc1tdAEOgeTNy3SsB491S3aHn4S4r3e976eUnPdU+NbdtmBuLncYir2tMU9Nw==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.1.tgz",
+            "integrity": "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==",
            "cpu": [
                "x64"
            ],
@@ -1384,9 +1384,9 @@
            }
        },
        "node_modules/@esbuild/linux-arm": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.0.tgz",
-            "integrity": "sha512-CjaaREJagqJp7iTaNQjjidaNbCKYcd4IDkzbwwxtSvjI7NZm79qiHc8HqciMddQ6CKvJT6aBd8lO9kN/ZudLlw==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.1.tgz",
+            "integrity": "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==",
            "cpu": [
                "arm"
            ],
@@ -1401,9 +1401,9 @@
            }
        },
        "node_modules/@esbuild/linux-arm64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.0.tgz",
-            "integrity": "sha512-RVyzfb3FWsGA55n6WY0MEIEPURL1FcbhFE6BffZEMEekfCzCIMtB5yyDcFnVbTnwk+CLAgTujmV/Lgvih56W+A==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.1.tgz",
+            "integrity": "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==",
            "cpu": [
                "arm64"
            ],
@@ -1418,9 +1418,9 @@
            }
        },
        "node_modules/@esbuild/linux-ia32": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.0.tgz",
-            "integrity": "sha512-KBnSTt1kxl9x70q+ydterVdl+Cn0H18ngRMRCEQfrbqdUuntQQ0LoMZv47uB97NljZFzY6HcfqEZ2SAyIUTQBQ==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.1.tgz",
+            "integrity": "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==",
            "cpu": [
                "ia32"
            ],
@@ -1435,9 +1435,9 @@
            }
        },
        "node_modules/@esbuild/linux-loong64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.0.tgz",
-            "integrity": "sha512-zpSlUce1mnxzgBADvxKXX5sl8aYQHo2ezvMNI8I0lbblJtp8V4odlm3Yzlj7gPyt3T8ReksE6bK+pT3WD+aJRg==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.1.tgz",
+            "integrity": "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==",
            "cpu": [
                "loong64"
            ],
@@ -1452,9 +1452,9 @@
            }
        },
        "node_modules/@esbuild/linux-mips64el": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.0.tgz",
-            "integrity": "sha512-2jIfP6mmjkdmeTlsX/9vmdmhBmKADrWqN7zcdtHIeNSCH1SqIoNI63cYsjQR8J+wGa4Y5izRcSHSm8K3QWmk3w==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.1.tgz",
+            "integrity": "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==",
            "cpu": [
                "mips64el"
            ],
@@ -1469,9 +1469,9 @@
            }
        },
        "node_modules/@esbuild/linux-ppc64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.0.tgz",
-            "integrity": "sha512-bc0FE9wWeC0WBm49IQMPSPILRocGTQt3j5KPCA8os6VprfuJ7KD+5PzESSrJ6GmPIPJK965ZJHTUlSA6GNYEhg==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.1.tgz",
+            "integrity": "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==",
            "cpu": [
                "ppc64"
            ],
@@ -1486,9 +1486,9 @@
            }
        },
        "node_modules/@esbuild/linux-riscv64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.0.tgz",
-            "integrity": "sha512-SQPZOwoTTT/HXFXQJG/vBX8sOFagGqvZyXcgLA3NhIqcBv1BJU1d46c0rGcrij2B56Z2rNiSLaZOYW5cUk7yLQ==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.1.tgz",
+            "integrity": "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==",
            "cpu": [
                "riscv64"
            ],
@@ -1503,9 +1503,9 @@
            }
        },
        "node_modules/@esbuild/linux-s390x": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.0.tgz",
-            "integrity": "sha512-SCfR0HN8CEEjnYnySJTd2cw0k9OHB/YFzt5zgJEwa+wL/T/raGWYMBqwDNAC6dqFKmJYZoQBRfHjgwLHGSrn3Q==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.1.tgz",
+            "integrity": "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==",
            "cpu": [
                "s390x"
            ],
@@ -1520,9 +1520,9 @@
            }
        },
        "node_modules/@esbuild/linux-x64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.0.tgz",
-            "integrity": "sha512-us0dSb9iFxIi8srnpl931Nvs65it/Jd2a2K3qs7fz2WfGPHqzfzZTfec7oxZJRNPXPnNYZtanmRc4AL/JwVzHQ==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.1.tgz",
+            "integrity": "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==",
            "cpu": [
                "x64"
            ],
@@ -1537,9 +1537,9 @@
            }
        },
        "node_modules/@esbuild/netbsd-arm64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.0.tgz",
-            "integrity": "sha512-CR/RYotgtCKwtftMwJlUU7xCVNg3lMYZ0RzTmAHSfLCXw3NtZtNpswLEj/Kkf6kEL3Gw+BpOekRX0BYCtklhUw==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.1.tgz",
+            "integrity": "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==",
            "cpu": [
                "arm64"
            ],
@@ -1554,9 +1554,9 @@
            }
        },
        "node_modules/@esbuild/netbsd-x64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.0.tgz",
-            "integrity": "sha512-nU1yhmYutL+fQ71Kxnhg8uEOdC0pwEW9entHykTgEbna2pw2dkbFSMeqjjyHZoCmt8SBkOSvV+yNmm94aUrrqw==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.1.tgz",
+            "integrity": "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==",
            "cpu": [
                "x64"
            ],
@@ -1571,9 +1571,9 @@
            }
        },
        "node_modules/@esbuild/openbsd-arm64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.0.tgz",
-            "integrity": "sha512-cXb5vApOsRsxsEl4mcZ1XY3D4DzcoMxR/nnc4IyqYs0rTI8ZKmW6kyyg+11Z8yvgMfAEldKzP7AdP64HnSC/6g==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.1.tgz",
+            "integrity": "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==",
            "cpu": [
                "arm64"
            ],
@@ -1588,9 +1588,9 @@
            }
        },
        "node_modules/@esbuild/openbsd-x64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.0.tgz",
-            "integrity": "sha512-8wZM2qqtv9UP3mzy7HiGYNH/zjTA355mpeuA+859TyR+e+Tc08IHYpLJuMsfpDJwoLo1ikIJI8jC3GFjnRClzA==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.1.tgz",
+            "integrity": "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==",
            "cpu": [
                "x64"
            ],
@@ -1605,9 +1605,9 @@
            }
        },
        "node_modules/@esbuild/openharmony-arm64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.0.tgz",
-            "integrity": "sha512-FLGfyizszcef5C3YtoyQDACyg95+dndv79i2EekILBofh5wpCa1KuBqOWKrEHZg3zrL3t5ouE5jgr94vA+Wb2w==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.1.tgz",
+            "integrity": "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==",
            "cpu": [
                "arm64"
            ],
@@ -1622,9 +1622,9 @@
            }
        },
        "node_modules/@esbuild/sunos-x64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.0.tgz",
-            "integrity": "sha512-1ZgjUoEdHZZl/YlV76TSCz9Hqj9h9YmMGAgAPYd+q4SicWNX3G5GCyx9uhQWSLcbvPW8Ni7lj4gDa1T40akdlw==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.1.tgz",
+            "integrity": "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==",
            "cpu": [
                "x64"
            ],
@@ -1639,9 +1639,9 @@
            }
        },
        "node_modules/@esbuild/win32-arm64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.0.tgz",
-            "integrity": "sha512-Q9StnDmQ/enxnpxCCLSg0oo4+34B9TdXpuyPeTedN/6+iXBJ4J+zwfQI28u/Jl40nOYAxGoNi7mFP40RUtkmUA==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.1.tgz",
+            "integrity": "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==",
            "cpu": [
                "arm64"
            ],
@@ -1656,9 +1656,9 @@
            }
        },
        "node_modules/@esbuild/win32-ia32": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.0.tgz",
-            "integrity": "sha512-zF3ag/gfiCe6U2iczcRzSYJKH1DCI+ByzSENHlM2FcDbEeo5Zd2C86Aq0tKUYAJJ1obRP84ymxIAksZUcdztHA==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.1.tgz",
+            "integrity": "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==",
            "cpu": [
                "ia32"
            ],
@@ -1673,9 +1673,9 @@
            }
        },
        "node_modules/@esbuild/win32-x64": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.0.tgz",
-            "integrity": "sha512-pEl1bO9mfAmIC+tW5btTmrKaujg3zGtUmWNdCw/xs70FBjwAL3o9OEKNHvNmnyylD6ubxUERiEhdsL0xBQ9efw==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.1.tgz",
+            "integrity": "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==",
            "cpu": [
                "x64"
            ],
@@ -2076,9 +2076,6 @@
            "cpu": [
                "arm"
            ],
-            "libc": [
-                "glibc"
-            ],
            "license": "LGPL-3.0-or-later",
            "optional": true,
            "os": [
@@ -2095,9 +2092,6 @@
            "cpu": [
                "arm64"
            ],
-            "libc": [
-                "glibc"
-            ],
            "license": "LGPL-3.0-or-later",
            "optional": true,
            "os": [
@@ -2114,9 +2108,6 @@
            "cpu": [
                "ppc64"
            ],
-            "libc": [
-                "glibc"
-            ],
            "license": "LGPL-3.0-or-later",
            "optional": true,
            "os": [
@@ -2133,9 +2124,6 @@
            "cpu": [
                "riscv64"
            ],
-            "libc": [
-                "glibc"
-            ],
            "license": "LGPL-3.0-or-later",
            "optional": true,
            "os": [
@@ -2152,9 +2140,6 @@
            "cpu": [
                "s390x"
            ],
-            "libc": [
-                "glibc"
-            ],
            "license": "LGPL-3.0-or-later",
            "optional": true,
            "os": [
@@ -2187,9 +2172,6 @@
            "cpu": [
                "arm64"
            ],
-            "libc": [
-                "musl"
-            ],
            "license": "LGPL-3.0-or-later",
            "optional": true,
            "os": [
@@ -2222,9 +2204,6 @@
            "cpu": [
                "arm"
            ],
-            "libc": [
-                "glibc"
-            ],
            "license": "Apache-2.0",
            "optional": true,
            "os": [
@@ -2247,9 +2226,6 @@
            "cpu": [
                "arm64"
            ],
-            "libc": [
-                "glibc"
-            ],
            "license": "Apache-2.0",
            "optional": true,
            "os": [
@@ -2272,9 +2248,6 @@
            "cpu": [
                "ppc64"
            ],
-            "libc": [
-                "glibc"
-            ],
            "license": "Apache-2.0",
            "optional": true,
            "os": [
@@ -2297,9 +2270,6 @@
            "cpu": [
                "riscv64"
            ],
-            "libc": [
-                "glibc"
-            ],
            "license": "Apache-2.0",
            "optional": true,
            "os": [
@@ -2322,9 +2292,6 @@
            "cpu": [
                "s390x"
            ],
-            "libc": [
-                "glibc"
-            ],
            "license": "Apache-2.0",
            "optional": true,
            "os": [
@@ -2369,9 +2336,6 @@
            "cpu": [
                "arm64"
            ],
-            "libc": [
-                "musl"
-            ],
            "license": "Apache-2.0",
            "optional": true,
            "os": [
@@ -2664,9 +2628,6 @@
            "cpu": [
                "arm64"
            ],
-            "libc": [
-                "glibc"
-            ],
            "license": "MIT",
            "optional": true,
            "os": [
@@ -2683,9 +2644,6 @@
            "cpu": [
                "arm64"
            ],
-            "libc": [
-                "musl"
-            ],
            "license": "MIT",
            "optional": true,
            "os": [
@@ -2941,9 +2899,6 @@
            "cpu": [
                "arm64"
            ],
-            "libc": [
-                "glibc"
-            ],
            "license": "MIT",
            "optional": true,
            "os": [
@@ -2960,9 +2915,6 @@
            "cpu": [
                "arm64"
            ],
-            "libc": [
-                "musl"
-            ],
            "license": "MIT",
            "optional": true,
            "os": [
@@ -3200,9 +3152,6 @@
            "cpu": [
                "arm64"
            ],
-            "libc": [
-                "glibc"
-            ],
            "license": "MIT",
            "optional": true,
            "os": [
@@ -3219,9 +3168,6 @@
            "cpu": [
                "arm64"
            ],
-            "libc": [
-                "musl"
-            ],
            "license": "MIT",
            "optional": true,
            "os": [
@@ -3582,9 +3528,6 @@
            "cpu": [
                "arm"
            ],
-            "libc": [
-                "glibc"
-            ],
            "license": "MIT",
            "optional": true,
            "os": [
@@ -3605,9 +3548,6 @@
            "cpu": [
                "arm"
            ],
-            "libc": [
-                "musl"
-            ],
            "license": "MIT",
            "optional": true,
            "os": [
@@ -3628,9 +3568,6 @@
            "cpu": [
                "arm64"
            ],
-            "libc": [
-                "glibc"
-            ],
            "license": "MIT",
            "optional": true,
            "os": [
@@ -3651,9 +3588,6 @@
            "cpu": [
                "arm64"
            ],
-            "libc": [
-                "musl"
-            ],
            "license": "MIT",
            "optional": true,
            "os": [
@@ -6873,9 +6807,6 @@
            "cpu": [
                "arm64"
            ],
-            "libc": [
-                "glibc"
-            ],
            "license": "Apache-2.0 AND MIT",
            "optional": true,
            "os": [
@@ -6892,9 +6823,6 @@
            "cpu": [
                "arm64"
            ],
-            "libc": [
-                "musl"
-            ],
            "license": "Apache-2.0 AND MIT",
            "optional": true,
            "os": [
@@ -6911,9 +6839,6 @@
            "cpu": [
                "ppc64"
            ],
-            "libc": [
-                "glibc"
-            ],
            "license": "Apache-2.0 AND MIT",
            "optional": true,
            "os": [
@@ -6930,9 +6855,6 @@
            "cpu": [
                "s390x"
            ],
-            "libc": [
-                "glibc"
-            ],
            "license": "Apache-2.0 AND MIT",
            "optional": true,
            "os": [
@@ -7200,9 +7122,6 @@
                "arm64"
            ],
            "dev": true,
-            "libc": [
-                "glibc"
-            ],
            "license": "MIT",
            "optional": true,
            "os": [
@@ -7220,9 +7139,6 @@
                "arm64"
            ],
            "dev": true,
-            "libc": [
-                "musl"
-            ],
            "license": "MIT",
            "optional": true,
            "os": [
@@ -7296,6 +7212,72 @@
                "node": ">=14.0.0"
            }
        },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/core": {
+            "version": "1.10.0",
+            "dev": true,
+            "inBundle": true,
+            "license": "MIT",
+            "optional": true,
+            "dependencies": {
+                "@emnapi/wasi-threads": "1.2.1",
+                "tslib": "^2.4.0"
+            }
+        },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/runtime": {
+            "version": "1.10.0",
+            "dev": true,
+            "inBundle": true,
+            "license": "MIT",
+            "optional": true,
+            "dependencies": {
+                "tslib": "^2.4.0"
+            }
+        },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
+            "version": "1.2.1",
+            "dev": true,
+            "inBundle": true,
+            "license": "MIT",
+            "optional": true,
+            "dependencies": {
+                "tslib": "^2.4.0"
+            }
+        },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@napi-rs/wasm-runtime": {
+            "version": "1.1.4",
+            "dev": true,
+            "inBundle": true,
+            "license": "MIT",
+            "optional": true,
+            "dependencies": {
+                "@tybys/wasm-util": "^0.10.1"
+            },
+            "funding": {
+                "type": "github",
+                "url": "https://github.com/sponsors/Brooooooklyn"
+            },
+            "peerDependencies": {
+                "@emnapi/core": "^1.7.1",
+                "@emnapi/runtime": "^1.7.1"
+            }
+        },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@tybys/wasm-util": {
+            "version": "0.10.1",
+            "dev": true,
+            "inBundle": true,
+            "license": "MIT",
+            "optional": true,
+            "dependencies": {
+                "tslib": "^2.4.0"
+            }
+        },
+        "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/tslib": {
+            "version": "2.8.1",
+            "dev": true,
+            "inBundle": true,
+            "license": "0BSD",
+            "optional": true
+        },
        "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
            "version": "4.3.0",
            "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.0.tgz",
@@ -8448,9 +8430,6 @@
                "arm64"
            ],
            "dev": true,
-            "libc": [
-                "glibc"
-            ],
            "license": "MIT",
            "optional": true,
            "os": [
@@ -8465,9 +8444,6 @@
                "arm64"
            ],
            "dev": true,
-            "libc": [
-                "musl"
-            ],
            "license": "MIT",
            "optional": true,
            "os": [
@@ -8482,9 +8458,6 @@
                "ppc64"
            ],
            "dev": true,
-            "libc": [
-                "glibc"
-            ],
            "license": "MIT",
            "optional": true,
            "os": [
@@ -8499,9 +8472,6 @@
                "riscv64"
            ],
            "dev": true,
-            "libc": [
-                "glibc"
-            ],
            "license": "MIT",
            "optional": true,
            "os": [
@@ -8516,9 +8486,6 @@
                "riscv64"
            ],
            "dev": true,
-            "libc": [
-                "musl"
-            ],
            "license": "MIT",
            "optional": true,
            "os": [
@@ -8533,9 +8500,6 @@
                "s390x"
            ],
            "dev": true,
-            "libc": [
-                "glibc"
-            ],
            "license": "MIT",
            "optional": true,
            "os": [
@@ -11261,9 +11225,9 @@
            ]
        },
        "node_modules/esbuild": {
-            "version": "0.28.0",
-            "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.0.tgz",
-            "integrity": "sha512-sNR9MHpXSUV/XB4zmsFKN+QgVG82Cc7+/aaxJ8Adi8hyOac+EXptIp45QBPaVyX3N70664wRbTcLTOemCAnyqw==",
+            "version": "0.28.1",
+            "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.1.tgz",
+            "integrity": "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==",
            "dev": true,
            "hasInstallScript": true,
            "license": "MIT",
@@ -11274,32 +11238,32 @@
                "node": ">=18"
            },
            "optionalDependencies": {
-                "@esbuild/aix-ppc64": "0.28.0",
-                "@esbuild/android-arm": "0.28.0",
-                "@esbuild/android-arm64": "0.28.0",
-                "@esbuild/android-x64": "0.28.0",
-                "@esbuild/darwin-arm64": "0.28.0",
-                "@esbuild/darwin-x64": "0.28.0",
-                "@esbuild/freebsd-arm64": "0.28.0",
-                "@esbuild/freebsd-x64": "0.28.0",
-                "@esbuild/linux-arm": "0.28.0",
-                "@esbuild/linux-arm64": "0.28.0",
-                "@esbuild/linux-ia32": "0.28.0",
-                "@esbuild/linux-loong64": "0.28.0",
-                "@esbuild/linux-mips64el": "0.28.0",
-                "@esbuild/linux-ppc64": "0.28.0",
-                "@esbuild/linux-riscv64": "0.28.0",
-                "@esbuild/linux-s390x": "0.28.0",
-                "@esbuild/linux-x64": "0.28.0",
-                "@esbuild/netbsd-arm64": "0.28.0",
-                "@esbuild/netbsd-x64": "0.28.0",
-                "@esbuild/openbsd-arm64": "0.28.0",
-                "@esbuild/openbsd-x64": "0.28.0",
-                "@esbuild/openharmony-arm64": "0.28.0",
-                "@esbuild/sunos-x64": "0.28.0",
-                "@esbuild/win32-arm64": "0.28.0",
-                "@esbuild/win32-ia32": "0.28.0",
-                "@esbuild/win32-x64": "0.28.0"
+                "@esbuild/aix-ppc64": "0.28.1",
+                "@esbuild/android-arm": "0.28.1",
+                "@esbuild/android-arm64": "0.28.1",
+                "@esbuild/android-x64": "0.28.1",
+                "@esbuild/darwin-arm64": "0.28.1",
+                "@esbuild/darwin-x64": "0.28.1",
+                "@esbuild/freebsd-arm64": "0.28.1",
+                "@esbuild/freebsd-x64": "0.28.1",
+                "@esbuild/linux-arm": "0.28.1",
+                "@esbuild/linux-arm64": "0.28.1",
+                "@esbuild/linux-ia32": "0.28.1",
+                "@esbuild/linux-loong64": "0.28.1",
+                "@esbuild/linux-mips64el": "0.28.1",
+                "@esbuild/linux-ppc64": "0.28.1",
+                "@esbuild/linux-riscv64": "0.28.1",
+                "@esbuild/linux-s390x": "0.28.1",
+                "@esbuild/linux-x64": "0.28.1",
+                "@esbuild/netbsd-arm64": "0.28.1",
+                "@esbuild/netbsd-x64": "0.28.1",
+                "@esbuild/openbsd-arm64": "0.28.1",
+                "@esbuild/openbsd-x64": "0.28.1",
+                "@esbuild/openharmony-arm64": "0.28.1",
+                "@esbuild/sunos-x64": "0.28.1",
+                "@esbuild/win32-arm64": "0.28.1",
+                "@esbuild/win32-ia32": "0.28.1",
+                "@esbuild/win32-x64": "0.28.1"
            }
        },
        "node_modules/esbuild-node-externals": {
@@ -12191,16 +12155,16 @@
            }
        },
        "node_modules/form-data": {
-            "version": "4.0.5",
-            "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
-            "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
+            "version": "4.0.6",
+            "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz",
+            "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==",
            "license": "MIT",
            "dependencies": {
                "asynckit": "^0.4.0",
                "combined-stream": "^1.0.8",
                "es-set-tostringtag": "^2.1.0",
-                "hasown": "^2.0.2",
-                "mime-types": "^2.1.12"
+                "hasown": "^2.0.4",
+                "mime-types": "^2.1.35"
            },
            "engines": {
                "node": ">= 6"
@@ -12629,9 +12593,9 @@
            }
        },
        "node_modules/hasown": {
-            "version": "2.0.3",
-            "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.3.tgz",
-            "integrity": "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==",
+            "version": "2.0.4",
+            "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+            "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
            "license": "MIT",
            "dependencies": {
                "function-bind": "^1.1.2"
@@ -13425,9 +13389,19 @@
            "license": "MIT"
        },
        "node_modules/js-yaml": {
-            "version": "4.1.1",
-            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-            "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+            "version": "4.2.0",
+            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
+            "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+            "funding": [
+                {
+                    "type": "github",
+                    "url": "https://github.com/sponsors/puzrin"
+                },
+                {
+                    "type": "github",
+                    "url": "https://github.com/sponsors/nodeca"
+                }
+            ],
            "license": "MIT",
            "dependencies": {
                "argparse": "^2.0.1"
@@ -13767,9 +13741,6 @@
                "arm64"
            ],
            "dev": true,
-            "libc": [
-                "glibc"
-            ],
            "license": "MPL-2.0",
            "optional": true,
            "os": [
@@ -13791,9 +13762,6 @@
                "arm64"
            ],
            "dev": true,
-            "libc": [
-                "musl"
-            ],
            "license": "MPL-2.0",
            "optional": true,
            "os": [
@@ -14574,9 +14542,9 @@
            "license": "MIT"
        },
        "node_modules/nodemailer": {
-            "version": "8.0.9",
-            "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-8.0.9.tgz",
-            "integrity": "sha512-5ofa7BUN8+C+Hckh5V2GjeeOGRQBx0CJQA6KxrvuZfC8iU4/q7sLn8XrtEEhJkjV6HdyIiQs7Bba6bTao8JhkA==",
+            "version": "9.0.1",
+            "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-9.0.1.tgz",
+            "integrity": "sha512-Gwv8SQewT616ZM/URn0H54b8PWo/Wum7md3EW2aWy1lO27+WZCX+Xyak3J+NlmHUjDh5ME+uesJUDRbR3Ye8Bw==",
            "license": "MIT-0",
            "engines": {
                "node": ">=6.0.0"
@@ -15001,9 +14969,6 @@
            "cpu": [
                "arm64"
            ],
-            "libc": [
-                "glibc"
-            ],
            "license": "MIT",
            "optional": true,
            "os": [
@@ -15020,9 +14985,6 @@
            "cpu": [
                "arm64"
            ],
-            "libc": [
-                "musl"
-            ],
            "license": "MIT",
            "optional": true,
            "os": [
--- a/package.json
+++ b/package.json
@@ -93,7 +93,7 @@
        "input-otp": "1.4.2",
        "ioredis": "5.11.0",
        "jmespath": "0.16.0",
-        "js-yaml": "4.1.1",
+        "js-yaml": "4.2.0",
        "jsonwebtoken": "9.0.3",
        "lucide-react": "1.17.0",
        "maxmind": "5.0.6",
@@ -103,7 +103,7 @@
        "next-themes": "0.4.6",
        "nextjs-toploader": "3.9.17",
        "node-cache": "5.1.2",
-        "nodemailer": "8.0.9",
+        "nodemailer": "9.0.1",
        "oslo": "1.2.1",
        "pg": "8.21.0",
        "posthog-node": "5.35.6",
@@ -165,7 +165,7 @@
        "@types/yargs": "17.0.35",
        "babel-plugin-react-compiler": "1.0.0",
        "drizzle-kit": "0.31.10",
-        "esbuild": "0.28.0",
+        "esbuild": "0.28.1",
        "esbuild-node-externals": "1.22.0",
        "eslint": "10.4.0",
        "eslint-config-next": "16.2.6",
@@ -179,7 +179,7 @@
        "typescript-eslint": "8.60.0"
    },
    "overrides": {
-        "esbuild": "0.28.0",
+        "esbuild": "0.28.1",
        "dompurify": "3.4.0",
        "postcss": "8.5.15"
    }
--- a/server/auth/sessions/app.ts
+++ b/server/auth/sessions/app.ts
@@ -12,7 +12,7 @@ import {
    users
 } from "@server/db";
 import { db } from "@server/db";
-import { eq, inArray } from "drizzle-orm";
+import { and, eq, inArray, ne } from "drizzle-orm";
 import config from "@server/lib/config";
 import type { RandomReader } from "@oslojs/crypto/random";
 import { generateRandomString } from "@oslojs/crypto/random";
@@ -136,6 +136,45 @@ export async function invalidateAllSessions(userId: string): Promise<void> {
    }
 }

+export async function invalidateAllSessionsExceptCurrent(
+    userId: string,
+    currentSessionId: string
+): Promise<void> {
+    try {
+        await db.transaction(async (trx) => {
+            const userSessions = await trx
+                .select()
+                .from(sessions)
+                .where(
+                    and(
+                        eq(sessions.userId, userId),
+                        ne(sessions.sessionId, currentSessionId)
+                    )
+                );
+
+            if (userSessions.length > 0) {
+                await trx.delete(resourceSessions).where(
+                    inArray(
+                        resourceSessions.userSessionId,
+                        userSessions.map((s) => s.sessionId)
+                    )
+                );
+            }
+
+            await trx
+                .delete(sessions)
+                .where(
+                    and(
+                        eq(sessions.userId, userId),
+                        ne(sessions.sessionId, currentSessionId)
+                    )
+                );
+        });
+    } catch (e) {
+        logger.error("Failed to invalidate user sessions except current", e);
+    }
+}
+
 export function serializeSessionCookie(
    token: string,
    isSecure: boolean,
--- a/server/db/countries.ts
+++ b/server/db/countries.ts
@@ -795,10 +795,13 @@ export const COUNTRIES = [
        name: "Serbia",
        code: "RS"
    },
-    {
-        name: "Serbia and Montenegro",
-        code: "CS"
-    },
+    // Removed as this is a deprecated ISO country code, not supported anymore
+    // Also the individual flags for Serbia & Montenegro are already included in the list
+    // more details: https://en.wikipedia.org/wiki/ISO_3166-2:CS
+    // {
+    //     name: "Serbia and Montenegro",
+    //     code: "CS"
+    // },
    {
        name: "Seychelles",
        code: "SC"
--- a/server/lib/blueprints/applyBlueprint.ts
+++ b/server/lib/blueprints/applyBlueprint.ts
@@ -3,7 +3,6 @@ import {
    newts,
    blueprints,
    Blueprint,
-    Site,
    siteResources,
    roleSiteResources,
    userSiteResources,
@@ -30,8 +29,11 @@ import { updateResourcePolicies } from "./resourcePolicies";
 import { BlueprintSource } from "@server/routers/blueprints/types";
 import { stringify as stringifyYaml } from "yaml";
 import { generateName } from "@server/db/names";
-import { handleMessagingForUpdatedSiteResource } from "@server/routers/siteResource";
-import { rebuildClientAssociationsFromSiteResource } from "../rebuildClientAssociations";
+import {
+    handleMessagingForUpdatedSiteResource,
+    rebuildClientAssociationsFromSiteResource,
+    waitForSiteResourceRebuildIdle
+} from "../rebuildClientAssociations";

 type ApplyBlueprintArgs = {
    orgId: string;
@@ -60,30 +62,26 @@ export async function applyBlueprint({

        const config: Config = validationResult.data;

-        let proxyResourcesResults: PublicResourcesResults = [];
-        let clientResourcesResults: ClientResourcesResults = [];
+        let publicResourcesResults: PublicResourcesResults = [];
+        let privateResourcesResults: ClientResourcesResults = [];
        await db.transaction(async (trx) => {
            await updateResourcePolicies(orgId, config, trx);

-            proxyResourcesResults = await updatePublicResources(
+            publicResourcesResults = await updatePublicResources(
                orgId,
                config,
                trx,
                siteId
            );
-            clientResourcesResults = await updatePrivateResources(
+            privateResourcesResults = await updatePrivateResources(
                orgId,
                config,
                trx,
                siteId
            );

-            logger.debug(
-                `Successfully updated proxy resources for org ${orgId}: ${JSON.stringify(proxyResourcesResults)}`
-            );
-
            // We need to update the targets on the newts from the successfully updated information
-            for (const result of proxyResourcesResults) {
+            for (const result of publicResourcesResults) {
                for (const target of result.targetsToUpdate) {
                    const [site] = await trx
                        .select()
@@ -136,166 +134,37 @@ export async function applyBlueprint({
            }

            logger.debug(
-                `Successfully updated client resources for org ${orgId}: ${JSON.stringify(clientResourcesResults)}`
+                `Successfully updated public resources for org ${orgId}: ${JSON.stringify(publicResourcesResults)}`
            );

            // We need to update the targets on the newts from the successfully updated information
-            for (const result of clientResourcesResults) {
-                if (
-                    result.oldSiteResource &&
-                    JSON.stringify(result.newSites?.sort()) !==
-                        JSON.stringify(result.oldSites?.sort())
-                ) {
-                    // query existing associations
-                    const existingRoleIds = await trx
-                        .select()
-                        .from(roleSiteResources)
-                        .where(
-                            eq(
-                                roleSiteResources.siteResourceId,
-                                result.oldSiteResource.siteResourceId
-                            )
+            for (const result of privateResourcesResults) {
+                rebuildClientAssociationsFromSiteResource(
+                    result.newSiteResource
+                )
+                    .then(() =>
+                        waitForSiteResourceRebuildIdle(
+                            result.newSiteResource.siteResourceId
                        )
-                        .then((rows) => rows.map((row) => row.roleId));
-
-                    const existingUserIds = await trx
-                        .select()
-                        .from(userSiteResources)
-                        .where(
-                            eq(
-                                userSiteResources.siteResourceId,
-                                result.oldSiteResource.siteResourceId
-                            )
+                    )
+                    .then(() =>
+                        handleMessagingForUpdatedSiteResource(
+                            result.oldSiteResource,
+                            result.newSiteResource,
+                            result.oldSites.map((s) => s.siteId),
+                            result.newSites.map((s) => s.siteId)
                        )
-                        .then((rows) => rows.map((row) => row.userId));
-
-                    const existingClientIds = await trx
-                        .select()
-                        .from(clientSiteResources)
-                        .where(
-                            eq(
-                                clientSiteResources.siteResourceId,
-                                result.oldSiteResource.siteResourceId
-                            )
-                        )
-                        .then((rows) => rows.map((row) => row.clientId));
-
-                    // delete the existing site resource
-                    await trx
-                        .delete(siteResources)
-                        .where(
-                            and(
-                                eq(
-                                    siteResources.siteResourceId,
-                                    result.oldSiteResource.siteResourceId
-                                )
-                            )
+                    )
+                    .catch((e) => {
+                        logger.error(
+                            `Failed to rebuild and handle messaging for site resource ${result.newSiteResource.siteResourceId}. Error: ${e}`
                        );
-
-                    await rebuildClientAssociationsFromSiteResource(
-                        result.oldSiteResource,
-                        trx
-                    );
-
-                    const [insertedSiteResource] = await trx
-                        .insert(siteResources)
-                        .values({
-                            ...result.newSiteResource
-                        })
-                        .returning();
-
-                    // wait some time to allow for messages to be handled
-                    await new Promise((resolve) => setTimeout(resolve, 750));
-
-                    //////////////////// update the associations ////////////////////
-
-                    if (existingRoleIds.length > 0) {
-                        await trx.insert(roleSiteResources).values(
-                            existingRoleIds.map((roleId) => ({
-                                roleId,
-                                siteResourceId:
-                                    insertedSiteResource!.siteResourceId
-                            }))
-                        );
-                    }
-
-                    if (existingUserIds.length > 0) {
-                        await trx.insert(userSiteResources).values(
-                            existingUserIds.map((userId) => ({
-                                userId,
-                                siteResourceId:
-                                    insertedSiteResource!.siteResourceId
-                            }))
-                        );
-                    }
-
-                    if (existingClientIds.length > 0) {
-                        await trx.insert(clientSiteResources).values(
-                            existingClientIds.map((clientId) => ({
-                                clientId,
-                                siteResourceId:
-                                    insertedSiteResource!.siteResourceId
-                            }))
-                        );
-                    }
-
-                    await rebuildClientAssociationsFromSiteResource(
-                        insertedSiteResource,
-                        trx
-                    );
-                } else {
-                    let good = true;
-                    for (const newSite of result.newSites) {
-                        const [site] = await trx
-                            .select()
-                            .from(sites)
-                            .innerJoin(newts, eq(sites.siteId, newts.siteId))
-                            .where(
-                                and(
-                                    eq(sites.siteId, newSite.siteId),
-                                    eq(sites.orgId, orgId),
-                                    eq(sites.type, "newt"),
-                                    isNotNull(sites.pubKey)
-                                )
-                            )
-                            .limit(1);
-
-                        if (!site) {
-                            logger.debug(
-                                `No newt sites found for client resource ${result.newSiteResource.siteResourceId}, skipping target update`
-                            );
-                            good = false;
-                            break;
-                        }
-
-                        logger.debug(
-                            `Updating client resource ${result.newSiteResource.siteResourceId} on site ${newSite.siteId}`
-                        );
-                    }
-
-                    if (!good) {
-                        continue;
-                    }
-
-                    await handleMessagingForUpdatedSiteResource(
-                        result.oldSiteResource,
-                        result.newSiteResource,
-                        result.newSites.map((site) => ({
-                            siteId: site.siteId,
-                            orgId: result.newSiteResource.orgId
-                        })),
-                        trx
-                    );
-                }
-
-                // await addClientTargets(
-                //     site.newt.newtId,
-                //     result.resource.destination,
-                //     result.resource.destinationPort,
-                //     result.resource.protocol,
-                //     result.resource.proxyPort
-                // );
+                    });
            }
+
+            logger.debug(
+                `Successfully updated private resources for org ${orgId}: ${JSON.stringify(privateResourcesResults)}`
+            );
        });

        blueprintSucceeded = true;
--- a/server/lib/calculateUserClientsForOrgs.ts
+++ b/server/lib/calculateUserClientsForOrgs.ts
@@ -6,6 +6,7 @@ import {
    db,
    olms,
    orgs,
+    primaryDb,
    roleClients,
    roles,
    Transaction,
@@ -23,415 +24,427 @@ import { rebuildClientAssociationsFromClient } from "./rebuildClientAssociations
 import { OlmErrorCodes } from "@server/routers/olm/error";
 import { tierMatrix } from "./billing/tierMatrix";

-export async function calculateUserClientsForOrgs(
+type ClientRow = typeof clients.$inferSelect;
+
+function runQueuedClientAssociationRebuilds(
    userId: string,
-    trx: Transaction | typeof db = db
-): Promise<void> {
-    const execute = async (transaction: Transaction | typeof db) => {
-        const orgCache = new Map<string, typeof orgs.$inferSelect | null>();
-        const adminRoleCache = new Map<
-            string,
-            typeof roles.$inferSelect | null
-        >();
-        const exitNodesCache = new Map<
-            string,
-            Awaited<ReturnType<typeof listExitNodes>>
-        >();
-        const isOrgLicensedCache = new Map<string, boolean>();
-        const existingClientCache = new Map<
-            string,
-            typeof clients.$inferSelect | null
-        >();
-        const roleClientAccessCache = new Map<string, boolean>();
-        const userClientAccessCache = new Map<string, boolean>();
+    queuedClients: ClientRow[]
+) {
+    if (queuedClients.length === 0) {
+        return;
+    }

-        const getOrgOlmKey = (orgId: string, olmId: string) =>
-            `${orgId}:${olmId}`;
-        const getRoleClientKey = (roleId: number, clientId: number) =>
-            `${roleId}:${clientId}`;
-        const getUserClientKey = (cachedUserId: string, clientId: number) =>
-            `${cachedUserId}:${clientId}`;
+    const uniqueClientsById = new Map<number, ClientRow>();
+    for (const client of queuedClients) {
+        uniqueClientsById.set(client.clientId, client);
+    }

-        const getOrg = async (orgId: string) => {
-            if (orgCache.has(orgId)) {
-                return orgCache.get(orgId) ?? null;
-            }
-
-            const [org] = await transaction
-                .select()
-                .from(orgs)
-                .where(eq(orgs.orgId, orgId));
-            orgCache.set(orgId, org ?? null);
-
-            return org ?? null;
-        };
-
-        const getAdminRole = async (orgId: string) => {
-            if (adminRoleCache.has(orgId)) {
-                return adminRoleCache.get(orgId) ?? null;
-            }
-
-            const [adminRole] = await transaction
-                .select()
-                .from(roles)
-                .where(and(eq(roles.isAdmin, true), eq(roles.orgId, orgId)))
-                .limit(1);
-            adminRoleCache.set(orgId, adminRole ?? null);
-
-            return adminRole ?? null;
-        };
-
-        const getExitNodes = async (orgId: string) => {
-            if (exitNodesCache.has(orgId)) {
-                return exitNodesCache.get(orgId)!;
-            }
-
-            const exitNodes = await listExitNodes(orgId);
-            exitNodesCache.set(orgId, exitNodes);
-
-            return exitNodes;
-        };
-
-        const getIsOrgLicensed = async (orgId: string) => {
-            if (isOrgLicensedCache.has(orgId)) {
-                return isOrgLicensedCache.get(orgId)!;
-            }
-
-            const isOrgLicensed = await isLicensedOrSubscribed(
-                orgId,
-                tierMatrix.deviceApprovals
+    for (const client of uniqueClientsById.values()) {
+        rebuildClientAssociationsFromClient(client).catch((error) => {
+            logger.error(
+                `Error rebuilding client associations for client ${client.clientId} (user ${userId}): ${String(
+                    error
+                )}`
            );
-            isOrgLicensedCache.set(orgId, isOrgLicensed);
-
-            return isOrgLicensed;
-        };
-
-        const getExistingClient = async (orgId: string, olmId: string) => {
-            const key = getOrgOlmKey(orgId, olmId);
-            if (existingClientCache.has(key)) {
-                return existingClientCache.get(key) ?? null;
-            }
-
-            const [existingClient] = await transaction
-                .select()
-                .from(clients)
-                .where(
-                    and(
-                        eq(clients.userId, userId),
-                        eq(clients.orgId, orgId),
-                        eq(clients.olmId, olmId)
-                    )
-                )
-                .limit(1);
-
-            existingClientCache.set(key, existingClient ?? null);
-
-            return existingClient ?? null;
-        };
-
-        const hasRoleClientAccess = async (
-            roleId: number,
-            clientId: number
-        ) => {
-            const key = getRoleClientKey(roleId, clientId);
-            if (roleClientAccessCache.has(key)) {
-                return roleClientAccessCache.get(key)!;
-            }
-
-            const [existingRoleClient] = await transaction
-                .select()
-                .from(roleClients)
-                .where(
-                    and(
-                        eq(roleClients.roleId, roleId),
-                        eq(roleClients.clientId, clientId)
-                    )
-                )
-                .limit(1);
-
-            const hasAccess = Boolean(existingRoleClient);
-            roleClientAccessCache.set(key, hasAccess);
-
-            return hasAccess;
-        };
-
-        const hasUserClientAccess = async (
-            cachedUserId: string,
-            clientId: number
-        ) => {
-            const key = getUserClientKey(cachedUserId, clientId);
-            if (userClientAccessCache.has(key)) {
-                return userClientAccessCache.get(key)!;
-            }
-
-            const [existingUserClient] = await transaction
-                .select()
-                .from(userClients)
-                .where(
-                    and(
-                        eq(userClients.userId, cachedUserId),
-                        eq(userClients.clientId, clientId)
-                    )
-                )
-                .limit(1);
-
-            const hasAccess = Boolean(existingUserClient);
-            userClientAccessCache.set(key, hasAccess);
-
-            return hasAccess;
-        };
-
-        // Get all OLMs for this user
-        const userOlms = await transaction
-            .select()
-            .from(olms)
-            .where(eq(olms.userId, userId));
-
-        if (userOlms.length === 0) {
-            // No OLMs for this user, but we should still clean up any orphaned clients
-            await cleanupOrphanedClients(userId, transaction);
-            return;
-        }
-
-        // Get all user orgs with all roles (for org list and role-based logic)
-        const userOrgRoleRows = await transaction
-            .select()
-            .from(userOrgs)
-            .innerJoin(
-                userOrgRoles,
-                and(
-                    eq(userOrgs.userId, userOrgRoles.userId),
-                    eq(userOrgs.orgId, userOrgRoles.orgId)
-                )
-            )
-            .innerJoin(roles, eq(userOrgRoles.roleId, roles.roleId))
-            .where(eq(userOrgs.userId, userId));
-
-        const userOrgIds = [
-            ...new Set(userOrgRoleRows.map((r) => r.userOrgs.orgId))
-        ];
-        const orgIdToRoleRows = new Map<
-            string,
-            (typeof userOrgRoleRows)[0][]
-        >();
-        for (const r of userOrgRoleRows) {
-            const list = orgIdToRoleRows.get(r.userOrgs.orgId) ?? [];
-            list.push(r);
-            orgIdToRoleRows.set(r.userOrgs.orgId, list);
-        }
-        const orgRequiresDeviceApprovalRole = new Map<string, boolean>();
-        for (const [orgId, roleRowsForOrg] of orgIdToRoleRows.entries()) {
-            orgRequiresDeviceApprovalRole.set(
-                orgId,
-                roleRowsForOrg.some((r) => r.roles.requireDeviceApproval)
-            );
-        }
-
-        // For each OLM, ensure there's a client in each org the user is in
-        for (const olm of userOlms) {
-            for (const orgId of orgIdToRoleRows.keys()) {
-                const roleRowsForOrg = orgIdToRoleRows.get(orgId)!;
-                const userOrg = roleRowsForOrg[0].userOrgs;
-
-                const org = await getOrg(orgId);
-
-                if (!org) {
-                    logger.warn(
-                        `Skipping org ${orgId} for OLM ${olm.olmId} (user ${userId}): org not found`
-                    );
-                    continue;
-                }
-
-                if (!org.subnet) {
-                    logger.warn(
-                        `Skipping org ${orgId} for OLM ${olm.olmId} (user ${userId}): org has no subnet configured`
-                    );
-                    continue;
-                }
-
-                // Get admin role for this org (needed for access grants)
-                const adminRole = await getAdminRole(orgId);
-
-                if (!adminRole) {
-                    logger.warn(
-                        `Skipping org ${orgId} for OLM ${olm.olmId} (user ${userId}): no admin role found`
-                    );
-                    continue;
-                }
-
-                // Check if a client already exists for this OLM+user+org combination
-                const existingClient = await getExistingClient(
-                    orgId,
-                    olm.olmId
-                );
-
-                if (existingClient) {
-                    // Ensure admin role has access to the client
-                    const hasRoleAccess = await hasRoleClientAccess(
-                        adminRole.roleId,
-                        existingClient.clientId
-                    );
-
-                    if (!hasRoleAccess) {
-                        await transaction.insert(roleClients).values({
-                            roleId: adminRole.roleId,
-                            clientId: existingClient.clientId
-                        });
-                        roleClientAccessCache.set(
-                            getRoleClientKey(
-                                adminRole.roleId,
-                                existingClient.clientId
-                            ),
-                            true
-                        );
-                        logger.debug(
-                            `Granted admin role access to existing client ${existingClient.clientId} for OLM ${olm.olmId} in org ${orgId} (user ${userId})`
-                        );
-                    }
-
-                    // Ensure user has access to the client
-                    const hasUserAccess = await hasUserClientAccess(
-                        userId,
-                        existingClient.clientId
-                    );
-
-                    if (!hasUserAccess) {
-                        await transaction.insert(userClients).values({
-                            userId,
-                            clientId: existingClient.clientId
-                        });
-                        userClientAccessCache.set(
-                            getUserClientKey(userId, existingClient.clientId),
-                            true
-                        );
-                        logger.debug(
-                            `Granted user access to existing client ${existingClient.clientId} for OLM ${olm.olmId} in org ${orgId} (user ${userId})`
-                        );
-                    }
-
-                    logger.debug(
-                        `Client already exists for OLM ${olm.olmId} in org ${orgId} (user ${userId}), skipping creation`
-                    );
-                    continue;
-                }
-
-                // Get exit nodes for this org
-                const exitNodesList = await getExitNodes(orgId);
-
-                if (exitNodesList.length === 0) {
-                    logger.warn(
-                        `Skipping org ${orgId} for OLM ${olm.olmId} (user ${userId}): no exit nodes found`
-                    );
-                    continue;
-                }
-
-                const randomExitNode =
-                    exitNodesList[
-                        Math.floor(Math.random() * exitNodesList.length)
-                    ];
-
-                // Get next available subnet
-                const { value: newSubnet, release: releaseSubnetLock } =
-                    await getNextAvailableClientSubnet(orgId, transaction);
-
-                const subnet = newSubnet.split("/")[0];
-                const updatedSubnet = `${subnet}/${org.subnet.split("/")[1]}`;
-
-                const niceId = await getUniqueClientName(orgId);
-
-                const isOrgLicensed = await getIsOrgLicensed(userOrg.orgId);
-                const requireApproval =
-                    build !== "oss" &&
-                    isOrgLicensed &&
-                    orgRequiresDeviceApprovalRole.get(orgId) === true;
-
-                const newClientData: InferInsertModel<typeof clients> = {
-                    userId,
-                    orgId: userOrg.orgId,
-                    exitNodeId: randomExitNode.exitNodeId,
-                    name: olm.name || "User Client",
-                    subnet: updatedSubnet,
-                    olmId: olm.olmId,
-                    type: "olm",
-                    niceId,
-                    approvalState: requireApproval ? "pending" : null
-                };
-
-                // Create the client
-                const [newClient] = await transaction
-                    .insert(clients)
-                    .values(newClientData)
-                    .returning();
-                await releaseSubnetLock();
-                existingClientCache.set(
-                    getOrgOlmKey(orgId, olm.olmId),
-                    newClient
-                );
-
-                // create approval request
-                if (requireApproval) {
-                    await transaction
-                        .insert(approvals)
-                        .values({
-                            timestamp: Math.floor(new Date().getTime() / 1000),
-                            orgId: userOrg.orgId,
-                            clientId: newClient.clientId,
-                            userId,
-                            type: "user_device"
-                        })
-                        .returning();
-                }
-
-                await rebuildClientAssociationsFromClient(
-                    newClient,
-                    transaction
-                );
-
-                // Grant admin role access to the client
-                await transaction.insert(roleClients).values({
-                    roleId: adminRole.roleId,
-                    clientId: newClient.clientId
-                });
-                roleClientAccessCache.set(
-                    getRoleClientKey(adminRole.roleId, newClient.clientId),
-                    true
-                );
-
-                // Grant user access to the client
-                await transaction.insert(userClients).values({
-                    userId,
-                    clientId: newClient.clientId
-                });
-                userClientAccessCache.set(
-                    getUserClientKey(userId, newClient.clientId),
-                    true
-                );
-
-                logger.debug(
-                    `Created client for OLM ${olm.olmId} in org ${orgId} (user ${userId}) with access granted to admin role and user`
-                );
-            }
-        }
-
-        // Clean up clients in orgs the user is no longer in
-        await cleanupOrphanedClients(userId, transaction, userOrgIds);
-    };
-
-    if (trx) {
-        // Use provided transaction
-        await execute(trx);
-    } else {
-        // Create new transaction
-        await db.transaction(async (transaction) => {
-            await execute(transaction);
        });
    }
+
+    logger.debug(
+        `Queued association rebuild completed for ${uniqueClientsById.size} client(s) (user ${userId})`
+    );
+}
+
+export async function calculateUserClientsForOrgs(
+    userId: string
+): Promise<void> {
+    const trx = primaryDb;
+
+    const queuedAssociationRebuilds: ClientRow[] = [];
+    const orgCache = new Map<string, typeof orgs.$inferSelect | null>();
+    const adminRoleCache = new Map<string, typeof roles.$inferSelect | null>();
+    const exitNodesCache = new Map<
+        string,
+        Awaited<ReturnType<typeof listExitNodes>>
+    >();
+    const isOrgLicensedCache = new Map<string, boolean>();
+    const existingClientCache = new Map<
+        string,
+        typeof clients.$inferSelect | null
+    >();
+    const roleClientAccessCache = new Map<string, boolean>();
+    const userClientAccessCache = new Map<string, boolean>();
+
+    const getOrgOlmKey = (orgId: string, olmId: string) => `${orgId}:${olmId}`;
+    const getRoleClientKey = (roleId: number, clientId: number) =>
+        `${roleId}:${clientId}`;
+    const getUserClientKey = (cachedUserId: string, clientId: number) =>
+        `${cachedUserId}:${clientId}`;
+
+    const getOrg = async (orgId: string) => {
+        if (orgCache.has(orgId)) {
+            return orgCache.get(orgId) ?? null;
+        }
+
+        const [org] = await trx
+            .select()
+            .from(orgs)
+            .where(eq(orgs.orgId, orgId));
+        orgCache.set(orgId, org ?? null);
+
+        return org ?? null;
+    };
+
+    const getAdminRole = async (orgId: string) => {
+        if (adminRoleCache.has(orgId)) {
+            return adminRoleCache.get(orgId) ?? null;
+        }
+
+        const [adminRole] = await trx
+            .select()
+            .from(roles)
+            .where(and(eq(roles.isAdmin, true), eq(roles.orgId, orgId)))
+            .limit(1);
+        adminRoleCache.set(orgId, adminRole ?? null);
+
+        return adminRole ?? null;
+    };
+
+    const getExitNodes = async (orgId: string) => {
+        if (exitNodesCache.has(orgId)) {
+            return exitNodesCache.get(orgId)!;
+        }
+
+        const exitNodes = await listExitNodes(orgId);
+        exitNodesCache.set(orgId, exitNodes);
+
+        return exitNodes;
+    };
+
+    const getIsOrgLicensed = async (orgId: string) => {
+        if (isOrgLicensedCache.has(orgId)) {
+            return isOrgLicensedCache.get(orgId)!;
+        }
+
+        const isOrgLicensed = await isLicensedOrSubscribed(
+            orgId,
+            tierMatrix.deviceApprovals
+        );
+        isOrgLicensedCache.set(orgId, isOrgLicensed);
+
+        return isOrgLicensed;
+    };
+
+    const getExistingClient = async (orgId: string, olmId: string) => {
+        const key = getOrgOlmKey(orgId, olmId);
+        if (existingClientCache.has(key)) {
+            return existingClientCache.get(key) ?? null;
+        }
+
+        const [existingClient] = await trx
+            .select()
+            .from(clients)
+            .where(
+                and(
+                    eq(clients.userId, userId),
+                    eq(clients.orgId, orgId),
+                    eq(clients.olmId, olmId)
+                )
+            )
+            .limit(1);
+
+        existingClientCache.set(key, existingClient ?? null);
+
+        return existingClient ?? null;
+    };
+
+    const hasRoleClientAccess = async (roleId: number, clientId: number) => {
+        const key = getRoleClientKey(roleId, clientId);
+        if (roleClientAccessCache.has(key)) {
+            return roleClientAccessCache.get(key)!;
+        }
+
+        const [existingRoleClient] = await trx
+            .select()
+            .from(roleClients)
+            .where(
+                and(
+                    eq(roleClients.roleId, roleId),
+                    eq(roleClients.clientId, clientId)
+                )
+            )
+            .limit(1);
+
+        const hasAccess = Boolean(existingRoleClient);
+        roleClientAccessCache.set(key, hasAccess);
+
+        return hasAccess;
+    };
+
+    const hasUserClientAccess = async (
+        cachedUserId: string,
+        clientId: number
+    ) => {
+        const key = getUserClientKey(cachedUserId, clientId);
+        if (userClientAccessCache.has(key)) {
+            return userClientAccessCache.get(key)!;
+        }
+
+        const [existingUserClient] = await trx
+            .select()
+            .from(userClients)
+            .where(
+                and(
+                    eq(userClients.userId, cachedUserId),
+                    eq(userClients.clientId, clientId)
+                )
+            )
+            .limit(1);
+
+        const hasAccess = Boolean(existingUserClient);
+        userClientAccessCache.set(key, hasAccess);
+
+        return hasAccess;
+    };
+
+    // Get all OLMs for this user
+    const userOlms = await trx
+        .select()
+        .from(olms)
+        .where(eq(olms.userId, userId));
+
+    if (userOlms.length === 0) {
+        // No OLMs for this user, but we should still clean up any orphaned clients
+        await cleanupOrphanedClients(
+            userId,
+            trx,
+            [],
+            queuedAssociationRebuilds
+        );
+        return;
+    }
+
+    // Get all user orgs with all roles (for org list and role-based logic)
+    const userOrgRoleRows = await trx
+        .select()
+        .from(userOrgs)
+        .innerJoin(
+            userOrgRoles,
+            and(
+                eq(userOrgs.userId, userOrgRoles.userId),
+                eq(userOrgs.orgId, userOrgRoles.orgId)
+            )
+        )
+        .innerJoin(roles, eq(userOrgRoles.roleId, roles.roleId))
+        .where(eq(userOrgs.userId, userId));
+
+    const userOrgIds = [
+        ...new Set(userOrgRoleRows.map((r) => r.userOrgs.orgId))
+    ];
+    const orgIdToRoleRows = new Map<string, (typeof userOrgRoleRows)[0][]>();
+    for (const r of userOrgRoleRows) {
+        const list = orgIdToRoleRows.get(r.userOrgs.orgId) ?? [];
+        list.push(r);
+        orgIdToRoleRows.set(r.userOrgs.orgId, list);
+    }
+    const orgRequiresDeviceApprovalRole = new Map<string, boolean>();
+    for (const [orgId, roleRowsForOrg] of orgIdToRoleRows.entries()) {
+        orgRequiresDeviceApprovalRole.set(
+            orgId,
+            roleRowsForOrg.some((r) => r.roles.requireDeviceApproval)
+        );
+    }
+
+    // For each OLM, ensure there's a client in each org the user is in
+    for (const olm of userOlms) {
+        for (const orgId of orgIdToRoleRows.keys()) {
+            const roleRowsForOrg = orgIdToRoleRows.get(orgId)!;
+            const userOrg = roleRowsForOrg[0].userOrgs;
+
+            const org = await getOrg(orgId);
+
+            if (!org) {
+                logger.warn(
+                    `Skipping org ${orgId} for OLM ${olm.olmId} (user ${userId}): org not found`
+                );
+                continue;
+            }
+
+            if (!org.subnet) {
+                logger.warn(
+                    `Skipping org ${orgId} for OLM ${olm.olmId} (user ${userId}): org has no subnet configured`
+                );
+                continue;
+            }
+
+            // Get admin role for this org (needed for access grants)
+            const adminRole = await getAdminRole(orgId);
+
+            if (!adminRole) {
+                logger.warn(
+                    `Skipping org ${orgId} for OLM ${olm.olmId} (user ${userId}): no admin role found`
+                );
+                continue;
+            }
+
+            // Check if a client already exists for this OLM+user+org combination
+            const existingClient = await getExistingClient(orgId, olm.olmId);
+
+            if (existingClient) {
+                // Ensure admin role has access to the client
+                const hasRoleAccess = await hasRoleClientAccess(
+                    adminRole.roleId,
+                    existingClient.clientId
+                );
+
+                if (!hasRoleAccess) {
+                    await trx.insert(roleClients).values({
+                        roleId: adminRole.roleId,
+                        clientId: existingClient.clientId
+                    });
+                    roleClientAccessCache.set(
+                        getRoleClientKey(
+                            adminRole.roleId,
+                            existingClient.clientId
+                        ),
+                        true
+                    );
+                    logger.debug(
+                        `Granted admin role access to existing client ${existingClient.clientId} for OLM ${olm.olmId} in org ${orgId} (user ${userId})`
+                    );
+                }
+
+                // Ensure user has access to the client
+                const hasUserAccess = await hasUserClientAccess(
+                    userId,
+                    existingClient.clientId
+                );
+
+                if (!hasUserAccess) {
+                    await trx.insert(userClients).values({
+                        userId,
+                        clientId: existingClient.clientId
+                    });
+                    userClientAccessCache.set(
+                        getUserClientKey(userId, existingClient.clientId),
+                        true
+                    );
+                    logger.debug(
+                        `Granted user access to existing client ${existingClient.clientId} for OLM ${olm.olmId} in org ${orgId} (user ${userId})`
+                    );
+                }
+
+                logger.debug(
+                    `Client already exists for OLM ${olm.olmId} in org ${orgId} (user ${userId}), skipping creation`
+                );
+                continue;
+            }
+
+            // Get exit nodes for this org
+            const exitNodesList = await getExitNodes(orgId);
+
+            if (exitNodesList.length === 0) {
+                logger.warn(
+                    `Skipping org ${orgId} for OLM ${olm.olmId} (user ${userId}): no exit nodes found`
+                );
+                continue;
+            }
+
+            const randomExitNode =
+                exitNodesList[Math.floor(Math.random() * exitNodesList.length)];
+
+            // Get next available subnet
+            const { value: newSubnet, release: releaseSubnetLock } =
+                await getNextAvailableClientSubnet(orgId, trx);
+
+            const subnet = newSubnet.split("/")[0];
+            const updatedSubnet = `${subnet}/${org.subnet.split("/")[1]}`;
+
+            const niceId = await getUniqueClientName(orgId);
+
+            const isOrgLicensed = await getIsOrgLicensed(userOrg.orgId);
+            const requireApproval =
+                build !== "oss" &&
+                isOrgLicensed &&
+                orgRequiresDeviceApprovalRole.get(orgId) === true;
+
+            const newClientData: InferInsertModel<typeof clients> = {
+                userId,
+                orgId: userOrg.orgId,
+                exitNodeId: randomExitNode.exitNodeId,
+                name: olm.name || "User Client",
+                subnet: updatedSubnet,
+                olmId: olm.olmId,
+                type: "olm",
+                niceId,
+                approvalState: requireApproval ? "pending" : null
+            };
+
+            // Create the client
+            const [newClient] = await trx
+                .insert(clients)
+                .values(newClientData)
+                .returning();
+            await releaseSubnetLock();
+            existingClientCache.set(getOrgOlmKey(orgId, olm.olmId), newClient);
+
+            // create approval request
+            if (requireApproval) {
+                await trx
+                    .insert(approvals)
+                    .values({
+                        timestamp: Math.floor(new Date().getTime() / 1000),
+                        orgId: userOrg.orgId,
+                        clientId: newClient.clientId,
+                        userId,
+                        type: "user_device"
+                    })
+                    .returning();
+            }
+
+            queuedAssociationRebuilds.push(newClient);
+
+            // Grant admin role access to the client
+            await trx.insert(roleClients).values({
+                roleId: adminRole.roleId,
+                clientId: newClient.clientId
+            });
+            roleClientAccessCache.set(
+                getRoleClientKey(adminRole.roleId, newClient.clientId),
+                true
+            );
+
+            // Grant user access to the client
+            await trx.insert(userClients).values({
+                userId,
+                clientId: newClient.clientId
+            });
+            userClientAccessCache.set(
+                getUserClientKey(userId, newClient.clientId),
+                true
+            );
+
+            logger.debug(
+                `Created client for OLM ${olm.olmId} in org ${orgId} (user ${userId}) with access granted to admin role and user`
+            );
+        }
+    }
+
+    // Clean up clients in orgs the user is no longer in
+    await cleanupOrphanedClients(
+        userId,
+        trx,
+        userOrgIds,
+        queuedAssociationRebuilds
+    );
+
+    runQueuedClientAssociationRebuilds(userId, queuedAssociationRebuilds);
 }

 async function cleanupOrphanedClients(
    userId: string,
    trx: Transaction | typeof db,
-    userOrgIds: string[] = []
+    userOrgIds: string[] = [],
+    queuedAssociationRebuilds: ClientRow[] = []
 ): Promise<void> {
    // Find all OLM clients for this user that should be deleted
    // If userOrgIds is empty, delete all OLM clients (user has no orgs)
@@ -461,9 +474,9 @@ async function cleanupOrphanedClients(
            )
            .returning();

-        // Rebuild associations for each deleted client to clean up related data
+        // Queue deleted clients for post-trx association cleanup.
        for (const deletedClient of deletedClients) {
-            await rebuildClientAssociationsFromClient(deletedClient, trx);
+            queuedAssociationRebuilds.push(deletedClient);

            if (deletedClient.olmId) {
                await sendTerminateClient(
--- a/server/lib/deleteResource.ts
+++ b/server/lib/deleteResource.ts
@@ -0,0 +1,144 @@
+import { eq, inArray } from "drizzle-orm";
+import {
+    db,
+    newts,
+    resourcePolicies,
+    resources,
+    sites,
+    targetHealthCheck,
+    targets,
+    type Resource,
+    type Target,
+    type TargetHealthCheck,
+    type Transaction
+} from "@server/db";
+import logger from "@server/logger";
+import { removeTargets } from "@server/routers/newt/targets";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+
+export type DeleteResourceResult = {
+    deletedResource: Resource;
+    targetsToBeRemoved: Target[];
+    healthChecksToBeRemoved: TargetHealthCheck[];
+};
+
+export async function performDeleteResources(
+    resourceIds: number[],
+    trx: Transaction | typeof db = db
+): Promise<DeleteResourceResult[]> {
+    if (resourceIds.length === 0) {
+        return [];
+    }
+
+    const targetsToBeRemoved = await trx
+        .select()
+        .from(targets)
+        .where(inArray(targets.resourceId, resourceIds));
+
+    const targetIds = targetsToBeRemoved.map((t) => t.targetId);
+    const healthChecksToBeRemoved =
+        targetIds.length > 0
+            ? await trx
+                  .select()
+                  .from(targetHealthCheck)
+                  .where(inArray(targetHealthCheck.targetId, targetIds))
+            : [];
+
+    const deletedResources = await trx
+        .delete(resources)
+        .where(inArray(resources.resourceId, resourceIds))
+        .returning();
+
+    const policyIds = deletedResources
+        .map((resource) => resource.defaultResourcePolicyId)
+        .filter((id): id is number => id != null);
+
+    if (policyIds.length > 0) {
+        await trx
+            .delete(resourcePolicies)
+            .where(inArray(resourcePolicies.resourcePolicyId, policyIds));
+    }
+
+    if (deletedResources.length > 0) {
+        logger.debug(`Deleted ${deletedResources.length} resources`);
+    }
+
+    const targetsByResourceId = new Map<number, Target[]>();
+    for (const target of targetsToBeRemoved) {
+        const existing = targetsByResourceId.get(target.resourceId) ?? [];
+        existing.push(target);
+        targetsByResourceId.set(target.resourceId, existing);
+    }
+
+    const targetIdToResourceId = new Map(
+        targetsToBeRemoved.map((target) => [target.targetId, target.resourceId])
+    );
+
+    const healthChecksByResourceId = new Map<number, TargetHealthCheck[]>();
+    for (const healthCheck of healthChecksToBeRemoved) {
+        const resourceId = targetIdToResourceId.get(healthCheck.targetId!);
+        if (resourceId == null) {
+            continue;
+        }
+        const existing = healthChecksByResourceId.get(resourceId) ?? [];
+        existing.push(healthCheck);
+        healthChecksByResourceId.set(resourceId, existing);
+    }
+
+    return deletedResources.map((deletedResource) => ({
+        deletedResource,
+        targetsToBeRemoved:
+            targetsByResourceId.get(deletedResource.resourceId) ?? [],
+        healthChecksToBeRemoved:
+            healthChecksByResourceId.get(deletedResource.resourceId) ?? []
+    }));
+}
+
+export async function performDeleteResource(
+    resourceId: number,
+    trx: Transaction | typeof db = db
+): Promise<DeleteResourceResult | null> {
+    const [result] = await performDeleteResources([resourceId], trx);
+    return result ?? null;
+}
+
+export async function runResourceDeleteSideEffects(
+    result: DeleteResourceResult
+): Promise<void> {
+    const { deletedResource, targetsToBeRemoved, healthChecksToBeRemoved } =
+        result;
+
+    for (const target of targetsToBeRemoved) {
+        const [site] = await db
+            .select()
+            .from(sites)
+            .where(eq(sites.siteId, target.siteId))
+            .limit(1);
+
+        if (!site) {
+            throw createHttpError(
+                HttpCode.NOT_FOUND,
+                `Site with ID ${target.siteId} not found`
+            );
+        }
+
+        if (site.pubKey && site.type === "newt") {
+            const [newt] = await db
+                .select()
+                .from(newts)
+                .where(eq(newts.siteId, site.siteId))
+                .limit(1);
+
+            if (newt) {
+                await removeTargets(
+                    newt.newtId,
+                    [],
+                    healthChecksToBeRemoved,
+                    deletedResource.mode === "udp" ? "udp" : "tcp",
+                    newt.version
+                );
+            }
+        }
+    }
+}
--- a/server/lib/deleteSiteAssociatedResources.ts
+++ b/server/lib/deleteSiteAssociatedResources.ts
@@ -0,0 +1,126 @@
+import { and, eq, sql } from "drizzle-orm";
+import {
+    db,
+    siteNetworks,
+    siteResources,
+    targets,
+    type SiteResource,
+    type Transaction
+} from "@server/db";
+import {
+    performDeleteResources,
+    runResourceDeleteSideEffects,
+    type DeleteResourceResult
+} from "@server/lib/deleteResource";
+import {
+    performDeleteSiteResources,
+    runSiteResourceDeleteSideEffects
+} from "@server/lib/deleteSiteResource";
+import logger from "@server/logger";
+
+export const MAX_SITE_ASSOCIATED_RESOURCES_FOR_BULK_DELETE = 250;
+
+export type DeleteSiteAssociatedResourcesSideEffects = {
+    resources: DeleteResourceResult[];
+    siteResources: SiteResource[];
+};
+
+export async function getResourceIdsForSite(
+    siteId: number,
+    trx: Transaction | typeof db = db
+): Promise<number[]> {
+    const rows = await trx
+        .selectDistinct({ resourceId: targets.resourceId })
+        .from(targets)
+        .where(eq(targets.siteId, siteId));
+
+    return rows.map((row) => row.resourceId);
+}
+
+export async function getSiteResourceIdsForSite(
+    siteId: number,
+    orgId: string,
+    trx: Transaction | typeof db = db
+): Promise<number[]> {
+    const rows = await trx
+        .selectDistinct({ siteResourceId: siteResources.siteResourceId })
+        .from(siteNetworks)
+        .innerJoin(
+            siteResources,
+            eq(siteResources.networkId, siteNetworks.networkId)
+        )
+        .where(
+            and(eq(siteNetworks.siteId, siteId), eq(siteResources.orgId, orgId))
+        );
+
+    return rows.map((row) => row.siteResourceId);
+}
+
+export async function getAssociatedResourceCountForSite(
+    siteId: number,
+    orgId: string,
+    trx: Transaction | typeof db = db
+): Promise<number> {
+    const [publicCountResult, privateCountResult] = await Promise.all([
+        trx
+            .select({
+                count: sql<number>`count(distinct ${targets.resourceId})`
+            })
+            .from(targets)
+            .where(eq(targets.siteId, siteId)),
+        trx
+            .select({
+                count: sql<number>`count(distinct ${siteResources.siteResourceId})`
+            })
+            .from(siteNetworks)
+            .innerJoin(
+                siteResources,
+                eq(siteResources.networkId, siteNetworks.networkId)
+            )
+            .where(
+                and(
+                    eq(siteNetworks.siteId, siteId),
+                    eq(siteResources.orgId, orgId)
+                )
+            )
+    ]);
+
+    return (
+        Number(publicCountResult[0]?.count ?? 0) +
+        Number(privateCountResult[0]?.count ?? 0)
+    );
+}
+
+export function exceedsSiteAssociatedResourceDeleteLimit(
+    resourceCount: number
+): boolean {
+    return resourceCount > MAX_SITE_ASSOCIATED_RESOURCES_FOR_BULK_DELETE;
+}
+
+export async function deleteAssociatedResourcesForSite(
+    siteId: number,
+    orgId: string,
+    trx: Transaction | typeof db = db
+): Promise<DeleteSiteAssociatedResourcesSideEffects> {
+    const resourceIds = await getResourceIdsForSite(siteId, trx);
+    const siteResourceIds = await getSiteResourceIdsForSite(siteId, orgId, trx);
+
+    const [resources, siteResourcesDeleted] = await Promise.all([
+        performDeleteResources(resourceIds, trx),
+        performDeleteSiteResources(siteResourceIds, trx)
+    ]);
+
+    return { resources, siteResources: siteResourcesDeleted };
+}
+
+export async function runDeleteSiteAssociatedResourcesSideEffects(
+    sideEffects: DeleteSiteAssociatedResourcesSideEffects
+): Promise<void> {
+    for (const result of sideEffects.resources) {
+        await runResourceDeleteSideEffects(result);
+    }
+
+    for (const removed of sideEffects.siteResources) {
+        runSiteResourceDeleteSideEffects(removed);
+    }
+}
--- a/server/lib/deleteSiteResource.ts
+++ b/server/lib/deleteSiteResource.ts
@@ -0,0 +1,53 @@
+import { inArray } from "drizzle-orm";
+import {
+    db,
+    siteResources,
+    type SiteResource,
+    type Transaction
+} from "@server/db";
+import logger from "@server/logger";
+import { rebuildClientAssociationsFromSiteResource } from "@server/lib/rebuildClientAssociations";
+
+export async function performDeleteSiteResources(
+    siteResourceIds: number[],
+    trx: Transaction | typeof db = db
+): Promise<SiteResource[]> {
+    if (siteResourceIds.length === 0) {
+        return [];
+    }
+
+    const removedSiteResources = await trx
+        .delete(siteResources)
+        .where(inArray(siteResources.siteResourceId, siteResourceIds))
+        .returning();
+
+    if (removedSiteResources.length > 0) {
+        logger.debug(`Deleted ${removedSiteResources.length} site resources`);
+    }
+
+    return removedSiteResources;
+}
+
+export async function performDeleteSiteResource(
+    siteResourceId: number,
+    trx: Transaction | typeof db = db
+): Promise<SiteResource | null> {
+    const [removedSiteResource] = await performDeleteSiteResources(
+        [siteResourceId],
+        trx
+    );
+    return removedSiteResource ?? null;
+}
+
+export function runSiteResourceDeleteSideEffects(
+    removedSiteResource: SiteResource
+): void {
+    rebuildClientAssociationsFromSiteResource(removedSiteResource).catch(
+        (err) => {
+            logger.error(
+                `Error rebuilding client associations for site resource ${removedSiteResource.siteResourceId}:`,
+                err
+            );
+        }
+    );
+}
--- a/server/lib/lock.ts
+++ b/server/lib/lock.ts
@@ -1,4 +1,24 @@
+const instanceId = `local-${Math.random().toString(36).slice(2)}-${Date.now()}`;
+
+type LocalLockRecord = {
+    owner: string;
+    expiresAt: number;
+};
+
+const localLocks = new Map<string, LocalLockRecord>();
+
 export class LockManager {
+    private clearExpiredLocalLock(lockKey: string): void {
+        const current = localLocks.get(lockKey);
+        if (current && current.expiresAt <= Date.now()) {
+            localLocks.delete(lockKey);
+        }
+    }
+
+    private getLocalOwnerToken(): string {
+        return `${instanceId}:`;
+    }
+
    /**
     * Acquire a distributed lock using Redis SET with NX and PX options
     * @param lockKey - Unique identifier for the lock
@@ -7,22 +27,57 @@ export class LockManager {
     */
    async acquireLock(
        lockKey: string,
-        ttlMs: number = 30000
+        ttlMs: number = 30000,
+        maxRetries: number = 3,
+        retryDelayMs: number = 100
    ): Promise<boolean> {
-        return true;
+        for (let attempt = 0; attempt < maxRetries; attempt++) {
+            this.clearExpiredLocalLock(lockKey);
+
+            const existing = localLocks.get(lockKey);
+            if (!existing) {
+                localLocks.set(lockKey, {
+                    owner: this.getLocalOwnerToken(),
+                    expiresAt: Date.now() + ttlMs
+                });
+                return true;
+            }
+
+            if (existing.owner === this.getLocalOwnerToken()) {
+                existing.expiresAt = Date.now() + ttlMs;
+                localLocks.set(lockKey, existing);
+                return true;
+            }
+
+            if (attempt < maxRetries - 1) {
+                const delay = retryDelayMs * Math.pow(2, attempt);
+                await new Promise((resolve) => setTimeout(resolve, delay));
+            }
+        }
+
+        return false;
    }

    /**
     * Release a lock using Lua script to ensure atomicity
     * @param lockKey - Unique identifier for the lock
     */
-    async releaseLock(lockKey: string): Promise<void> {}
+    async releaseLock(lockKey: string): Promise<void> {
+        this.clearExpiredLocalLock(lockKey);
+        const existing = localLocks.get(lockKey);
+
+        if (existing && existing.owner === this.getLocalOwnerToken()) {
+            localLocks.delete(lockKey);
+        }
+    }

    /**
     * Force release a lock regardless of owner (use with caution)
     * @param lockKey - Unique identifier for the lock
     */
-    async forceReleaseLock(lockKey: string): Promise<void> {}
+    async forceReleaseLock(lockKey: string): Promise<void> {
+        localLocks.delete(lockKey);
+    }

    /**
     * Check if a lock exists and get its info
@@ -35,7 +90,20 @@ export class LockManager {
        ttl: number;
        owner?: string;
    }> {
-        return { exists: true, ownedByMe: true, ttl: 0 };
+        this.clearExpiredLocalLock(lockKey);
+        const existing = localLocks.get(lockKey);
+
+        if (!existing) {
+            return { exists: false, ownedByMe: false, ttl: 0 };
+        }
+
+        const ttl = Math.max(0, existing.expiresAt - Date.now());
+        return {
+            exists: true,
+            ownedByMe: existing.owner === this.getLocalOwnerToken(),
+            ttl,
+            owner: existing.owner.split(":")[0]
+        };
    }

    /**
@@ -45,6 +113,15 @@ export class LockManager {
     * @returns Promise<boolean> - true if extended successfully
     */
    async extendLock(lockKey: string, ttlMs: number): Promise<boolean> {
+        this.clearExpiredLocalLock(lockKey);
+        const existing = localLocks.get(lockKey);
+
+        if (!existing || existing.owner !== this.getLocalOwnerToken()) {
+            return false;
+        }
+
+        existing.expiresAt = Date.now() + ttlMs;
+        localLocks.set(lockKey, existing);
        return true;
    }

@@ -62,7 +139,26 @@ export class LockManager {
        maxRetries: number = 5,
        baseDelayMs: number = 100
    ): Promise<boolean> {
-        return true;
+        for (let attempt = 0; attempt <= maxRetries; attempt++) {
+            const acquired = await this.acquireLock(
+                lockKey,
+                ttlMs,
+                1,
+                baseDelayMs
+            );
+
+            if (acquired) {
+                return true;
+            }
+
+            if (attempt < maxRetries) {
+                const delay =
+                    baseDelayMs * Math.pow(2, attempt) + Math.random() * 100;
+                await new Promise((resolve) => setTimeout(resolve, delay));
+            }
+        }
+
+        return false;
    }

    /**
@@ -99,7 +195,21 @@ export class LockManager {
        activeLocksCount: number;
        locksOwnedByMe: number;
    }> {
-        return { activeLocksCount: 0, locksOwnedByMe: 0 };
+        const now = Date.now();
+        for (const [key, value] of localLocks.entries()) {
+            if (value.expiresAt <= now) {
+                localLocks.delete(key);
+            }
+        }
+
+        let locksOwnedByMe = 0;
+        for (const value of localLocks.values()) {
+            if (value.owner === this.getLocalOwnerToken()) {
+                locksOwnedByMe++;
+            }
+        }
+
+        return { activeLocksCount: localLocks.size, locksOwnedByMe };
    }

    /**
--- a/server/lib/rebuildClientAssociations.ts
+++ b/server/lib/rebuildClientAssociations.ts
@@ -35,10 +35,13 @@ import {
    parseEndpoint
 } from "@server/lib/ip";
 import {
+    addPeerData,
    addPeerDataBatch,
    addTargetsBatch as addSubnetProxyTargetsBatch,
    removePeerDataBatch,
-    removeTargetsBatch as removeSubnetProxyTargetsBatch
+    removeTargetsBatch as removeSubnetProxyTargetsBatch,
+    updatePeerDataBatch,
+    updateTargets
 } from "@server/routers/client/targets";
 import { lockManager } from "#dynamic/lib/lock";
 import { rebuildQueue } from "#dynamic/lib/rebuildQueue";
@@ -47,6 +50,112 @@ import { rebuildQueue } from "#dynamic/lib/rebuildQueue";
 // peer/proxy updates, so give them a generous window.
 const REBUILD_ASSOCIATIONS_LOCK_TTL_MS = 120000;

+const REBUILD_IDLE_POLL_INTERVAL_MS = 300;
+const REBUILD_IDLE_DEFAULT_TIMEOUT_MS = 130_000; // slightly longer than lock TTL
+const REBUILD_IDLE_HANDLER_TIMEOUT_MS = 5_000;
+
+/**
+ * Returns true if a rebuild for the given site resource is currently active
+ * (holding the distributed lock) or is pending in the rebuild queue.
+ */
+export async function hasActiveSiteResourceRebuild(
+    siteResourceId: number
+): Promise<boolean> {
+    const lockKey = `rebuild-client-associations:site-resource:${siteResourceId}`;
+    const lockInfo = await lockManager.getLockInfo(lockKey);
+    if (lockInfo.exists) return true;
+    return rebuildQueue.isQueued({ type: "site-resource", id: siteResourceId });
+}
+
+/**
+ * Resolves once there is no active or queued rebuild for the given site resource.
+ * Logs a warning and resolves early if the timeout is reached.
+ */
+export async function waitForSiteResourceRebuildIdle(
+    siteResourceId: number,
+    timeoutMs = REBUILD_IDLE_DEFAULT_TIMEOUT_MS
+): Promise<void> {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (!(await hasActiveSiteResourceRebuild(siteResourceId))) return;
+        await new Promise<void>((r) =>
+            setTimeout(r, REBUILD_IDLE_POLL_INTERVAL_MS)
+        );
+    }
+    logger.warn(
+        `waitForSiteResourceRebuildIdle: timed out after ${timeoutMs}ms waiting for siteResourceId=${siteResourceId}`
+    );
+}
+
+/**
+ * Resolves once there are no active or queued rebuilds for any site resource
+ * associated with the given site.
+ */
+export async function waitForSiteRebuildIdle(
+    siteId: number,
+    timeoutMs = REBUILD_IDLE_HANDLER_TIMEOUT_MS
+): Promise<void> {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        const resourceRows = await db
+            .select({ siteResourceId: siteResources.siteResourceId })
+            .from(siteResources)
+            .innerJoin(
+                siteNetworks,
+                eq(siteNetworks.networkId, siteResources.networkId)
+            )
+            .where(eq(siteNetworks.siteId, siteId));
+        let allIdle = true;
+        for (const { siteResourceId } of resourceRows) {
+            if (await hasActiveSiteResourceRebuild(siteResourceId)) {
+                allIdle = false;
+                break;
+            }
+        }
+        if (allIdle) return;
+        await new Promise<void>((r) =>
+            setTimeout(r, REBUILD_IDLE_POLL_INTERVAL_MS)
+        );
+    }
+    logger.warn(
+        `waitForSiteRebuildIdle: timed out after ${timeoutMs}ms waiting for siteId=${siteId}`
+    );
+}
+
+/**
+ * Resolves once there are no active or queued rebuilds for any site resource
+ * associated with the given client.
+ */
+export async function waitForClientRebuildIdle(
+    clientId: number,
+    timeoutMs = REBUILD_IDLE_HANDLER_TIMEOUT_MS
+): Promise<void> {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        const resourceRows = await db
+            .select({
+                siteResourceId:
+                    clientSiteResourcesAssociationsCache.siteResourceId
+            })
+            .from(clientSiteResourcesAssociationsCache)
+            .where(eq(clientSiteResourcesAssociationsCache.clientId, clientId));
+        let allIdle = true;
+        for (const { siteResourceId } of resourceRows) {
+            if (await hasActiveSiteResourceRebuild(siteResourceId)) {
+                allIdle = false;
+                break;
+            }
+        }
+        if (allIdle) return;
+        await new Promise<void>((r) =>
+            setTimeout(r, REBUILD_IDLE_POLL_INTERVAL_MS)
+        );
+    }
+    logger.warn(
+        `waitForClientRebuildIdle: timed out after ${timeoutMs}ms waiting for clientId=${clientId}`
+    );
+}
+
 export async function getClientSiteResourceAccess(
    siteResource: SiteResource,
    trx: Transaction | typeof db = db
@@ -160,17 +269,12 @@ export async function getClientSiteResourceAccess(
 }

 export async function rebuildClientAssociationsFromSiteResource(
-    siteResource: SiteResource,
-    trx: Transaction | typeof db = db
+    siteResource: SiteResource
 ) {
    try {
        return await lockManager.withLock(
            `rebuild-client-associations:site-resource:${siteResource.siteResourceId}`,
-            () =>
-                rebuildClientAssociationsFromSiteResourceImpl(
-                    siteResource,
-                    trx
-                ),
+            () => rebuildClientAssociationsFromSiteResourceImpl(siteResource),
            REBUILD_ASSOCIATIONS_LOCK_TTL_MS
        );
    } catch (err: any) {
@@ -192,15 +296,10 @@ export async function rebuildClientAssociationsFromSiteResource(
 }

 async function rebuildClientAssociationsFromSiteResourceImpl(
-    siteResource: SiteResource,
-    trx: Transaction | typeof db = db
-): Promise<{
-    mergedAllClients: {
-        clientId: number;
-        pubKey: string | null;
-        subnet: string | null;
-    }[];
-}> {
+    siteResource: SiteResource
+) {
+    const trx = primaryDb;
+
    logger.debug(
        `rebuildClientAssociations: [rebuildClientAssociationsFromSiteResource] START siteResourceId=${siteResource.siteResourceId} networkId=${siteResource.networkId} orgId=${siteResource.orgId}`
    );
@@ -214,14 +313,62 @@ async function rebuildClientAssociationsFromSiteResourceImpl(

    /////////// process the client-siteResource associations ///////////

+    const existingClientSiteResources = await trx
+        .select({
+            clientId: clientSiteResourcesAssociationsCache.clientId
+        })
+        .from(clientSiteResourcesAssociationsCache)
+        .where(
+            eq(
+                clientSiteResourcesAssociationsCache.siteResourceId,
+                siteResource.siteResourceId
+            )
+        );
+
+    const existingClientSiteResourceIds = existingClientSiteResources.map(
+        (row) => row.clientId
+    );
+
    // get all of the clients associated with other site resources that share
    // any of the same sites as this site resource (via siteNetworks). We can't
    // simply filter by networkId since each site resource has its own network;
    // two site resources serving the same site typically belong to different
    // networks that both happen to include the site through siteNetworks.
    const sitesListSiteIds = sitesList.map((s) => s.siteId);
+
+    // We must also consider sites where these clients are currently cached,
+    // otherwise removing a site from this resource can leave stale
+    // client-site cache entries behind for the removed site.
+    const cachedSiteRowsForResourceClients =
+        existingClientSiteResourceIds.length > 0
+            ? await trx
+                  .select({ siteId: clientSitesAssociationsCache.siteId })
+                  .from(clientSitesAssociationsCache)
+                  .where(
+                      inArray(
+                          clientSitesAssociationsCache.clientId,
+                          existingClientSiteResourceIds
+                      )
+                  )
+            : [];
+
+    const allCandidateSiteIds = Array.from(
+        new Set([
+            ...sitesListSiteIds,
+            ...cachedSiteRowsForResourceClients.map((r) => r.siteId)
+        ])
+    );
+
+    const sitesToProcess =
+        allCandidateSiteIds.length > 0
+            ? await trx
+                  .select()
+                  .from(sites)
+                  .where(inArray(sites.siteId, allCandidateSiteIds))
+            : [];
+    const currentSiteIdSet = new Set(sitesListSiteIds);
    const allUpdatedClientsFromOtherResourcesOnThisSite =
-        sitesListSiteIds.length > 0
+        allCandidateSiteIds.length > 0
            ? await trx
                  .select({
                      clientId: clientSiteResourcesAssociationsCache.clientId,
@@ -241,7 +388,7 @@ async function rebuildClientAssociationsFromSiteResourceImpl(
                  )
                  .where(
                      and(
-                          inArray(siteNetworks.siteId, sitesListSiteIds),
+                          inArray(siteNetworks.siteId, allCandidateSiteIds),
                          ne(
                              siteResources.siteResourceId,
                              siteResource.siteResourceId
@@ -260,22 +407,6 @@ async function rebuildClientAssociationsFromSiteResourceImpl(
        clientsFromOtherResourcesBySite.get(row.siteId)!.add(row.clientId);
    }

-    const existingClientSiteResources = await trx
-        .select({
-            clientId: clientSiteResourcesAssociationsCache.clientId
-        })
-        .from(clientSiteResourcesAssociationsCache)
-        .where(
-            eq(
-                clientSiteResourcesAssociationsCache.siteResourceId,
-                siteResource.siteResourceId
-            )
-        );
-
-    const existingClientSiteResourceIds = existingClientSiteResources.map(
-        (row) => row.clientId
-    );
-
    logger.debug(
        `rebuildClientAssociations: [rebuildClientAssociationsFromSiteResource] siteResourceId=${siteResource.siteResourceId} existingResourceClientIds=[${existingClientSiteResourceIds.join(", ")}]`
    );
@@ -358,10 +489,10 @@ async function rebuildClientAssociationsFromSiteResourceImpl(
    /////////// process the client-site associations ///////////

    logger.debug(
-        `rebuildClientAssociations: [rebuildClientAssociationsFromSiteResource] siteResourceId=${siteResource.siteResourceId} beginning client-site association loop over ${sitesList.length} site(s)`
+        `rebuildClientAssociations: [rebuildClientAssociationsFromSiteResource] siteResourceId=${siteResource.siteResourceId} beginning client-site association loop over ${sitesToProcess.length} site(s) (current=${sitesList.length})`
    );

-    for (const site of sitesList) {
+    for (const site of sitesToProcess) {
        const siteId = site.siteId;

        logger.debug(
@@ -403,7 +534,13 @@ async function rebuildClientAssociationsFromSiteResourceImpl(
            `rebuildClientAssociations: [rebuildClientAssociationsFromSiteResource] siteId=${siteId} otherResourceClientIds=[${[...otherResourceClientIds].join(", ")}] mergedAllClientIds=[${mergedAllClientIds.join(", ")}]`
        );

-        const clientSitesToAdd = mergedAllClientIds.filter(
+        // Expected clients from this resource are site-scoped: if this site is
+        // no longer attached to the resource, the expected set is empty.
+        const expectedClientIdsForSite = currentSiteIdSet.has(siteId)
+            ? mergedAllClientIds
+            : [];
+
+        const clientSitesToAdd = expectedClientIdsForSite.filter(
            (clientId) =>
                !existingClientSiteIds.includes(clientId) &&
                !otherResourceClientIds.has(clientId) // dont add if already connected via another site resource
@@ -438,7 +575,7 @@ async function rebuildClientAssociationsFromSiteResourceImpl(
        // Now remove any client-site associations that should no longer exist
        const clientSitesToRemove = existingClientSiteIds.filter(
            (clientId) =>
-                !mergedAllClientIds.includes(clientId) &&
+                !expectedClientIdsForSite.includes(clientId) &&
                !otherResourceClientIds.has(clientId) // dont remove if there is still another connection for another site resource
        );

@@ -485,10 +622,6 @@ async function rebuildClientAssociationsFromSiteResourceImpl(
        clientSiteResourcesToRemove,
        trx
    );
-
-    return {
-        mergedAllClients
-    };
 }

 async function handleMessagesForSiteClients(
@@ -1042,10 +1175,470 @@ async function handleSubnetProxyTargetUpdates(
    await Promise.all([...proxyJobs, ...olmJobs]);
 }

+export async function handleMessagingForUpdatedSiteResource(
+    existingSiteResource: SiteResource | undefined,
+    updatedSiteResource: SiteResource,
+    existingSiteIds: number[],
+    updatedSiteIds: number[]
+) {
+    const trx = primaryDb;
+
+    logger.debug(
+        `handleMessagingForUpdatedSiteResource: START siteResourceId=${updatedSiteResource.siteResourceId} existingSiteIds=[${existingSiteIds.join(", ")}] updatedSiteIds=[${updatedSiteIds.join(", ")}]`
+    );
+
+    logger.debug(
+        "handleMessagingForUpdatedSiteResource: existingSiteResource is: ",
+        existingSiteResource
+    );
+    logger.debug(
+        "handleMessagingForUpdatedSiteResource: updatedSiteResource is: ",
+        updatedSiteResource
+    );
+
+    const allSiteIds = [...new Set([...existingSiteIds, ...updatedSiteIds])];
+
+    logger.debug(
+        `handleMessagingForUpdatedSiteResource: allSiteIds=[${allSiteIds.join(", ")}] count=${allSiteIds.length}`
+    );
+
+    const newtsForSites =
+        allSiteIds.length > 0
+            ? await trx
+                  .select()
+                  .from(newts)
+                  .where(inArray(newts.siteId, allSiteIds))
+            : [];
+    const newtBySiteId = new Map(
+        newtsForSites.map((newt) => [newt.siteId, newt])
+    );
+
+    logger.debug(
+        `handleMessagingForUpdatedSiteResource: fetched newts for ${newtsForSites.length}/${allSiteIds.length} site(s)`
+    );
+
+    // WARNING: THIS RELIES ON THE CACHE TABLES BEING UP TO DATE, SO CALL THIS AFTER THE ASSOCIATION CACHE IS UPDATED
+    const mergedAllClients = await trx
+        .select({
+            clientId: clientSiteResourcesAssociationsCache.clientId,
+            pubKey: clients.pubKey,
+            subnet: clients.subnet
+        })
+        .from(clientSiteResourcesAssociationsCache)
+        .innerJoin(
+            clients,
+            eq(clientSiteResourcesAssociationsCache.clientId, clients.clientId)
+        )
+        .where(
+            eq(
+                clientSiteResourcesAssociationsCache.siteResourceId,
+                updatedSiteResource.siteResourceId
+            )
+        );
+
+    logger.debug(
+        `handleMessagingForUpdatedSiteResource: resolved merged clients count=${mergedAllClients.length} clientIds=[${mergedAllClients.map((c) => c.clientId).join(", ")}]`
+    );
+
+    const targets = await generateSubnetProxyTargetV2(
+        updatedSiteResource,
+        mergedAllClients
+    );
+
+    logger.debug(
+        `handleMessagingForUpdatedSiteResource: generated updated targets count=${targets ? targets.length : 0}`
+    );
+
+    const oldDestinationStillInUseClientSitePairs = new Set<string>();
+    if (
+        existingSiteResource?.destination &&
+        allSiteIds.length > 0 &&
+        mergedAllClients.length > 0
+    ) {
+        logger.debug(
+            `handleMessagingForUpdatedSiteResource: checking old destination reuse destination=${existingSiteResource.destination} across siteCount=${allSiteIds.length} clientCount=${mergedAllClients.length}`
+        );
+
+        // we need to do this because the client only knows about peers not resources so we need to make sure that we dont remove it if there is still a another resource
+        const oldDestinationStillInUseRows = await trx
+            .select({
+                clientId: clientSiteResourcesAssociationsCache.clientId,
+                siteId: siteNetworks.siteId
+            })
+            .from(siteResources)
+            .innerJoin(
+                clientSiteResourcesAssociationsCache,
+                eq(
+                    clientSiteResourcesAssociationsCache.siteResourceId,
+                    siteResources.siteResourceId
+                )
+            )
+            .innerJoin(
+                siteNetworks,
+                eq(siteNetworks.networkId, siteResources.networkId)
+            )
+            .where(
+                and(
+                    inArray(
+                        clientSiteResourcesAssociationsCache.clientId,
+                        mergedAllClients.map((c) => c.clientId)
+                    ),
+                    inArray(siteNetworks.siteId, allSiteIds),
+                    eq(
+                        siteResources.destination,
+                        existingSiteResource.destination
+                    ),
+                    ne(
+                        siteResources.siteResourceId,
+                        existingSiteResource.siteResourceId
+                    )
+                )
+            );
+
+        for (const row of oldDestinationStillInUseRows) {
+            oldDestinationStillInUseClientSitePairs.add(
+                `${row.clientId}:${row.siteId}`
+            );
+        }
+
+        logger.debug(
+            `handleMessagingForUpdatedSiteResource: old destination still in use rows=${oldDestinationStillInUseRows.length} uniqueClientSitePairs=${oldDestinationStillInUseClientSitePairs.size}`
+        );
+    } else {
+        logger.debug(
+            "handleMessagingForUpdatedSiteResource: skipping old destination reuse check (missing existing destination or no sites/clients)"
+        );
+    }
+
+    //////////////////////////// FROM HERE DOWN WE ARE DEALING WITH REMOVING SITES
+    const removedSiteIds = existingSiteIds.filter(
+        (id) => !updatedSiteIds.includes(id)
+    );
+
+    logger.debug(
+        `handleMessagingForUpdatedSiteResource: removing sites removedSiteIds=[${removedSiteIds.join(", ")}] count=${removedSiteIds.length}`
+    );
+
+    const targetsToRemoveBatch: {
+        newtId: string;
+        targets: any[];
+        version: string | null;
+    }[] = [];
+    const peerDataRemoves: {
+        clientId: number;
+        siteId: number;
+        remoteSubnets: string[];
+        aliases: ReturnType<typeof generateAliasConfig>;
+    }[] = [];
+    if (targets) {
+        for (const siteId of removedSiteIds) {
+            const newt = newtBySiteId.get(siteId);
+            if (!newt) {
+                logger.debug(
+                    `handleMessagingForUpdatedSiteResource: skipping remove for siteId=${siteId} because no newt found`
+                );
+                continue;
+            }
+
+            logger.debug(
+                `handleMessagingForUpdatedSiteResource: preparing remove batches for siteId=${siteId} newtId=${newt.newtId}`
+            );
+
+            targetsToRemoveBatch.push({
+                newtId: newt.newtId,
+                targets: targets,
+                version: newt.version
+            });
+            for (const client of mergedAllClients) {
+                // we need to do this because the client only knows about peers not resources so we need to make sure that we dont remove it if there is still a another resource
+                const oldDestinationStillInUseBySite =
+                    oldDestinationStillInUseClientSitePairs.has(
+                        `${client.clientId}:${siteId}`
+                    );
+
+                if (existingSiteResource) {
+                    peerDataRemoves.push({
+                        // this might happen twice after the rebuild function but that is okay
+                        clientId: client.clientId,
+                        siteId,
+                        remoteSubnets: !oldDestinationStillInUseBySite
+                            ? generateRemoteSubnets([existingSiteResource])
+                            : [],
+                        aliases: generateAliasConfig([existingSiteResource])
+                    });
+                }
+            }
+        }
+    } else {
+        logger.debug(
+            "handleMessagingForUpdatedSiteResource: skipping removal batch generation because targets were empty"
+        );
+    }
+
+    logger.debug(
+        `handleMessagingForUpdatedSiteResource: remove batches prepared targetBatchCount=${targetsToRemoveBatch.length} peerDataCount=${peerDataRemoves.length}`
+    );
+
+    logger.debug(
+        "handleMessagingForUpdatedSiteResource: dispatching removeSubnetProxyTargetsBatch"
+    );
+
+    removeSubnetProxyTargetsBatch(targetsToRemoveBatch);
+
+    logger.debug(
+        "handleMessagingForUpdatedSiteResource: dispatching removePeerDataBatch"
+    );
+
+    removePeerDataBatch(peerDataRemoves);
+
+    //////////////////////////// FROM HERE DOWN WE ARE DEALING WITH ADDING NEW SITES
+    const addedSiteIds = updatedSiteIds.filter(
+        (id) => !existingSiteIds.includes(id)
+    );
+
+    logger.debug(
+        `handleMessagingForUpdatedSiteResource: adding sites addedSiteIds=[${addedSiteIds.join(", ")}] count=${addedSiteIds.length}`
+    );
+
+    const targetsToAddBatch: {
+        newtId: string;
+        targets: any[];
+        version: string | null;
+    }[] = [];
+    const peerDataAdds: {
+        clientId: number;
+        siteId: number;
+        remoteSubnets: string[];
+        aliases: ReturnType<typeof generateAliasConfig>;
+    }[] = [];
+    if (targets) {
+        for (const siteId of addedSiteIds) {
+            const newt = newtBySiteId.get(siteId);
+            if (!newt) {
+                logger.debug(
+                    `handleMessagingForUpdatedSiteResource: skipping add for siteId=${siteId} because no newt found`
+                );
+                continue;
+            }
+
+            logger.debug(
+                `handleMessagingForUpdatedSiteResource: preparing add batches for siteId=${siteId} newtId=${newt.newtId}`
+            );
+
+            targetsToAddBatch.push({
+                newtId: newt.newtId,
+                targets: targets,
+                version: newt.version
+            });
+            for (const client of mergedAllClients) {
+                peerDataAdds.push({
+                    clientId: client.clientId,
+                    siteId,
+                    remoteSubnets: generateRemoteSubnets([updatedSiteResource]),
+                    aliases: generateAliasConfig([updatedSiteResource])
+                });
+            }
+        }
+    } else {
+        logger.debug(
+            "handleMessagingForUpdatedSiteResource: skipping add batch generation because targets were empty"
+        );
+    }
+
+    logger.debug(
+        `handleMessagingForUpdatedSiteResource: add batches prepared targetBatchCount=${targetsToAddBatch.length} peerDataCount=${peerDataAdds.length}`
+    );
+
+    logger.debug(
+        "handleMessagingForUpdatedSiteResource: dispatching addSubnetProxyTargetsBatch"
+    );
+
+    addSubnetProxyTargetsBatch(targetsToAddBatch);
+
+    logger.debug(
+        "handleMessagingForUpdatedSiteResource: dispatching addPeerDataBatch"
+    );
+
+    addPeerDataBatch(peerDataAdds);
+
+    //////////////////////////// FROM HERE DOWN WE ARE DEALING WITH UPDATING THE EXISTING SITES
+
+    const unchangedSiteIds = existingSiteIds.filter((id) =>
+        updatedSiteIds.includes(id)
+    );
+
+    logger.debug(
+        `handleMessagingForUpdatedSiteResource: unchangedSiteIds=[${unchangedSiteIds.join(", ")}] count=${unchangedSiteIds.length}`
+    );
+
+    // after everything is rebuilt above we still need to update the targets and remote subnets if the destination changed
+    const destinationChanged =
+        existingSiteResource &&
+        existingSiteResource.destination !== updatedSiteResource.destination;
+    const destinationPortChanged =
+        existingSiteResource &&
+        existingSiteResource.destinationPort !==
+            updatedSiteResource.destinationPort;
+    const aliasChanged =
+        existingSiteResource &&
+        existingSiteResource.alias !== updatedSiteResource.alias;
+    const fullDomainChanged =
+        existingSiteResource &&
+        existingSiteResource.fullDomain !== updatedSiteResource.fullDomain;
+    const sslChanged =
+        existingSiteResource &&
+        existingSiteResource.ssl !== updatedSiteResource.ssl;
+    const portRangesChanged =
+        existingSiteResource &&
+        (existingSiteResource.tcpPortRangeString !==
+            updatedSiteResource.tcpPortRangeString ||
+            existingSiteResource.udpPortRangeString !==
+                updatedSiteResource.udpPortRangeString ||
+            existingSiteResource.disableIcmp !==
+                updatedSiteResource.disableIcmp);
+
+    logger.debug(
+        `handleMessagingForUpdatedSiteResource: change flags destinationChanged=${Boolean(destinationChanged)} destinationPortChanged=${Boolean(destinationPortChanged)} aliasChanged=${Boolean(aliasChanged)} fullDomainChanged=${Boolean(fullDomainChanged)} sslChanged=${Boolean(sslChanged)} portRangesChanged=${Boolean(portRangesChanged)}`
+    );
+
+    // if the existingSiteResource is undefined (new resource) we don't need to do anything here, the rebuild above handled it all
+
+    if (
+        destinationChanged ||
+        aliasChanged ||
+        fullDomainChanged ||
+        sslChanged ||
+        portRangesChanged ||
+        destinationPortChanged
+    ) {
+        const shouldUpdateTargets =
+            destinationChanged ||
+            sslChanged ||
+            portRangesChanged ||
+            fullDomainChanged ||
+            destinationPortChanged;
+
+        logger.debug(
+            `handleMessagingForUpdatedSiteResource: entering unchanged-site update path shouldUpdateTargets=${shouldUpdateTargets}`
+        );
+
+        const oldTargets = shouldUpdateTargets
+            ? await generateSubnetProxyTargetV2(
+                  existingSiteResource,
+                  mergedAllClients
+              )
+            : [];
+        const newTargets = shouldUpdateTargets
+            ? await generateSubnetProxyTargetV2(
+                  updatedSiteResource,
+                  mergedAllClients
+              )
+            : [];
+
+        logger.debug(
+            `handleMessagingForUpdatedSiteResource: target update payload sizes oldTargets=${oldTargets ? oldTargets.length : 0} newTargets=${newTargets ? newTargets.length : 0}`
+        );
+
+        const peerDataUpdateBatch: Parameters<typeof updatePeerDataBatch>[0] =
+            [];
+
+        for (const siteId of unchangedSiteIds) {
+            const newt = newtBySiteId.get(siteId);
+
+            logger.debug(
+                `handleMessagingForUpdatedSiteResource: processing unchanged siteId=${siteId}`
+            );
+
+            if (!newt) {
+                logger.error(
+                    `handleMessagingForUpdatedSiteResource: missing newt for unchanged siteId=${siteId}`
+                );
+                throw new Error(
+                    "Newt not found for site during site resource update"
+                );
+            }
+
+            // Only update targets on newt if these items change
+            if (shouldUpdateTargets) {
+                logger.debug(
+                    `handleMessagingForUpdatedSiteResource: updating targets for siteId=${siteId} newtId=${newt.newtId}`
+                );
+                await updateTargets(
+                    newt.newtId,
+                    {
+                        oldTargets: oldTargets ? oldTargets : [],
+                        newTargets: newTargets ? newTargets : []
+                    },
+                    newt.version
+                );
+            }
+
+            for (const client of mergedAllClients) {
+                // does this client have access to another resource on this site that has the same destination still? if so we dont want to remove it from their olm yet
+                if (!existingSiteResource.destination) {
+                    logger.debug(
+                        `handleMessagingForUpdatedSiteResource: skipping peerData update for clientId=${client.clientId} siteId=${siteId} because existing destination is empty`
+                    );
+                    continue;
+                }
+
+                // we need to do this because the client only knows about peers not resources so we need to make sure that we dont remove it if there is still a another resource
+                const oldDestinationStillInUseBySite =
+                    oldDestinationStillInUseClientSitePairs.has(
+                        `${client.clientId}:${siteId}`
+                    );
+
+                // we also need to update the remote subnets on the olms for each client that has access to this site
+                peerDataUpdateBatch.push({
+                    clientId: client.clientId,
+                    siteId,
+                    remoteSubnets: destinationChanged
+                        ? {
+                              oldRemoteSubnets: !oldDestinationStillInUseBySite
+                                  ? generateRemoteSubnets([
+                                        existingSiteResource
+                                    ])
+                                  : [],
+                              newRemoteSubnets: generateRemoteSubnets([
+                                  updatedSiteResource
+                              ])
+                          }
+                        : undefined,
+                    aliases:
+                        aliasChanged || fullDomainChanged // the full domain is sent down as an alias
+                            ? {
+                                  oldAliases: generateAliasConfig([
+                                      existingSiteResource
+                                  ]),
+                                  newAliases: generateAliasConfig([
+                                      updatedSiteResource
+                                  ])
+                              }
+                            : undefined
+                });
+            }
+        }
+
+        logger.debug(
+            `handleMessagingForUpdatedSiteResource: dispatching updatePeerDataBatch count=${peerDataUpdateBatch.length}`
+        );
+
+        updatePeerDataBatch(peerDataUpdateBatch);
+    } else {
+        logger.debug(
+            "handleMessagingForUpdatedSiteResource: no unchanged-site update required because no relevant fields changed"
+        );
+    }
+
+    logger.debug(
+        `handleMessagingForUpdatedSiteResource: DONE siteResourceId=${updatedSiteResource.siteResourceId}`
+    );
+}
+
 export async function rebuildClientAssociationsFromClient(
-    client: Client,
-    trx: Transaction | typeof db = db
+    client: Client
 ): Promise<void> {
+    const trx = primaryDb;
    try {
        return await lockManager.withLock(
            `rebuild-client-associations:client:${client.clientId}`,
@@ -1776,7 +2369,7 @@ async function handleMessagesForClientResources(
                            )
                        );

-                    // Only remove remote subnet if no other resource uses the same destination
+                    // Only remove remote subnet if no other resource uses the same destination on the same site
                    const remoteSubnetsToRemove =
                        destinationStillInUse.length > 0
                            ? []
@@ -2119,10 +2712,7 @@ export function startRebuildQueueProcessor(): void {
                return;
            }

-            await rebuildClientAssociationsFromSiteResource(
-                siteResource,
-                primaryDb
-            );
+            await rebuildClientAssociationsFromSiteResource(siteResource);
        },
        onClient: async (clientId: number) => {
            const [client] = await primaryDb
@@ -2137,7 +2727,7 @@ export function startRebuildQueueProcessor(): void {
                return;
            }

-            await rebuildClientAssociationsFromClient(client, primaryDb);
+            await rebuildClientAssociationsFromClient(client);
        }
    });
 }
--- a/server/lib/rebuildQueue.ts
+++ b/server/lib/rebuildQueue.ts
@@ -13,11 +13,15 @@ export interface RebuildJobHandlers {
 export interface RebuildQueueManager {
    enqueue(job: RebuildJob): Promise<void>;
    startProcessing(handlers: RebuildJobHandlers): void;
+    isQueued(job: RebuildJob): Promise<boolean>;
 }

 class NoopRebuildQueue implements RebuildQueueManager {
    async enqueue(_job: RebuildJob): Promise<void> {}
    startProcessing(_handlers: RebuildJobHandlers): void {}
+    async isQueued(_job: RebuildJob): Promise<boolean> {
+        return false;
+    }
 }

 export const rebuildQueue: RebuildQueueManager = new NoopRebuildQueue();
--- a/server/lib/statusHistory.ts
+++ b/server/lib/statusHistory.ts
@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { db, logsDb, statusHistory } from "@server/db";
-import { and, eq, gte, asc } from "drizzle-orm";
+import { and, eq, gte, lt, asc, desc } from "drizzle-orm";
 import { regionalCache as cache } from "#dynamic/lib/cache";

 const STATUS_HISTORY_CACHE_TTL = 60; // seconds
@@ -42,7 +42,29 @@ export async function getCachedStatusHistory(
        )
        .orderBy(asc(statusHistory.timestamp));

-    const { buckets, totalDowntime } = computeBuckets(events, days);
+    // Fetch the last known state before the window so that entities that
+    // haven't changed status recently still show the correct status rather
+    // than appearing as "no_data".
+    const [lastKnownEvent] = await logsDb
+        .select()
+        .from(statusHistory)
+        .where(
+            and(
+                eq(statusHistory.entityType, entityType),
+                eq(statusHistory.entityId, entityId),
+                lt(statusHistory.timestamp, startSec)
+            )
+        )
+        .orderBy(desc(statusHistory.timestamp))
+        .limit(1);
+
+    const priorStatus = lastKnownEvent?.status ?? null;
+
+    const { buckets, totalDowntime } = computeBuckets(
+        events,
+        days,
+        priorStatus
+    );
    const totalWindow = days * 86400;
    const overallUptime =
        totalWindow > 0
@@ -110,7 +132,8 @@ export function computeBuckets(
        timestamp: number;
        id: number;
    }[],
-    days: number
+    days: number,
+    priorStatus: string | null = null
 ): { buckets: StatusHistoryDayBucket[]; totalDowntime: number } {
    const nowSec = Math.floor(Date.now() / 1000);

@@ -136,7 +159,10 @@ export function computeBuckets(
            .filter((e) => e.timestamp < dayStartSec)
            .at(-1);

-        const currentStatus = lastBeforeDay?.status ?? null;
+        // Fall back to the last known state before the entire query window
+        // so that entities that haven't generated events recently still show
+        // as their actual status rather than "no_data".
+        const currentStatus = lastBeforeDay?.status ?? priorStatus ?? null;

        const windows: { start: number; end: number | null; status: string }[] =
            [];
--- a/server/middlewares/verifyAccessTokenAccess.ts
+++ b/server/middlewares/verifyAccessTokenAccess.ts
@@ -119,8 +119,7 @@ export async function verifyAccessTokenAccess(
                return next(
                    createHttpError(
                        HttpCode.FORBIDDEN,
-                        "Failed organization access policy check: " +
-                            (policyCheck.error || "Unknown error")
+                        "" + (policyCheck.error || "Unknown error")
                    )
                );
            }
--- a/server/middlewares/verifyAdmin.ts
+++ b/server/middlewares/verifyAdmin.ts
@@ -56,8 +56,7 @@ export async function verifyAdmin(
            return next(
                createHttpError(
                    HttpCode.FORBIDDEN,
-                    "Failed organization access policy check: " +
-                        (policyCheck.error || "Unknown error")
+                    "" + (policyCheck.error || "Unknown error")
                )
            );
        }
--- a/server/middlewares/verifyApiKeyAccess.ts
+++ b/server/middlewares/verifyApiKeyAccess.ts
@@ -113,8 +113,7 @@ export async function verifyApiKeyAccess(
                return next(
                    createHttpError(
                        HttpCode.FORBIDDEN,
-                        "Failed organization access policy check: " +
-                            (policyCheck.error || "Unknown error")
+                        "" + (policyCheck.error || "Unknown error")
                    )
                );
            }
--- a/server/middlewares/verifyClientAccess.ts
+++ b/server/middlewares/verifyClientAccess.ts
@@ -107,8 +107,7 @@ export async function verifyClientAccess(
                return next(
                    createHttpError(
                        HttpCode.FORBIDDEN,
-                        "Failed organization access policy check: " +
-                            (policyCheck.error || "Unknown error")
+                        "" + (policyCheck.error || "Unknown error")
                    )
                );
            }
@@ -129,10 +128,7 @@ export async function verifyClientAccess(
                      .where(
                          and(
                              eq(roleClients.clientId, client.clientId),
-                              inArray(
-                                  roleClients.roleId,
-                                  req.userOrgRoleIds!
-                              )
+                              inArray(roleClients.roleId, req.userOrgRoleIds!)
                          )
                      )
                      .limit(1)
--- a/server/middlewares/verifyDomainAccess.ts
+++ b/server/middlewares/verifyDomainAccess.ts
@@ -88,8 +88,7 @@ export async function verifyDomainAccess(
                return next(
                    createHttpError(
                        HttpCode.FORBIDDEN,
-                        "Failed organization access policy check: " +
-                            (policyCheck.error || "Unknown error")
+                        "" + (policyCheck.error || "Unknown error")
                    )
                );
            }
--- a/server/middlewares/verifyOrgAccess.ts
+++ b/server/middlewares/verifyOrgAccess.ts
@@ -7,6 +7,7 @@ import HttpCode from "@server/types/HttpCode";
 import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy";
 import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
 import { getFirstString } from "@server/lib/requestParams";
+import logger from "@server/logger";

 export async function verifyOrgAccess(
    req: Request,
@@ -59,8 +60,7 @@ export async function verifyOrgAccess(
                return next(
                    createHttpError(
                        HttpCode.FORBIDDEN,
-                        "Failed organization access policy check: " +
-                            (policyCheck.error || "Unknown error")
+                        "" + (policyCheck.error || "Unknown error")
                    )
                );
            }
--- a/server/middlewares/verifyResourceAccess.ts
+++ b/server/middlewares/verifyResourceAccess.ts
@@ -105,8 +105,7 @@ export async function verifyResourceAccess(
                return next(
                    createHttpError(
                        HttpCode.FORBIDDEN,
-                        "Failed organization access policy check: " +
-                            (policyCheck.error || "Unknown error")
+                        "" + (policyCheck.error || "Unknown error")
                    )
                );
            }
--- a/server/middlewares/verifyResourcePolicyAccess.ts
+++ b/server/middlewares/verifyResourcePolicyAccess.ts
@@ -102,8 +102,7 @@ export async function verifyResourcePolicyAccess(
                return next(
                    createHttpError(
                        HttpCode.FORBIDDEN,
-                        "Failed organization access policy check: " +
-                            (policyCheck.error || "Unknown error")
+                        "" + (policyCheck.error || "Unknown error")
                    )
                );
            }
--- a/server/middlewares/verifyRoleAccess.ts
+++ b/server/middlewares/verifyRoleAccess.ts
@@ -132,8 +132,7 @@ export async function verifyRoleAccess(
                return next(
                    createHttpError(
                        HttpCode.FORBIDDEN,
-                        "Failed organization access policy check: " +
-                            (policyCheck.error || "Unknown error")
+                        "" + (policyCheck.error || "Unknown error")
                    )
                );
            }
--- a/server/middlewares/verifySetResourceClients.ts
+++ b/server/middlewares/verifySetResourceClients.ts
@@ -45,8 +45,7 @@ export async function verifySetResourceClients(
            return next(
                createHttpError(
                    HttpCode.FORBIDDEN,
-                    "Failed organization access policy check: " +
-                        (policyCheck.error || "Unknown error")
+                    "" + (policyCheck.error || "Unknown error")
                )
            );
        }
--- a/server/middlewares/verifySetResourceUsers.ts
+++ b/server/middlewares/verifySetResourceUsers.ts
@@ -40,8 +40,7 @@ export async function verifySetResourceUsers(
            return next(
                createHttpError(
                    HttpCode.FORBIDDEN,
-                    "Failed organization access policy check: " +
-                        (policyCheck.error || "Unknown error")
+                    "" + (policyCheck.error || "Unknown error")
                )
            );
        }
--- a/server/middlewares/verifySiteAccess.ts
+++ b/server/middlewares/verifySiteAccess.ts
@@ -115,8 +115,7 @@ export async function verifySiteAccess(
                return next(
                    createHttpError(
                        HttpCode.FORBIDDEN,
-                        "Failed organization access policy check: " +
-                            (policyCheck.error || "Unknown error")
+                        "" + (policyCheck.error || "Unknown error")
                    )
                );
            }
--- a/server/middlewares/verifySiteProvisioningKeyAccess.ts
+++ b/server/middlewares/verifySiteProvisioningKeyAccess.ts
@@ -115,8 +115,7 @@ export async function verifySiteProvisioningKeyAccess(
                return next(
                    createHttpError(
                        HttpCode.FORBIDDEN,
-                        "Failed organization access policy check: " +
-                            (policyCheck.error || "Unknown error")
+                        "" + (policyCheck.error || "Unknown error")
                    )
                );
            }
--- a/server/middlewares/verifySiteResourceAccess.ts
+++ b/server/middlewares/verifySiteResourceAccess.ts
@@ -103,8 +103,7 @@ export async function verifySiteResourceAccess(
                return next(
                    createHttpError(
                        HttpCode.FORBIDDEN,
-                        "Failed organization access policy check: " +
-                            (policyCheck.error || "Unknown error")
+                        "" + (policyCheck.error || "Unknown error")
                    )
                );
            }
--- a/server/middlewares/verifyTargetAccess.ts
+++ b/server/middlewares/verifyTargetAccess.ts
@@ -122,8 +122,7 @@ export async function verifyTargetAccess(
                return next(
                    createHttpError(
                        HttpCode.FORBIDDEN,
-                        "Failed organization access policy check: " +
-                            (policyCheck.error || "Unknown error")
+                        "" + (policyCheck.error || "Unknown error")
                    )
                );
            }
--- a/server/middlewares/verifyUserAccess.ts
+++ b/server/middlewares/verifyUserAccess.ts
@@ -59,8 +59,7 @@ export async function verifyUserAccess(
                return next(
                    createHttpError(
                        HttpCode.FORBIDDEN,
-                        "Failed organization access policy check: " +
-                            (policyCheck.error || "Unknown error")
+                        "" + (policyCheck.error || "Unknown error")
                    )
                );
            }
--- a/server/private/lib/acmeCertSync.ts
+++ b/server/private/lib/acmeCertSync.ts
@@ -693,9 +693,9 @@ async function syncAcmeCerts(acmeJsonPath: string): Promise<void> {
            );
            continue;
        }
-        logger.debug(
-            `acmeCertSync: found ${resolverData.Certificates.length} certificate(s) for resolver "${resolver}"`
-        );
+        // logger.debug(
+        //     `acmeCertSync: found ${resolverData.Certificates.length} certificate(s) for resolver "${resolver}"`
+        // );
        for (const cert of resolverData.Certificates) {
            allCerts.push(cert);
        }
--- a/server/private/lib/checkOrgAccessPolicy.ts
+++ b/server/private/lib/checkOrgAccessPolicy.ts
@@ -21,6 +21,49 @@ import {
 } from "@server/lib/checkOrgAccessPolicy";
 import { UserType } from "@server/types/UserTypes";

+function formatMaxSessionLengthRequirement(
+    maxSessionLengthHours: number
+): string {
+    if (maxSessionLengthHours < 24) {
+        return `This organization requires you to log in every ${maxSessionLengthHours} hours.`;
+    }
+
+    const maxDays = Math.round(maxSessionLengthHours / 24);
+    return `This organization requires you to log in every ${maxDays} days.`;
+}
+
+function buildOrgAccessPolicyError(
+    policies: CheckOrgAccessPolicyResult["policies"]
+): string | undefined {
+    if (!policies) {
+        return undefined;
+    }
+
+    const errors: string[] = [];
+
+    if (policies.requiredTwoFactor === false) {
+        errors.push(
+            "This organization requires two-factor authentication. Enable two-factor authentication on your account to continue."
+        );
+    }
+
+    if (policies.maxSessionLength?.compliant === false) {
+        errors.push(
+            `Your session has expired. ${formatMaxSessionLengthRequirement(
+                policies.maxSessionLength.maxSessionLengthHours
+            )}`
+        );
+    }
+
+    if (policies.passwordAge?.compliant === false) {
+        errors.push(
+            `Your password has expired. This organization requires you to change your password every ${policies.passwordAge.maxPasswordAgeDays} days.`
+        );
+    }
+
+    return errors.length > 0 ? errors.join(" ") : undefined;
+}
+
 export function enforceResourceSessionLength(
    resourceSession: ResourceSession,
    org: Org
@@ -36,13 +79,17 @@ export function enforceResourceSessionLength(
            if (sessionAgeMs > maxSessionLengthMs) {
                return {
                    valid: false,
-                    error: `Resource session has expired due to organization policy (max session length: ${maxSessionLengthHours} hours)`
+                    error: `Your resource session has expired. ${formatMaxSessionLengthRequirement(
+                        maxSessionLengthHours
+                    )}`
                };
            }
        } else {
            return {
                valid: false,
-                error: `Resource session is invalid due to organization policy (max session length: ${maxSessionLengthHours} hours)`
+                error: `Your resource session is invalid. ${formatMaxSessionLengthRequirement(
+                    maxSessionLengthHours
+                )}`
            };
        }
    }
@@ -60,14 +107,20 @@ export async function checkOrgAccessPolicy(
    if (!orgId) {
        return {
            allowed: false,
-            error: "Organization ID is required"
+            error: "Unable to verify organization access. Organization information is missing."
        };
    }
    if (!userId) {
-        return { allowed: false, error: "User ID is required" };
+        return {
+            allowed: false,
+            error: "Unable to verify organization access. User information is missing."
+        };
    }
    if (!sessionId) {
-        return { allowed: false, error: "Session ID is required" };
+        return {
+            allowed: false,
+            error: "Your session is invalid. Please log in again."
+        };
    }

    if (build === "enterprise") {
@@ -89,7 +142,10 @@ export async function checkOrgAccessPolicy(
            .where(eq(orgs.orgId, orgId));
        props.org = orgQuery;
        if (!props.org) {
-            return { allowed: false, error: "Organization not found" };
+            return {
+                allowed: false,
+                error: "This organization could not be found."
+            };
        }
    }

@@ -100,7 +156,10 @@ export async function checkOrgAccessPolicy(
            .where(eq(users.userId, userId));
        props.user = userQuery;
        if (!props.user) {
-            return { allowed: false, error: "User not found" };
+            return {
+                allowed: false,
+                error: "Your account could not be found."
+            };
        }
    }

@@ -111,14 +170,17 @@ export async function checkOrgAccessPolicy(
            .where(eq(sessions.sessionId, sessionId));
        props.session = sessionQuery;
        if (!props.session) {
-            return { allowed: false, error: "Session not found" };
+            return {
+                allowed: false,
+                error: "Your session has expired. Please log in again."
+            };
        }
    }

    if (props.session.userId !== props.user.userId) {
        return {
            allowed: false,
-            error: "Session does not belong to the user"
+            error: "Your session is invalid. Please log in again."
        };
    }

@@ -187,8 +249,14 @@ export async function checkOrgAccessPolicy(
        allowed = false;
    }

+    const policyError = buildOrgAccessPolicyError(policies);
+
    return {
        allowed,
-        policies
+        policies,
+        error: allowed
+            ? undefined
+            : (policyError ??
+              "You do not meet this organization's security requirements.")
    };
 }
--- a/server/private/lib/lock.ts
+++ b/server/private/lib/lock.ts
@@ -11,14 +11,31 @@
 * This file is not licensed under the AGPLv3.
 */

-import { config } from "@server/lib/config";
 import logger from "@server/logger";
 import { redis } from "#private/lib/redis";
 import { v4 as uuidv4 } from "uuid";

 const instanceId = uuidv4();

+type LocalLockRecord = {
+    owner: string;
+    expiresAt: number;
+};
+
+const localLocks = new Map<string, LocalLockRecord>();
+
 export class LockManager {
+    private clearExpiredLocalLock(lockKey: string): void {
+        const current = localLocks.get(lockKey);
+        if (current && current.expiresAt <= Date.now()) {
+            localLocks.delete(lockKey);
+        }
+    }
+
+    private getLocalOwnerToken(): string {
+        return `${instanceId}:`;
+    }
+
    /**
     * Acquire a distributed lock using Redis SET with NX and PX options
     * @param lockKey - Unique identifier for the lock
@@ -32,12 +49,34 @@ export class LockManager {
        retryDelayMs: number = 100
    ): Promise<boolean> {
        if (!redis || !redis.status || redis.status !== "ready") {
-            return true;
+            for (let attempt = 0; attempt < maxRetries; attempt++) {
+                this.clearExpiredLocalLock(lockKey);
+
+                const existing = localLocks.get(lockKey);
+                if (!existing) {
+                    localLocks.set(lockKey, {
+                        owner: this.getLocalOwnerToken(),
+                        expiresAt: Date.now() + ttlMs
+                    });
+                    return true;
+                }
+
+                if (existing.owner === this.getLocalOwnerToken()) {
+                    existing.expiresAt = Date.now() + ttlMs;
+                    localLocks.set(lockKey, existing);
+                    return true;
+                }
+
+                if (attempt < maxRetries - 1) {
+                    const delay = retryDelayMs * Math.pow(2, attempt);
+                    await new Promise((resolve) => setTimeout(resolve, delay));
+                }
+            }
+
+            return false;
        }

-        const lockValue = `${
-            instanceId
-        }:${Date.now()}`;
+        const lockValue = `${instanceId}:${Date.now()}`;
        const redisKey = `lock:${lockKey}`;

        for (let attempt = 0; attempt < maxRetries; attempt++) {
@@ -53,11 +92,7 @@ export class LockManager {
                );

                if (result === "OK") {
-                    logger.debug(
-                        `Lock acquired: ${lockKey} by ${
-                            instanceId
-                        }`
-                    );
+                    logger.debug(`Lock acquired: ${lockKey} by ${instanceId}`);
                    return true;
                }

@@ -65,17 +100,11 @@ export class LockManager {
                const existingValue = await redis.get(redisKey);
                if (
                    existingValue &&
-                    existingValue.startsWith(
-                        `${instanceId}:`
-                    )
+                    existingValue.startsWith(`${instanceId}:`)
                ) {
                    // Extend the lock TTL since it's the same worker
                    await redis.pexpire(redisKey, ttlMs);
-                    logger.debug(
-                        `Lock extended: ${lockKey} by ${
-                            instanceId
-                        }`
-                    );
+                    logger.debug(`Lock extended: ${lockKey} by ${instanceId}`);
                    return true;
                }

@@ -88,7 +117,10 @@ export class LockManager {
                    await new Promise((resolve) => setTimeout(resolve, delay));
                }
            } catch (error) {
-                logger.error(`Failed to acquire lock ${lockKey} (attempt ${attempt + 1}/${maxRetries}):`, error);
+                logger.error(
+                    `Failed to acquire lock ${lockKey} (attempt ${attempt + 1}/${maxRetries}):`,
+                    error
+                );
                // On error, still retry if we have attempts left
                if (attempt < maxRetries - 1) {
                    const delay = retryDelayMs * Math.pow(2, attempt);
@@ -109,6 +141,11 @@ export class LockManager {
     */
    async releaseLock(lockKey: string): Promise<void> {
        if (!redis || !redis.status || redis.status !== "ready") {
+            this.clearExpiredLocalLock(lockKey);
+            const existing = localLocks.get(lockKey);
+            if (existing && existing.owner === this.getLocalOwnerToken()) {
+                localLocks.delete(lockKey);
+            }
            return;
        }

@@ -136,11 +173,7 @@ export class LockManager {
            )) as number;

            if (result === 1) {
-                logger.debug(
-                    `Lock released: ${lockKey} by ${
-                        instanceId
-                    }`
-                );
+                logger.debug(`Lock released: ${lockKey} by ${instanceId}`);
            } else {
                logger.warn(
                    `Lock not released - not owned by worker: ${lockKey} by ${
@@ -159,6 +192,7 @@ export class LockManager {
     */
    async forceReleaseLock(lockKey: string): Promise<void> {
        if (!redis || !redis.status || redis.status !== "ready") {
+            localLocks.delete(lockKey);
            return;
        }

@@ -186,7 +220,20 @@ export class LockManager {
        owner?: string;
    }> {
        if (!redis || !redis.status || redis.status !== "ready") {
-            return { exists: false, ownedByMe: true, ttl: 0 };
+            this.clearExpiredLocalLock(lockKey);
+            const existing = localLocks.get(lockKey);
+
+            if (!existing) {
+                return { exists: false, ownedByMe: false, ttl: 0 };
+            }
+
+            const ttl = Math.max(0, existing.expiresAt - Date.now());
+            return {
+                exists: true,
+                ownedByMe: existing.owner === this.getLocalOwnerToken(),
+                ttl,
+                owner: existing.owner.split(":")[0]
+            };
        }

        const redisKey = `lock:${lockKey}`;
@@ -198,11 +245,7 @@ export class LockManager {
            ]);

            const exists = value !== null;
-            const ownedByMe =
-                exists &&
-                value!.startsWith(
-                    `${instanceId}:`
-                );
+            const ownedByMe = exists && value!.startsWith(`${instanceId}:`);
            const owner = exists ? value!.split(":")[0] : undefined;

            return {
@@ -225,6 +268,15 @@ export class LockManager {
     */
    async extendLock(lockKey: string, ttlMs: number): Promise<boolean> {
        if (!redis || !redis.status || redis.status !== "ready") {
+            this.clearExpiredLocalLock(lockKey);
+            const existing = localLocks.get(lockKey);
+
+            if (!existing || existing.owner !== this.getLocalOwnerToken()) {
+                return false;
+            }
+
+            existing.expiresAt = Date.now() + ttlMs;
+            localLocks.set(lockKey, existing);
            return true;
        }

@@ -255,9 +307,7 @@ export class LockManager {

            if (result === 1) {
                logger.debug(
-                    `Lock extended: ${lockKey} by ${
-                        instanceId
-                    } for ${ttlMs}ms`
+                    `Lock extended: ${lockKey} by ${instanceId} for ${ttlMs}ms`
                );
                return true;
            }
@@ -282,12 +332,13 @@ export class LockManager {
        maxRetries: number = 5,
        baseDelayMs: number = 100
    ): Promise<boolean> {
-        if (!redis || !redis.status || redis.status !== "ready") {
-            return true;
-        }
-
        for (let attempt = 0; attempt <= maxRetries; attempt++) {
-            const acquired = await this.acquireLock(lockKey, ttlMs);
+            const acquired = await this.acquireLock(
+                lockKey,
+                ttlMs,
+                1,
+                baseDelayMs
+            );

            if (acquired) {
                return true;
@@ -319,10 +370,6 @@ export class LockManager {
        fn: () => Promise<T>,
        ttlMs: number = 30000
    ): Promise<T> {
-        if (!redis || !redis.status || redis.status !== "ready") {
-            return await fn();
-        }
-
        const acquired = await this.acquireLock(lockKey, ttlMs);

        if (!acquired) {
@@ -346,7 +393,21 @@ export class LockManager {
        locksOwnedByMe: number;
    }> {
        if (!redis || !redis.status || redis.status !== "ready") {
-            return { activeLocksCount: 0, locksOwnedByMe: 0 };
+            const now = Date.now();
+            for (const [key, value] of localLocks.entries()) {
+                if (value.expiresAt <= now) {
+                    localLocks.delete(key);
+                }
+            }
+
+            let locksOwnedByMe = 0;
+            for (const value of localLocks.values()) {
+                if (value.owner === this.getLocalOwnerToken()) {
+                    locksOwnedByMe++;
+                }
+            }
+
+            return { activeLocksCount: localLocks.size, locksOwnedByMe };
        }

        try {
@@ -356,11 +417,7 @@ export class LockManager {
            if (keys.length > 0) {
                const values = await redis.mget(...keys);
                locksOwnedByMe = values.filter(
-                    (value) =>
-                        value &&
-                        value.startsWith(
-                            `${instanceId}:`
-                        )
+                    (value) => value && value.startsWith(`${instanceId}:`)
                ).length;
            }

--- a/server/private/lib/rebuildQueue.ts
+++ b/server/private/lib/rebuildQueue.ts
@@ -12,7 +12,7 @@
 */

 import { redis } from "#private/lib/redis";
-import { lockManager } from "#dynamic/lib/lock";
+import { lockManager } from "#private/lib/lock";
 import logger from "@server/logger";

 export type RebuildJobType = "site-resource" | "client";
@@ -46,6 +46,17 @@ const POLL_INTERVAL_MS = 500;
 class RedisRebuildQueue {
    private processingStarted = false;

+    async isQueued(job: RebuildJob): Promise<boolean> {
+        if (!redis || redis.status !== "ready") return false;
+        const dedupeKey = `${job.type}:${job.id}`;
+        try {
+            const member = await redis.sismember(QUEUED_SET_KEY, dedupeKey);
+            return member === 1;
+        } catch {
+            return false;
+        }
+    }
+
    async enqueue(job: RebuildJob): Promise<void> {
        if (!redis || redis.status !== "ready") {
            logger.warn(
--- a/server/private/routers/healthChecks/createHealthCheck.ts
+++ b/server/private/routers/healthChecks/createHealthCheck.ts
@@ -29,26 +29,40 @@ const paramsSchema = z.strictObject({
    orgId: z.string().nonempty()
 });

-const bodySchema = z.strictObject({
-    name: z.string().nonempty(),
-    siteId: z.number().int().positive(),
-    hcEnabled: z.boolean().default(false),
-    hcMode: z.string().default("http"),
-    hcHostname: z.string().optional(),
-    hcPort: z.number().int().min(1).max(65535).optional(),
-    hcPath: z.string().optional(),
-    hcScheme: z.string().optional(),
-    hcMethod: z.string().default("GET"),
-    hcInterval: z.number().int().positive().default(30),
-    hcUnhealthyInterval: z.number().int().positive().default(30),
-    hcTimeout: z.number().int().positive().default(1),
-    hcHeaders: z.string().optional().nullable(),
-    hcFollowRedirects: z.boolean().default(true),
-    hcStatus: z.number().int().optional().nullable(),
-    hcTlsServerName: z.string().optional(),
-    hcHealthyThreshold: z.number().int().positive().default(1),
-    hcUnhealthyThreshold: z.number().int().positive().default(1)
-});
+const bodySchema = z
+    .strictObject({
+        name: z.string().nonempty(),
+        siteId: z.number().int().positive(),
+        hcEnabled: z.boolean().default(false),
+        hcMode: z.string().default("http"),
+        hcHostname: z.string().optional(),
+        hcPort: z.number().int().min(1).max(65535).optional(),
+        hcPath: z.string().optional(),
+        hcScheme: z.string().optional(),
+        hcMethod: z.string().default("GET"),
+        hcInterval: z.number().int().positive().default(30),
+        hcUnhealthyInterval: z.number().int().positive().default(30),
+        hcTimeout: z.number().int().positive().default(1),
+        hcHeaders: z.string().optional().nullable(),
+        hcFollowRedirects: z.boolean().default(true),
+        hcStatus: z.number().int().optional().nullable(),
+        hcTlsServerName: z.string().optional(),
+        hcHealthyThreshold: z.number().int().positive().default(1),
+        hcUnhealthyThreshold: z.number().int().positive().default(1)
+    })
+    .superRefine((data, ctx) => {
+        const hcHostnameMissing =
+            data.hcHostname === undefined ||
+            data.hcHostname.trim().length === 0;
+
+        if (data.hcEnabled === true && hcHostnameMissing) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["hcHostname"],
+                message: "hcHostname is required when hcEnabled is true"
+            });
+        }
+    });

 export type CreateHealthCheckResponse = {
    targetHealthCheckId: number;
@@ -57,7 +71,6 @@ const CreateHealthCheckResponseDataSchema = z.object({
    targetHealthCheckId: z.number()
 });

-
 registry.registerPath({
    method: "put",
    path: "/org/{orgId}/health-check",
@@ -78,7 +91,9 @@ registry.registerPath({
            description: "Successful response",
            content: {
                "application/json": {
-                    schema: createApiResponseSchema(CreateHealthCheckResponseDataSchema)
+                    schema: createApiResponseSchema(
+                        CreateHealthCheckResponseDataSchema
+                    )
                }
            }
        }
--- a/server/private/routers/healthChecks/updateHealthCheck.ts
+++ b/server/private/routers/healthChecks/updateHealthCheck.ts
@@ -105,7 +105,6 @@ const UpdateHealthCheckResponseDataSchema = z.object({
    hcUnhealthyThreshold: z.number().nullable()
 });

-
 registry.registerPath({
    method: "post",
    path: "/org/{orgId}/health-check/{healthCheckId}",
@@ -126,7 +125,9 @@ registry.registerPath({
            description: "Successful response",
            content: {
                "application/json": {
-                    schema: createApiResponseSchema(UpdateHealthCheckResponseDataSchema)
+                    schema: createApiResponseSchema(
+                        UpdateHealthCheckResponseDataSchema
+                    )
                }
            }
        }
@@ -215,6 +216,32 @@ export async function updateHealthCheck(
            )
            .limit(1);

+        if (!existingHealthCheck) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    "Standalone health check not found"
+                )
+            );
+        }
+
+        const nextHcEnabled = hcEnabled ?? existingHealthCheck.hcEnabled;
+        const nextHcHostname =
+            hcHostname !== undefined
+                ? hcHostname
+                : existingHealthCheck.hcHostname;
+        const hcHostnameMissing =
+            !nextHcHostname || nextHcHostname.trim().length === 0;
+
+        if (nextHcEnabled && hcHostnameMissing) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "hcHostname is required when hcEnabled is true"
+                )
+            );
+        }
+
        if (name !== undefined) updateData.name = name;
        if (siteId !== undefined) updateData.siteId = siteId;
        if (hcEnabled !== undefined) updateData.hcEnabled = hcEnabled;
--- a/server/private/routers/orgIdp/unassociateOrgIdp.ts
+++ b/server/private/routers/orgIdp/unassociateOrgIdp.ts
@@ -121,7 +121,7 @@ export async function unassociateOrgIdp(
        });

        for (const userId of userIdsToRemove) {
-            calculateUserClientsForOrgs(userId, primaryDb).catch((e) => {
+            calculateUserClientsForOrgs(userId).catch((e) => {
                logger.error(
                    `Failed to calculate user clients after removing user ${userId} from org ${orgId} during IdP unassociation: ${e}`
                );
--- a/server/private/routers/user/addUserRole.ts
+++ b/server/private/routers/user/addUserRole.ts
@@ -163,13 +163,11 @@ export async function addUserRole(
        });

        for (const orgClient of orgClientsToRebuild) {
-            rebuildClientAssociationsFromClient(orgClient, primaryDb).catch(
-                (e) => {
-                    logger.error(
-                        `Failed to rebuild client associations for client ${orgClient.clientId} after adding role: ${e}`
-                    );
-                }
-            );
+            rebuildClientAssociationsFromClient(orgClient).catch((e) => {
+                logger.error(
+                    `Failed to rebuild client associations for client ${orgClient.clientId} after adding role: ${e}`
+                );
+            });
        }

        return response(res, {
--- a/server/private/routers/user/removeUserRole.ts
+++ b/server/private/routers/user/removeUserRole.ts
@@ -170,13 +170,11 @@ export async function removeUserRole(
        });

        for (const orgClient of orgClientsToRebuild) {
-            rebuildClientAssociationsFromClient(orgClient, primaryDb).catch(
-                (e) => {
-                    logger.error(
-                        `Failed to rebuild client associations for client ${orgClient.clientId} after removing role: ${e}`
-                    );
-                }
-            );
+            rebuildClientAssociationsFromClient(orgClient).catch((e) => {
+                logger.error(
+                    `Failed to rebuild client associations for client ${orgClient.clientId} after removing role: ${e}`
+                );
+            });
        }

        return response(res, {
--- a/server/private/routers/user/setUserOrgRoles.ts
+++ b/server/private/routers/user/setUserOrgRoles.ts
@@ -150,13 +150,11 @@ export async function setUserOrgRoles(
        });

        for (const orgClient of orgClientsToRebuild) {
-            rebuildClientAssociationsFromClient(orgClient, primaryDb).catch(
-                (e) => {
-                    logger.error(
-                        `Failed to rebuild client associations for client ${orgClient.clientId} after setting roles: ${e}`
-                    );
-                }
-            );
+            rebuildClientAssociationsFromClient(orgClient).catch((e) => {
+                logger.error(
+                    `Failed to rebuild client associations for client ${orgClient.clientId} after setting roles: ${e}`
+                );
+            });
        }

        return response(res, {
--- a/server/routers/accessToken/listAccessTokens.ts
+++ b/server/routers/accessToken/listAccessTokens.ts
@@ -30,7 +30,7 @@ const listAccessTokensParamsSchema = z
        error: "Either resourceId or orgId must be provided, but not both"
    });

-const listAccessTokensSchema = z.object({
+const listAccessTokensSchema = z.strictObject({
    limit: z
        .string()
        .optional()
--- a/server/routers/apiKeys/listApiKeyActions.ts
+++ b/server/routers/apiKeys/listApiKeyActions.ts
@@ -15,7 +15,7 @@ const paramsSchema = z.object({
    apiKeyId: z.string().nonempty()
 });

-const querySchema = z.object({
+const querySchema = z.strictObject({
    limit: z
        .string()
        .optional()
--- a/server/routers/apiKeys/listOrgApiKeys.ts
+++ b/server/routers/apiKeys/listOrgApiKeys.ts
@@ -11,7 +11,7 @@ import { eq, and } from "drizzle-orm";
 import { OpenAPITags, registry } from "@server/openApi";
 import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";

-const querySchema = z.object({
+const querySchema = z.strictObject({
    limit: z
        .string()
        .optional()
--- a/server/routers/apiKeys/listRootApiKeys.ts
+++ b/server/routers/apiKeys/listRootApiKeys.ts
@@ -9,7 +9,7 @@ import { z } from "zod";
 import { fromError } from "zod-validation-error";
 import { eq } from "drizzle-orm";

-const querySchema = z.object({
+const querySchema = z.strictObject({
    limit: z
        .string()
        .optional()
--- a/server/routers/auditLogs/queryRequestAuditLog.ts
+++ b/server/routers/auditLogs/queryRequestAuditLog.ts
@@ -20,7 +20,7 @@ import response from "@server/lib/response";
 import logger from "@server/logger";
 import { getSevenDaysAgo } from "@app/lib/getSevenDaysAgo";

-export const queryAccessAuditLogsQuery = z.object({
+export const queryAccessAuditLogsQuery = z.strictObject({
    // iso string just validate its a parseable date
    timeStart: z
        .string()
--- a/server/routers/auth/changePassword.ts
+++ b/server/routers/auth/changePassword.ts
@@ -10,9 +10,8 @@ import { hashPassword, verifyPassword } from "@server/auth/password";
 import { verifyTotpCode } from "@server/auth/totp";
 import logger from "@server/logger";
 import { unauthorized } from "@server/auth/unauthorizedResponse";
-import { invalidateAllSessions } from "@server/auth/sessions/app";
-import { sessions, resourceSessions } from "@server/db";
-import { and, eq, ne, inArray } from "drizzle-orm";
+import { invalidateAllSessionsExceptCurrent } from "@server/auth/sessions/app";
+import { eq } from "drizzle-orm";
 import { passwordSchema } from "@server/auth/passwordSchema";
 import { UserType } from "@server/types/UserTypes";
 import { sendEmail } from "@server/emails";
@@ -31,48 +30,6 @@ export type ChangePasswordResponse = {
    codeRequested?: boolean;
 };

-async function invalidateAllSessionsExceptCurrent(
-    userId: string,
-    currentSessionId: string
-): Promise<void> {
-    try {
-        await db.transaction(async (trx) => {
-            // Get all user sessions except the current one
-            const userSessions = await trx
-                .select()
-                .from(sessions)
-                .where(
-                    and(
-                        eq(sessions.userId, userId),
-                        ne(sessions.sessionId, currentSessionId)
-                    )
-                );
-
-            // Delete resource sessions for the sessions we're invalidating
-            if (userSessions.length > 0) {
-                await trx.delete(resourceSessions).where(
-                    inArray(
-                        resourceSessions.userSessionId,
-                        userSessions.map((s) => s.sessionId)
-                    )
-                );
-            }
-
-            // Delete the user sessions (except current)
-            await trx
-                .delete(sessions)
-                .where(
-                    and(
-                        eq(sessions.userId, userId),
-                        ne(sessions.sessionId, currentSessionId)
-                    )
-                );
-        });
-    } catch (e) {
-        logger.error("Failed to invalidate user sessions except current", e);
-    }
-}
-
 export async function changePassword(
    req: Request,
    res: Response,
--- a/server/routers/auth/deleteMyAccount.ts
+++ b/server/routers/auth/deleteMyAccount.ts
@@ -224,7 +224,7 @@ export async function deleteMyAccount(
            }
        });

-        calculateUserClientsForOrgs(userId, primaryDb).catch((e) => {
+        calculateUserClientsForOrgs(userId).catch((e) => {
            logger.error(
                `Failed to calculate user clients after deleting account for user ${userId}: ${e}`
            );
--- a/server/routers/auth/verifyTotp.ts
+++ b/server/routers/auth/verifyTotp.ts
@@ -15,6 +15,10 @@ import TwoFactorAuthNotification from "@server/emails/templates/TwoFactorAuthNot
 import config from "@server/lib/config";
 import { UserType } from "@server/types/UserTypes";
 import { generateBackupCodes } from "@server/lib/totp";
+import {
+    invalidateAllSessions,
+    invalidateAllSessionsExceptCurrent
+} from "@server/auth/sessions/app";
 import { verifySession } from "@server/auth/sessions/verifySession";
 import { unauthorized } from "@server/auth/unauthorizedResponse";

@@ -168,6 +172,15 @@ export async function verifyTotp(
            );
        }

+        if (existingSession) {
+            await invalidateAllSessionsExceptCurrent(
+                user.userId,
+                existingSession.sessionId
+            );
+        } else {
+            await invalidateAllSessions(user.userId);
+        }
+
        sendEmail(
            TwoFactorAuthNotification({
                email: user.email!,
--- a/server/routers/client/createClient.ts
+++ b/server/routers/client/createClient.ts
@@ -280,13 +280,11 @@ export async function createClient(
        });

        if (newClient) {
-            rebuildClientAssociationsFromClient(newClient, primaryDb).catch(
-                (e) => {
-                    logger.error(
-                        `Failed to rebuild client associations after creating client: ${e}`
-                    );
-                }
-            );
+            rebuildClientAssociationsFromClient(newClient).catch((e) => {
+                logger.error(
+                    `Failed to rebuild client associations after creating client: ${e}`
+                );
+            });
        }

        return response<CreateClientResponse>(res, {
--- a/server/routers/client/createUserClient.ts
+++ b/server/routers/client/createUserClient.ts
@@ -255,13 +255,11 @@ export async function createUserClient(
        });

        if (newClient) {
-            rebuildClientAssociationsFromClient(newClient, primaryDb).catch(
-                (e) => {
-                    logger.error(
-                        `Failed to rebuild client associations after creating user client: ${e}`
-                    );
-                }
-            );
+            rebuildClientAssociationsFromClient(newClient).catch((e) => {
+                logger.error(
+                    `Failed to rebuild client associations after creating user client: ${e}`
+                );
+            });
        }

        return response<CreateClientAndOlmResponse>(res, {
--- a/server/routers/client/deleteClient.ts
+++ b/server/routers/client/deleteClient.ts
@@ -109,13 +109,11 @@ export async function deleteClient(
        });

        if (deletedClient) {
-            rebuildClientAssociationsFromClient(deletedClient, primaryDb).catch(
-                (e) => {
-                    logger.error(
-                        `Failed to rebuild client associations after deleting client ${clientId}: ${e}`
-                    );
-                }
-            );
+            rebuildClientAssociationsFromClient(deletedClient).catch((e) => {
+                logger.error(
+                    `Failed to rebuild client associations after deleting client ${clientId}: ${e}`
+                );
+            });
            if (olm) {
                sendTerminateClient(
                    deletedClient.clientId,
--- a/server/routers/client/listClients.ts
+++ b/server/routers/client/listClients.ts
@@ -41,7 +41,7 @@ const listClientsParamsSchema = z.strictObject({
    orgId: z.string()
 });

-const listClientsSchema = z.object({
+const listClientsSchema = z.strictObject({
    pageSize: z.coerce
        .number<string>() // for prettier formatting
        .int()
--- a/server/routers/client/listUserDevices.ts
+++ b/server/routers/client/listUserDevices.ts
@@ -40,7 +40,7 @@ const listUserDevicesParamsSchema = z.strictObject({
    orgId: z.string()
 });

-const listUserDevicesSchema = z.object({
+const listUserDevicesSchema = z.strictObject({
    pageSize: z.coerce
        .number<string>() // for prettier formatting
        .int()
@@ -420,31 +420,6 @@ export async function listUserDevices(
            }
        );

-        // REMOVING THIS BECAUSE WE HAVE DIFFERENT TYPES OF CLIENTS NOW
-        // // Try to get the latest version, but don't block if it fails
-        // try {
-        //     const latestOlmVersion = await getLatestOlmVersion();
-
-        //     if (latestOlmVersion) {
-        //         olmsWithUpdates.forEach((client) => {
-        //             try {
-        //                 client.olmUpdateAvailable = semver.lt(
-        //                     client.olmVersion ? client.olmVersion : "",
-        //                     latestOlmVersion
-        //                 );
-        //             } catch (error) {
-        //                 client.olmUpdateAvailable = false;
-        //             }
-        //         });
-        //     }
-        // } catch (error) {
-        //     // Log the error but don't let it block the response
-        //     logger.warn(
-        //         "Failed to check for OLM updates, continuing without update info:",
-        //         error
-        //     );
-        // }
-
        return response<ListUserDevicesResponse>(res, {
            data: {
                devices: olmsWithUpdates,
--- a/server/routers/client/rebuildClientAssociationsCacheRoute.ts
+++ b/server/routers/client/rebuildClientAssociationsCacheRoute.ts
@@ -60,13 +60,17 @@ export async function rebuildClientAssociationsCacheRoute(
            );
        }

-        await rebuildClientAssociationsFromClient(client);
+        rebuildClientAssociationsFromClient(client).catch((e) => {
+            logger.error(
+                `Failed to rebuild client associations for client ${clientId}: ${e}`
+            );
+        });

        return response(res, {
            data: null,
            success: true,
            error: false,
-            message: "Client association cache rebuilt successfully",
+            message: "Client association cache queued successfully",
            status: HttpCode.OK
        });
    } catch (error) {
--- a/server/routers/client/targets.ts
+++ b/server/routers/client/targets.ts
@@ -438,6 +438,70 @@ export async function removePeerDataBatch(
    await sendToClientsBatch(payloads);
 }

+export async function updatePeerDataBatch(
+    entries: {
+        clientId: number;
+        siteId: number;
+        remoteSubnets:
+            | {
+                  oldRemoteSubnets: string[];
+                  newRemoteSubnets: string[];
+              }
+            | undefined;
+        aliases:
+            | {
+                  oldAliases: Alias[];
+                  newAliases: Alias[];
+              }
+            | undefined;
+        olmId?: string;
+        version?: string | null;
+    }[]
+) {
+    if (entries.length === 0) {
+        return;
+    }
+
+    const resolvedTargets = await resolveOlmTargets(entries);
+
+    if (resolvedTargets.length === 0) {
+        return;
+    }
+
+    const payloads = entries
+        .map((entry) => {
+            const resolved = resolvedTargets.find(
+                (target) => target.clientId === entry.clientId
+            );
+            if (!resolved) {
+                return null;
+            }
+
+            return {
+                clientId: resolved.olmId,
+                message: {
+                    type: `olm/wg/peer/data/update`,
+                    data: {
+                        siteId: entry.siteId,
+                        ...entry.remoteSubnets,
+                        ...entry.aliases
+                    }
+                },
+                options: {
+                    incrementConfigVersion: true,
+                    compress: canCompress(resolved.version, "olm")
+                }
+            };
+        })
+        .filter((entry) => entry !== null);
+
+    if (payloads.length === 0) {
+        return;
+    }
+
+    await sendToClientsBatch(payloads);
+}
+
 export async function updatePeerData(
    clientId: number,
    siteId: number,
--- a/server/routers/idp/validateOidcCallback.ts
+++ b/server/routers/idp/validateOidcCallback.ts
@@ -635,7 +635,7 @@ export async function validateOidcCallback(
                }
            });

-            calculateUserClientsForOrgs(userId!, primaryDb).catch((err) => {
+            calculateUserClientsForOrgs(userId!).catch((err) => {
                logger.error(
                    "Error calculating user clients after syncing orgs and roles for OIDC user",
                    { error: err }
--- a/server/routers/integration.ts
+++ b/server/routers/integration.ts
@@ -17,7 +17,6 @@ import {
    verifyApiKey,
    verifyApiKeyOrgAccess,
    verifyApiKeyHasAction,
-    verifyApiKeyCanSetUserOrgRoles,
    verifyApiKeySiteAccess,
    verifyApiKeyResourceAccess,
    verifyApiKeyTargetAccess,
@@ -974,6 +973,13 @@ authenticated.get(
    idp.getIdp
 );

+authenticated.delete(
+    "/idp/:idpId",
+    verifyApiKeyIsRoot,
+    verifyApiKeyHasAction(ActionsEnum.deleteIdp),
+    idp.deleteIdp
+);
+
 authenticated.put(
    "/idp/:idpId/org/:orgId",
    verifyApiKeyIsRoot,
--- a/server/routers/newt/handleNewtGetConfigMessage.ts
+++ b/server/routers/newt/handleNewtGetConfigMessage.ts
@@ -9,6 +9,7 @@ import { buildClientConfigurationForNewtClient } from "./buildConfiguration";
 import { convertTargetsIfNecessary } from "../client/targets";
 import { canCompress } from "@server/lib/clientVersionChecks";
 import config from "@server/lib/config";
+import { waitForSiteRebuildIdle } from "@server/lib/rebuildClientAssociations";

 export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
    const { message, client, sendToClient } = context;
@@ -61,6 +62,8 @@ export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
        return;
    }

+    await waitForSiteRebuildIdle(siteId);
+
    // update the endpoint and the public key
    const [site] = await db
        .update(sites)
--- a/server/routers/newt/handleNewtPingMessage.ts
+++ b/server/routers/newt/handleNewtPingMessage.ts
@@ -49,20 +49,22 @@ export const handleNewtPingMessage: MessageHandler = async (context) => {
            `Newt ping with outdated config version: ${message.configVersion} (current: ${configVersion})`
        );

-        const [site] = await db
-            .select()
-            .from(sites)
-            .where(eq(sites.siteId, newt.siteId))
-            .limit(1);
+        // TODO: IMPLEMENT THE SYNC ON THE NEWT SIDE AND COMMENT THIS BACK IN

-        if (!site) {
-            logger.warn(
-                `Newt ping message: site with ID ${newt.siteId} not found`
-            );
-            return;
-        }
+        // const [site] = await db
+        //     .select()
+        //     .from(sites)
+        //     .where(eq(sites.siteId, newt.siteId))
+        //     .limit(1);

-        await sendNewtSyncMessage(newt, site);
+        // if (!site) {
+        //     logger.warn(
+        //         `Newt ping message: site with ID ${newt.siteId} not found`
+        //     );
+        //     return;
+        // }
+
+        // await sendNewtSyncMessage(newt, site);
    }

    return {
--- a/server/routers/olm/createUserOlm.ts
+++ b/server/routers/olm/createUserOlm.ts
@@ -104,7 +104,7 @@ export async function createUserOlm(
            dateCreated: moment().toISOString()
        });

-        calculateUserClientsForOrgs(userId, primaryDb).catch((e) => {
+        calculateUserClientsForOrgs(userId).catch((e) => {
            console.error(
                "Error calculating user clients after creating olm:",
                e
--- a/server/routers/olm/deleteUserOlm.ts
+++ b/server/routers/olm/deleteUserOlm.ts
@@ -86,13 +86,11 @@ export async function deleteUserOlm(
        });

        if (deletedClient) {
-            rebuildClientAssociationsFromClient(deletedClient, primaryDb).catch(
-                (e) => {
-                    logger.error(
-                        `Failed to rebuild client-site associations after deleting OLM ${olmId}: ${e}`
-                    );
-                }
-            );
+            rebuildClientAssociationsFromClient(deletedClient).catch((e) => {
+                logger.error(
+                    `Failed to rebuild client-site associations after deleting OLM ${olmId}: ${e}`
+                );
+            });
            sendTerminateClient(
                deletedClient.clientId,
                OlmErrorCodes.TERMINATED_DELETED,
--- a/server/routers/olm/handleOlmRegisterMessage.ts
+++ b/server/routers/olm/handleOlmRegisterMessage.ts
@@ -21,6 +21,7 @@ import { build } from "@server/build";
 import { canCompress } from "@server/lib/clientVersionChecks";
 import config from "@server/lib/config";
 import cache from "#dynamic/lib/cache"; // not using regional here because we need this in the register message handler before we know where the client is
+import { waitForClientRebuildIdle } from "@server/lib/rebuildClientAssociations";

 const HOLEPUNCH_STALE_CHAIN_THRESHOLD = 18;
 const HOLEPUNCH_STALE_CHAIN_TTL_SECONDS = 1800;
@@ -385,6 +386,8 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
    }

    // NOTE: its important that the client here is the old client and the public key is the new key
+    await waitForClientRebuildIdle(olm.clientId);
+
    const siteConfigurations = await buildSiteConfigurationForOlmClient(
        client,
        publicKey,
--- a/server/routers/olm/listUserOlms.ts
+++ b/server/routers/olm/listUserOlms.ts
@@ -11,7 +11,7 @@ import logger from "@server/logger";
 import { OpenAPITags, registry } from "@server/openApi";
 import { getUserDeviceName } from "@server/db/names";

-const querySchema = z.object({
+const querySchema = z.strictObject({
    limit: z
        .string()
        .optional()
--- a/server/routers/org/createOrg.ts
+++ b/server/routers/org/createOrg.ts
@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { db } from "@server/db";
+import { db, primaryDb } from "@server/db";
 import { and, count, eq } from "drizzle-orm";
 import {
    domains,
@@ -233,6 +233,7 @@ export async function createOrg(
        let error = "";
        let org: Org | null = null;
        let numOrgs: number | null = null;
+        let ownerUserId: string | null = null;

        await db.transaction(async (trx) => {
            const allDomains = await trx
@@ -326,7 +327,6 @@ export async function createOrg(
                );
            }

-            let ownerUserId: string | null = null;
            if (req.user) {
                await trx.insert(userOrgs).values({
                    userId: req.user!.userId,
@@ -382,8 +382,6 @@ export async function createOrg(
                }))
            );

-            await calculateUserClientsForOrgs(ownerUserId, trx);
-
            if (billingOrgIdForNewOrg) {
                const [numOrgsResult] = await trx
                    .select({ count: count() })
@@ -396,6 +394,14 @@ export async function createOrg(
            }
        });

+        if (ownerUserId) {
+            calculateUserClientsForOrgs(ownerUserId).catch((e) => {
+                logger.error(
+                    `Failed to calculate user clients after creating org ${orgId} for user ${ownerUserId}: ${e}`
+                );
+            });
+        }
+
        if (!org) {
            return next(
                createHttpError(
--- a/server/routers/org/listOrgs.ts
+++ b/server/routers/org/listOrgs.ts
@@ -11,7 +11,7 @@ import { fromZodError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
 import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";

-const listOrgsSchema = z.object({
+const listOrgsSchema = z.strictObject({
    limit: z
        .string()
        .optional()
--- a/server/routers/org/listUserOrgs.ts
+++ b/server/routers/org/listUserOrgs.ts
@@ -14,7 +14,7 @@ const listOrgsParamsSchema = z.object({
    userId: z.string()
 });

-const listOrgsSchema = z.object({
+const listOrgsSchema = z.strictObject({
    limit: z
        .string()
        .optional()
--- a/server/routers/resource/deleteResource.ts
+++ b/server/routers/resource/deleteResource.ts
@@ -1,13 +1,4 @@
-import { eq, inArray } from "drizzle-orm";
-import {
-    db,
-    newts,
-    resourcePolicies,
-    resources,
-    sites,
-    targetHealthCheck,
-    targets
-} from "@server/db";
+import { db } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import { OpenAPITags, registry } from "@server/openApi";
@@ -16,9 +7,11 @@ import { NextFunction, Request, Response } from "express";
 import createHttpError from "http-errors";
 import { z } from "zod";
 import { fromError } from "zod-validation-error";
-import { removeTargets } from "../newt/targets";
+import {
+    performDeleteResource,
+    runResourceDeleteSideEffects
+} from "@server/lib/deleteResource";

-// Define Zod schema for request parameters validation
 const deleteResourceSchema = z.strictObject({
    resourceId: z.coerce.number().int().positive()
 });
@@ -67,27 +60,13 @@ export async function deleteResource(

        const { resourceId } = parsedParams.data;

-        const targetsToBeRemoved = await db
-            .select()
-            .from(targets)
-            .where(eq(targets.resourceId, resourceId));
+        let deleteResult = null;

-        const healthChecksToBeRemoved = await db
-            .select()
-            .from(targetHealthCheck)
-            .where(
-                inArray(
-                    targetHealthCheck.targetId,
-                    targetsToBeRemoved.map((t) => t.targetId)
-                )
-            );
+        await db.transaction(async (trx) => {
+            deleteResult = await performDeleteResource(resourceId, trx);
+        });

-        const [deletedResource] = await db
-            .delete(resources)
-            .where(eq(resources.resourceId, resourceId))
-            .returning();
-
-        if (!deletedResource) {
+        if (!deleteResult) {
            return next(
                createHttpError(
                    HttpCode.NOT_FOUND,
@@ -96,54 +75,7 @@ export async function deleteResource(
            );
        }

-        for (const target of targetsToBeRemoved) {
-            const [site] = await db
-                .select()
-                .from(sites)
-                .where(eq(sites.siteId, target.siteId))
-                .limit(1);
-
-            if (!site) {
-                return next(
-                    createHttpError(
-                        HttpCode.NOT_FOUND,
-                        `Site with ID ${target.siteId} not found`
-                    )
-                );
-            }
-
-            if (site.pubKey) {
-                if (site.type == "newt") {
-                    // get the newt on the site by querying the newt table for siteId
-                    const [newt] = await db
-                        .select()
-                        .from(newts)
-                        .where(eq(newts.siteId, site.siteId))
-                        .limit(1);
-
-                    await removeTargets(
-                        newt.newtId,
-                        // [target],
-                        [], // deleting the target from newt causes issues because we cant unbind the port. this needs to be fixed in newt before we can do this
-                        healthChecksToBeRemoved,
-                        deletedResource.mode === "udp" ? "udp" : "tcp",
-                        newt.version
-                    );
-                }
-            }
-        }
-
-        // Also delete default resource policy
-        if (deletedResource.defaultResourcePolicyId) {
-            await db
-                .delete(resourcePolicies)
-                .where(
-                    eq(
-                        resourcePolicies.resourcePolicyId,
-                        deletedResource.defaultResourcePolicyId
-                    )
-                );
-        }
+        await runResourceDeleteSideEffects(deleteResult);

        return response(res, {
            data: null,
@@ -154,6 +86,9 @@ export async function deleteResource(
        });
    } catch (error) {
        logger.error(error);
+        if (createHttpError.isHttpError(error)) {
+            return next(error);
+        }
        return next(
            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
        );
--- a/server/routers/resource/getExchangeToken.ts
+++ b/server/routers/resource/getExchangeToken.ts
@@ -80,8 +80,7 @@ export async function getExchangeToken(
            return next(
                createHttpError(
                    HttpCode.FORBIDDEN,
-                    "Failed organization access policy check: " +
-                        (hasAccess.error || "Unknown error")
+                    "" + (hasAccess.error || "Unknown error")
                )
            );
        }
--- a/server/routers/resource/getResource.ts
+++ b/server/routers/resource/getResource.ts
@@ -9,6 +9,7 @@ import { NextFunction, Request, Response } from "express";
 import createHttpError from "http-errors";
 import { z } from "zod";
 import { fromError } from "zod-validation-error";
+import { applyInlinePolicyFields } from "./inlinePolicyFields";

 const getResourceSchema = z.strictObject({
    resourceId: z
@@ -151,13 +152,7 @@ export async function getResource(
            const policy = await queryInlinePolicy(
                resource.defaultResourcePolicyId!
            );
-            returnData = {
-                ...returnData,
-                sso: policy?.sso || null,
-                emailWhitelistEnabled: policy?.emailWhitelistEnabled || null,
-                applyRules: policy?.applyRules || null,
-                skipToIdpId: policy?.idpId || null
-            };
+            returnData = applyInlinePolicyFields(returnData, policy);
        }

        return response<GetResourceResponse>(res, {
--- a/server/routers/resource/inlinePolicyFields.test.ts
+++ b/server/routers/resource/inlinePolicyFields.test.ts
@@ -0,0 +1,74 @@
+import { assertEquals } from "../../../test/assert";
+import { applyInlinePolicyFields } from "./inlinePolicyFields";
+
+function runTests() {
+    const resource = {
+        resourceId: 1,
+        name: "dashboard",
+        sso: null,
+        emailWhitelistEnabled: null,
+        applyRules: null,
+        skipToIdpId: null
+    } as any;
+
+    const enabledPolicy = {
+        sso: true,
+        emailWhitelistEnabled: true,
+        applyRules: true,
+        idpId: 42
+    };
+
+    const enabledResult = applyInlinePolicyFields(resource, enabledPolicy);
+    assertEquals(enabledResult.sso, true, "sso should mirror policy true");
+    assertEquals(
+        enabledResult.emailWhitelistEnabled,
+        true,
+        "email whitelist should mirror policy true"
+    );
+    assertEquals(
+        enabledResult.applyRules,
+        true,
+        "applyRules should mirror policy true"
+    );
+    assertEquals(
+        enabledResult.skipToIdpId,
+        42,
+        "skipToIdpId should use policy idpId"
+    );
+
+    const disabledPolicy = {
+        sso: false,
+        emailWhitelistEnabled: false,
+        applyRules: false,
+        idpId: null
+    };
+
+    const disabledResult = applyInlinePolicyFields(resource, disabledPolicy);
+    assertEquals(disabledResult.sso, false, "sso false must not become null");
+    assertEquals(
+        disabledResult.emailWhitelistEnabled,
+        false,
+        "email whitelist false must not become null"
+    );
+    assertEquals(
+        disabledResult.applyRules,
+        false,
+        "applyRules false must not become null"
+    );
+    assertEquals(
+        disabledResult.skipToIdpId,
+        null,
+        "missing idp should stay null"
+    );
+
+    const missingPolicyResult = applyInlinePolicyFields(resource, null);
+    assertEquals(
+        missingPolicyResult.sso,
+        null,
+        "missing policy should return nullable resource fields"
+    );
+
+    console.log("PASS: inline policy fields mirror policy values");
+}
+
+runTests();
--- a/server/routers/resource/inlinePolicyFields.ts
+++ b/server/routers/resource/inlinePolicyFields.ts
@@ -0,0 +1,19 @@
+import type { Resource, ResourcePolicy } from "@server/db";
+
+type InlinePolicyFields = Pick<
+    ResourcePolicy,
+    "sso" | "emailWhitelistEnabled" | "applyRules" | "idpId"
+>;
+
+export function applyInlinePolicyFields<T extends Resource>(
+    resource: T,
+    policy: InlinePolicyFields | null | undefined
+): T {
+    return {
+        ...resource,
+        sso: policy?.sso ?? null,
+        emailWhitelistEnabled: policy?.emailWhitelistEnabled ?? null,
+        applyRules: policy?.applyRules ?? null,
+        skipToIdpId: policy?.idpId ?? null
+    };
+}
--- a/server/routers/resource/listResourceRules.ts
+++ b/server/routers/resource/listResourceRules.ts
@@ -14,7 +14,7 @@ const listResourceRulesParamsSchema = z.strictObject({
    resourceId: z.coerce.number().int().positive()
 });

-const listResourceRulesSchema = z.object({
+const listResourceRulesSchema = z.strictObject({
    limit: z
        .string()
        .optional()
--- a/server/routers/resource/listResources.ts
+++ b/server/routers/resource/listResources.ts
@@ -48,7 +48,7 @@ const listResourcesParamsSchema = z.strictObject({
    orgId: z.string()
 });

-const listResourcesSchema = z.object({
+const listResourcesSchema = z.strictObject({
    pageSize: z.coerce
        .number<string>() // for prettier formatting
        .int()
--- a/server/routers/resource/listUserResourceAliases.ts
+++ b/server/routers/resource/listUserResourceAliases.ts
@@ -32,7 +32,7 @@ const listUserResourceAliasesParamsSchema = z.strictObject({
    orgId: z.string()
 });

-const listUserResourceAliasesQuerySchema = z.object({
+const listUserResourceAliasesQuerySchema = z.strictObject({
    pageSize: z.coerce
        .number<string>()
        .int()
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
dependabot[bot]	ca8f59cfa9	Bump actions/setup-go in the github-actions-dependencies group Bumps the github-actions-dependencies group with 1 update: [actions/setup-go](https://github.com/actions/setup-go). Updates `actions/setup-go` from 6.4.0 to 6.5.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](`4a3601121d...924ae3a1cd`) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 6.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>	2026-06-29 01:33:48 +00:00
Owen Schwartz	784588cebc	Merge pull request #3350 from fosrl/dev Make sure the rebuild actually executes	2026-06-26 09:28:12 -04:00
Owen	2e628fe0e4	Make sure the rebuild actually executes	2026-06-26 09:26:43 -04:00
Owen Schwartz	7590e8d8a1	Merge pull request #3345 from fosrl/dev Show utility subnet on org	2026-06-25 13:05:32 -07:00
Owen	053ff1e799	Add utility subnet	2026-06-25 15:39:04 -04:00
Owen Schwartz	c5ffca499e	Merge pull request #3330 from fosrl/dev 1.19.3	2026-06-25 11:54:25 -07:00
Owen Schwartz	9ae54f445d	Merge pull request #3343 from fosrl/crowdin_dev New Crowdin updates	2026-06-25 11:45:14 -07:00
Owen Schwartz	8183d19400	New translations en-us.json (Norwegian Bokmal) [ci skip]	2026-06-25 11:44:44 -07:00
Owen Schwartz	7425daad3f	New translations en-us.json (Chinese Simplified) [ci skip]	2026-06-25 11:44:43 -07:00
Owen Schwartz	39d61a35eb	New translations en-us.json (Turkish) [ci skip]	2026-06-25 11:44:41 -07:00
Owen Schwartz	f3fe11c136	New translations en-us.json (Russian) [ci skip]	2026-06-25 11:44:39 -07:00
Owen Schwartz	66b1b385a3	New translations en-us.json (Portuguese) [ci skip]	2026-06-25 11:44:37 -07:00
Owen Schwartz	822a07d48e	New translations en-us.json (Polish) [ci skip]	2026-06-25 11:44:35 -07:00
Owen Schwartz	3c13b1ea15	New translations en-us.json (Dutch) [ci skip]	2026-06-25 11:44:33 -07:00
Owen Schwartz	fee635b861	New translations en-us.json (Korean) [ci skip]	2026-06-25 11:44:31 -07:00
Owen Schwartz	7e4dea918a	New translations en-us.json (Italian) [ci skip]	2026-06-25 11:44:29 -07:00
Owen Schwartz	56187d61d5	New translations en-us.json (German) [ci skip]	2026-06-25 11:44:27 -07:00
Owen Schwartz	36460d4cc0	New translations en-us.json (Danish) [ci skip]	2026-06-25 11:44:25 -07:00
Owen Schwartz	88a9b92dc3	New translations en-us.json (Czech) [ci skip]	2026-06-25 11:44:23 -07:00
Owen Schwartz	dd26518d6f	New translations en-us.json (Bulgarian) [ci skip]	2026-06-25 11:44:21 -07:00
Owen Schwartz	60339706bb	New translations en-us.json (Spanish) [ci skip]	2026-06-25 11:44:19 -07:00
Owen Schwartz	4b1b3d3d5b	New translations en-us.json (French) [ci skip]	2026-06-25 11:44:17 -07:00
Owen	cf21bacd9c	Merge branch 'main' into dev	2026-06-25 14:30:05 -04:00
Owen Schwartz	80d257b94b	Merge pull request #3336 from mr1beast/main New translations en-us.json (Danish)	2026-06-25 11:24:56 -07:00
Owen Schwartz	e0d0c5dcbf	Merge pull request #3331 from Fredkiss3/feat/geoip-tag-in-tables feat: Show GeoIp country flags in site & rules page	2026-06-25 11:23:42 -07:00
Fred KISSIE	0f02d1bc02	♻️ remove deprecated ISO `CS` country code	2026-06-25 18:01:25 +02:00
Owen	f8591f27c5	Fix no data when last data was over 90 days ago	2026-06-25 10:08:37 -04:00
Owen	877985deb3	Spellcheck	2026-06-24 18:36:01 -04:00
Owen	be3877a3ce	Rename for clarity	2026-06-24 18:36:01 -04:00
Owen	79de64dc07	Fix removing site not removing peer	2026-06-24 18:36:01 -04:00
miloschwartz	d0defa380a	remove split by command and space in role form	2026-06-24 17:52:21 -04:00
miloschwartz	4eba51de72	support delete resources associated with site	2026-06-24 17:45:44 -04:00
mr1beast	a48032adb3	New translations en-us.json (Danish) New translations en-us.json (Danish)	2026-06-24 21:25:57 +00:00
miloschwartz	6fe4eee336	improve org policy error message responses	2026-06-24 16:32:58 -04:00
Owen	242123b875	Implement non-redis lock	2026-06-24 16:01:05 -04:00
miloschwartz	2b38658ea6	make sidebar notification failures more resilient	2026-06-24 15:55:29 -04:00
miloschwartz	b18a41e4aa	adjust translation	2026-06-24 15:55:29 -04:00
Owen	d303fa05cb	Comment out the sync	2026-06-24 15:50:54 -04:00
Owen	75b87ffba7	Quiet log message	2026-06-24 15:49:51 -04:00
Owen	62fc2edae9	Add logging and fix removing alias	2026-06-24 15:28:46 -04:00
Owen	80b66cf9b9	Add locks to rebuilds	2026-06-24 14:13:11 -04:00
Owen	034bcbd271	Reorg	2026-06-24 11:54:56 -04:00
Owen	bc63747efe	Refactor out transactions and always call rebuild on update	2026-06-23 18:12:51 -04:00
Fred KISSIE	bb7729df00	💄 show geoip flag in policy access rule tab	2026-06-23 23:45:59 +02:00
Owen	2a8ceeec1b	Restrict admin role	2026-06-23 17:45:42 -04:00
Owen	91ef0d0153	Show warning about the .local aliases	2026-06-23 17:44:18 -04:00
Fred KISSIE	e104489257	💄 Show GeoIp flag in site details page	2026-06-23 23:28:46 +02:00
Owen	b8101402cd	Merge branch 'main' into dev	2026-06-23 17:14:53 -04:00
Owen	7731849a2f	Standardize db rebuildClientAssociationsFromClient	2026-06-23 17:14:40 -04:00
Owen	c11d24e10a	Standardize db rebuildClientAssociationsFromClient	2026-06-23 17:14:40 -04:00
Owen	a9b7cce49b	Improve efficiency of calculateUserClientsForOrgs	2026-06-23 17:14:40 -04:00
Owen	d78223b94f	Fix import to be private	2026-06-23 17:14:40 -04:00
Owen Schwartz	963e9da7dd	Merge pull request #3213 from ivenos/rename-to-compose-yaml Rename docker-compose.yml to compose.yaml	2026-06-23 12:03:56 -07:00
Owen Schwartz	2cbc88fa05	Merge pull request #3326 from fosrl/dependabot/npm_and_yarn/js-yaml-4.2.0 Bump js-yaml from 4.1.1 to 4.2.0	2026-06-23 12:02:49 -07:00
Owen Schwartz	65bad456cb	Merge pull request #3327 from fosrl/crowdin_dev New Crowdin updates	2026-06-23 12:02:11 -07:00
Owen	f48a4f7bc0	Enforce strick query params Fixes #3313	2026-06-23 12:22:47 -04:00
Owen	ce3c2f7583	Fix #3314	2026-06-23 12:05:47 -04:00
Owen	51c357e6c7	Merge branch 'main' into dev	2026-06-23 11:30:46 -04:00
Owen Schwartz	7ae29612d4	Merge pull request #3302 from RitwijParmar/codex/resource-update-inline-policy-response Fix inline policy fields in resource update response	2026-06-23 08:30:31 -07:00
Owen	da794adb7d	Merge branch 'main' into dev	2026-06-23 11:26:03 -04:00
Owen	8004ae6870	Use the policy when updating rule Fixes #3273	2026-06-23 11:25:53 -04:00
Owen Schwartz	1bff7bbc2f	Merge pull request #3315 from fosrl/dependabot/npm_and_yarn/nodemailer-9.0.1 Bump nodemailer from 8.0.9 to 9.0.1	2026-06-23 07:58:58 -07:00
Owen Schwartz	50db5695fc	Merge pull request #3264 from fosrl/dependabot/npm_and_yarn/esbuild-0.28.1 Bump esbuild from 0.28.0 to 0.28.1	2026-06-23 07:57:47 -07:00
Owen Schwartz	babd90ae71	New translations en-us.json (Norwegian Bokmal) [ci skip]	2026-06-22 15:22:46 -07:00
Owen Schwartz	f7050ef989	New translations en-us.json (Chinese Simplified) [ci skip]	2026-06-22 15:22:44 -07:00
Owen Schwartz	b2778a2c49	New translations en-us.json (Turkish) [ci skip]	2026-06-22 15:22:42 -07:00
Owen Schwartz	096940a152	New translations en-us.json (Russian) [ci skip]	2026-06-22 15:22:40 -07:00
Owen Schwartz	73eb07de71	New translations en-us.json (Portuguese) [ci skip]	2026-06-22 15:22:38 -07:00
Owen Schwartz	74ef844e27	New translations en-us.json (Polish) [ci skip]	2026-06-22 15:22:36 -07:00
Owen Schwartz	c58968536d	New translations en-us.json (Dutch) [ci skip]	2026-06-22 15:22:34 -07:00
Owen Schwartz	228efacfe0	New translations en-us.json (Korean) [ci skip]	2026-06-22 15:22:32 -07:00
Owen Schwartz	1262030abb	New translations en-us.json (Italian) [ci skip]	2026-06-22 15:22:30 -07:00
Owen Schwartz	b07fe6d18b	New translations en-us.json (German) [ci skip]	2026-06-22 15:22:28 -07:00
Owen Schwartz	63c3ee623b	New translations en-us.json (Czech) [ci skip]	2026-06-22 15:22:26 -07:00
Owen Schwartz	18ec6c8d92	New translations en-us.json (Bulgarian) [ci skip]	2026-06-22 15:22:24 -07:00
Owen Schwartz	d8acccbde4	New translations en-us.json (Spanish) [ci skip]	2026-06-22 15:22:22 -07:00
Owen Schwartz	37eaf34e4d	New translations en-us.json (French) [ci skip]	2026-06-22 15:22:20 -07:00
dependabot[bot]	cfb63f9742	Bump js-yaml from 4.1.1 to 4.2.0 Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.2.0. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/4.1.1...4.2.0) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>	2026-06-22 21:04:39 +00:00
Owen Schwartz	c76b4555e1	Merge pull request #3316 from fosrl/dependabot/npm_and_yarn/form-data-4.0.6 Bump form-data from 4.0.5 to 4.0.6	2026-06-22 14:03:06 -07:00
Owen Schwartz	c25bfbad27	Merge pull request #3317 from fosrl/dependabot/github_actions/actions/checkout-7.0.0 Bump actions/checkout from 6.0.2 to 7.0.0	2026-06-22 14:02:51 -07:00
Owen Schwartz	44782f8963	Merge pull request #3323 from fosrl/dependabot/go_modules/install/go-install-dependencies-4dfeb96e78 Bump golang.org/x/term from 0.43.0 to 0.44.0 in /install in the go-install-dependencies group	2026-06-22 14:02:31 -07:00
Owen Schwartz	e6f7cd6da9	Merge pull request #3206 from gmpinder/fix-idp-delete fix: Add DELETE /idp/{idpId} to integration API	2026-06-22 14:01:47 -07:00
Owen Schwartz	19faa3a29c	Merge pull request #3223 from Adityakk9031/#2867 fix: request logs not loading on initial page open in Community Editi…	2026-06-22 14:00:29 -07:00
Owen	c284dc2e83	Merge branch 'Fredkiss3-refactor/show-if-client-needs-update' into dev	2026-06-22 16:58:55 -04:00
Owen	1b634955d8	Merge branch 'refactor/show-if-client-needs-update' of github.com:Fredkiss3/pangolin into dev	2026-06-22 16:58:50 -04:00
Fred KISSIE	be888c3fc1	💄 Show the latest new update in machine client table	2026-06-22 16:57:47 -04:00
Fred KISSIE	3f2bb42221	♻️ `lt` instead of `lte`	2026-06-22 16:57:47 -04:00
Fred KISSIE	5dc3ae4c7f	♻️ sites & clients should not get latest versions on the server	2026-06-22 16:57:45 -04:00
Fred KISSIE	ffb6c64de0	💄 Show updates available in the frontend, on sites & user devices	2026-06-22 16:57:08 -04:00
Fred KISSIE	2cbc6fb128	🏷️ types	2026-06-22 16:57:08 -04:00
Fred KISSIE	75084028d7	♻️ Remove queries that prefetch 1000 users/roles in private resources form	2026-06-22 16:57:08 -04:00
Owen	f44a7c55dd	Merge branch 'refactor/show-if-client-needs-update' of github.com:Fredkiss3/pangolin into Fredkiss3-refactor/show-if-client-needs-update	2026-06-22 16:56:52 -04:00
Owen Schwartz	72fa1d6a14	Merge pull request #3325 from fosrl/queue Improve performance of rebuild functions	2026-06-22 13:49:20 -07:00
dependabot[bot]	753358a17d	Bump golang.org/x/term in /install in the go-install-dependencies group Bumps the go-install-dependencies group in /install with 1 update: [golang.org/x/term](https://github.com/golang/term). Updates `golang.org/x/term` from 0.43.0 to 0.44.0 - [Commits](https://github.com/golang/term/compare/v0.43.0...v0.44.0) --- updated-dependencies: - dependency-name: golang.org/x/term dependency-version: 0.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-install-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>	2026-06-22 14:32:24 +00:00
dependabot[bot]	d747b45f0b	Bump actions/checkout from 6.0.2 to 7.0.0 Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](`de0fac2e45...9c091bb21b`) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-06-22 01:33:16 +00:00
dependabot[bot]	a24091257a	Bump form-data from 4.0.5 to 4.0.6 Bumps [form-data](https://github.com/form-data/form-data) from 4.0.5 to 4.0.6. - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](https://github.com/form-data/form-data/compare/v4.0.5...v4.0.6) --- updated-dependencies: - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2026-06-21 19:40:11 +00:00
dependabot[bot]	1c60041390	Bump nodemailer from 8.0.9 to 9.0.1 Bumps [nodemailer](https://github.com/nodemailer/nodemailer) from 8.0.9 to 9.0.1. - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodemailer/nodemailer/compare/v8.0.9...v9.0.1) --- updated-dependencies: - dependency-name: nodemailer dependency-version: 9.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>	2026-06-21 09:46:17 +00:00
Ritwij Aryan Parmar	95c3f74a33	Fix inline policy fields in resource update response	2026-06-17 14:36:34 -04:00
dependabot[bot]	cedccd8cdb	Bump esbuild from 0.28.0 to 0.28.1 Bumps [esbuild](https://github.com/evanw/esbuild) from 0.28.0 to 0.28.1. - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](https://github.com/evanw/esbuild/compare/v0.28.0...v0.28.1) --- updated-dependencies: - dependency-name: esbuild dependency-version: 0.28.1 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>	2026-06-13 01:23:46 +00:00
Fred KISSIE	7a275c86c2	Merge branch 'dev' into refactor/show-if-client-needs-update	2026-06-11 21:05:31 +02:00
Fred KISSIE	4b703b5c11	💄 Show the latest new update in machine client table	2026-06-11 20:58:23 +02:00
Fred KISSIE	1b6e9e8cfe	♻️ `lt` instead of `lte`	2026-06-11 19:55:48 +02:00
Fred KISSIE	fe55956079	♻️ sites & clients should not get latest versions on the server	2026-06-10 22:58:42 +02:00
Fred KISSIE	4cd0b9a0bb	💄 Show updates available in the frontend, on sites & user devices	2026-06-10 22:57:55 +02:00
Fred KISSIE	ab4d567af9	🏷️ types	2026-06-10 20:56:24 +02:00
Fred KISSIE	38203e522b	♻️ Remove queries that prefetch 1000 users/roles in private resources form	2026-06-09 19:29:00 +02:00
Aditya kumar singh	13b691fd7d	fix: request logs not loading on initial page open in Community Edition (#2867 )	2026-06-06 00:34:48 +05:30
ivenos	89f3f3c8cd	Rename docker-compose.yml to compose.yaml	2026-06-04 10:01:35 +02:00
Gerald Pinder	44c16d69af	fix: Add DELETE /idp/{idpId} to integration API	2026-06-03 12:48:34 -04:00