Bump node in the docker-dependencies group across 1 directory

Bumps the docker-dependencies group with 1 update in the / directory: node.


Updates `node` from 24-alpine to 26-alpine

---
updated-dependencies:
- dependency-name: node
  dependency-version: 26-alpine
  dependency-type: direct:production
  dependency-group: docker-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Dockerfile.dev

@@ -1,4 +1,4 @@
-FROM node:24-alpine
+FROM node:26-alpine
 
 WORKDIR /app
 

compose.example.yaml

@@ -41,7 +41,7 @@ services:
       - 80:80 # Port for traefik because of the network_mode
 
   traefik:
-    image: traefik:v3.6
+    image: traefik:v3.7
     container_name: traefik
     restart: unless-stopped
     network_mode: service:gerbil # Ports appear on the gerbil service

install/config/docker-compose.yml

@@ -50,7 +50,7 @@ services:
       - 80:80{{end}}
 
   traefik:
-    image: docker.io/traefik:v3.6
+    image: docker.io/traefik:v3.7
     container_name: traefik
     restart: unless-stopped
     {{if .InstallGerbil}}network_mode: service:gerbil # Ports appear on the gerbil service{{end}}{{if not .InstallGerbil}}

messages/en-US.json

@@ -864,8 +864,8 @@
     "policyAuthHeaderAuthTitle": "Basic Header Auth",
     "policyAuthHeaderAuthDescription": "Validate a custom HTTP header name and value on each request",
     "policyAuthHeaderAuthSummary": "Header configured",
-    "policyAuthHeaderName": "Header name",
-    "policyAuthHeaderValue": "Expected value",
+    "policyAuthHeaderName": "Username",
+    "policyAuthHeaderValue": "Password",
     "policyAuthSetPasscode": "Set Passcode",
     "policyAuthSetPincode": "Set PIN Code",
     "policyAuthSetEmailWhitelist": "Set Email Whitelist",
@@ -1915,6 +1915,9 @@
     "billingDomains": "Domains",
     "billingOrganizations": "Orgs",
     "billingRemoteExitNodes": "Remote Nodes",
+    "billingPublicResources": "Public Resources",
+    "billingPrivateResources": "Private Resources",
+    "billingMachineClients": "Machine Clients",
     "billingNoLimitConfigured": "No limit configured",
     "billingEstimatedPeriod": "Estimated Billing Period",
     "billingIncludedUsage": "Included Usage",
@@ -1943,6 +1946,9 @@
     "billingUsersInfo": "How many users you can use",
     "billingDomainInfo": "How many domains you can use",
     "billingRemoteExitNodesInfo": "How many remote nodes you can use",
+    "billingPublicResourcesInfo": "How many public resources you can use",
+    "billingPrivateResourcesInfo": "How many private resources you can use",
+    "billingMachineClientsInfo": "How many machine clients you can use",
     "billingLicenseKeys": "License Keys",
     "billingLicenseKeysDescription": "Manage your license key subscriptions",
     "billingLicenseSubscription": "License Subscription",
@@ -3571,18 +3577,23 @@
     "memberPortalResourceDisabled": "Resource Disabled",
     "memberPortalShowingResources": "Showing {start}-{end} of {total} resources",
     "resourceLauncherTitle": "Resource Launcher",
-    "resourceLauncherDescription": "View resource details and launch them from one place",
-    "resourceLauncherSearchPlaceholder": "Search all sites...",
+    "resourceLauncherDescription": "View all available resources and launch them from one central hub",
+    "resourceLauncherSearchPlaceholder": "Search your resources...",
     "resourceLauncherDefaultView": "Default",
     "resourceLauncherSaveView": "Save View",
     "resourceLauncherSaveToCurrentView": "Save to Current View",
+    "resourceLauncherSaveDefaultPersonal": "Save for Me",
     "resourceLauncherResetView": "Reset View",
+    "resourceLauncherResetSystemDefault": "Reset to System Default",
+    "resourceLauncherSystemDefaultRestored": "System default restored",
+    "resourceLauncherSystemDefaultRestoredDescription": "The default view has been reset to the original settings.",
     "resourceLauncherSaveAsNewView": "Save as New View",
     "resourceLauncherSaveAsNewViewDescription": "Give this view a name to save your current filters and layout.",
     "resourceLauncherSaveForEveryone": "Save for Everyone",
     "resourceLauncherSaveForEveryoneDescription": "Share this view with all organization members. When unchecked, the view is only visible to you.",
     "resourceLauncherMakePersonal": "Make Personal",
     "resourceLauncherFilter": "Filter",
+    "resourceLauncherFilterWithCount": "Filter, {count} applied",
     "resourceLauncherSort": "Sort",
     "resourceLauncherSortAscending": "Sort ascending",
     "resourceLauncherSortDescending": "Sort descending",
@@ -3590,6 +3601,7 @@
     "resourceLauncherGroupBy": "Group By",
     "resourceLauncherGroupBySite": "Site",
     "resourceLauncherGroupByLabel": "Label",
+    "resourceLauncherGroupByNone": "None",
     "resourceLauncherLayout": "Layout",
     "resourceLauncherLayoutGrid": "Grid",
     "resourceLauncherLayoutList": "List",
@@ -3597,8 +3609,20 @@
     "resourceLauncherShowSiteTags": "Show Site Tags",
     "resourceLauncherShowRecents": "Show Recents",
     "resourceLauncherDeleteView": "Delete View",
+    "resourceLauncherDeleteViewTitle": "Delete View",
+    "resourceLauncherDeleteViewQuestion": "Are you sure you want to delete this launcher view?",
+    "resourceLauncherDeleteViewConfirm": "Delete View",
     "resourceLauncherViewAsAdmin": "View as Admin",
-    "resourceLauncherResourceDetailsDescription": "View details for this resource.",
+    "resourceLauncherResourceDetailsDescription": "Connection information and status for this resource.",
+    "resourceLauncherResourceDetails": "Resource Details",
+    "resourceLauncherAuthMethodsDescription": "Authentication methods enabled for this resource.",
+    "resourceLauncherPrivateClientRequired": "Connect with a client on your device to access this resource privately.",
+    "resourceLauncherPrivateClientRequiredTitle": "Client Connection Required",
+    "resourceLauncherDownloadClient": "Download client",
+    "resourceLauncherFailedToLoadDetails": "Could not load resource details. You may no longer have access to this resource.",
+    "resourceLauncherNoPortRestrictions": "No port restrictions",
+    "resourceLauncherTcp": "TCP",
+    "resourceLauncherUdp": "UDP",
     "resourceLauncherUnlabeled": "Unlabeled",
     "resourceLauncherNoSite": "No Site",
     "resourceLauncherNoResourcesInGroup": "No resources in this group",
@@ -3607,6 +3631,12 @@
     "resourceLauncherEmptyStateNoResultsTitle": "No Resources Found",
     "resourceLauncherEmptyStateNoResultsDescription": "No resources match your current search or filters. Try adjusting them to find what you are looking for.",
     "resourceLauncherEmptyStateNoResultsWithQuery": "No resources match \"{query}\". Try adjusting your search or clearing filters to see all resources.",
+    "resourceLauncherSearchFirstTitle": "Search or Filter to Browse",
+    "resourceLauncherSearchFirstDescription": "You have access to many resources. Use search or filter by site or label to find what you need.",
+    "resourceLauncherSiteGroupingDisabled": "Site grouping is unavailable at this scale. Filter by site to group a smaller set.",
+    "resourceLauncherLabelGroupingDisabled": "Label grouping is unavailable at this scale.",
+    "resourceLauncherCompactModeHint": "Showing a simplified list for faster browsing. Use search or filters to narrow results.",
+    "resourceLauncherCompactGroupingHint": "Apply site or label filters to enable grouping.",
     "resourceLauncherCopiedToClipboard": "Copied to clipboard",
     "resourceLauncherCopiedAccessDescription": "Resource access has been copied to your clipboard.",
     "resourceLauncherViewNamePlaceholder": "View name",

server/db/pg/poolConfig.ts

@@ -1,3 +1,4 @@
+import config from "@server/lib/config";
 import { Pool, PoolConfig } from "pg";
 
 export function createPoolConfig(
@@ -39,6 +40,28 @@ export function attachPoolErrorHandlers(pool: Pool, label: string): void {
                 `Failed to set statement_timeout on ${label} client: ${err.message}`
             );
         });
+
+        // Disable JIT compilation for this connection. Our hot-path queries
+        // (e.g. resource-by-domain lookups) join many tables but only ever
+        // return a handful of rows. When planner row estimates drift (e.g.
+        // due to autovacuum lag under write-heavy load), Postgres decides
+        // these plans are expensive enough to JIT-compile, which can add
+        // multiple seconds of pure compilation overhead per query and
+        // saturate the connection pool. JIT never pays off for these
+        // short-lived OLTP queries, so it's disabled outright rather than
+        // relying on statistics staying fresh.
+        //
+        // Set via a runtime SET command rather than the `options: "-c
+        // jit=off"` startup parameter: connections in SaaS mode go through
+        // a pooler (e.g. PgBouncer) that rejects arbitrary startup packet
+        // options with a protocol_violation (08P01) error.
+        if (config.getRawConfig().postgres?.pool.jit_mode == false) {
+            client.query("SET jit = off").catch((err: Error) => {
+                console.warn(
+                    `Failed to set jit=off on ${label} client: ${err.message}`
+                );
+            });
+        }
     });
 }
 

server/db/pg/schema/schema.ts

@@ -232,6 +232,7 @@ export const launcherViews = pgTable("launcherViews", {
     }),
     name: varchar("name").notNull(),
     config: text("config").notNull(),
+    isDefault: boolean("isDefault").notNull().default(false),
     createdAt: varchar("createdAt").notNull(),
     updatedAt: varchar("updatedAt").notNull()
 });

server/db/sqlite/schema/schema.ts

@@ -233,6 +233,9 @@ export const launcherViews = sqliteTable("launcherViews", {
     }),
     name: text("name").notNull(),
     config: text("config").notNull(),
+    isDefault: integer("isDefault", { mode: "boolean" })
+        .notNull()
+        .default(false),
     createdAt: text("createdAt").notNull(),
     updatedAt: text("updatedAt").notNull()
 });

server/lib/billing/features.ts

@@ -27,6 +27,12 @@ export async function getFeatureDisplayName(
             return "Remote Exit Nodes";
         case LimitId.ORGANIZATIONS:
             return "Organizations";
+        case LimitId.PUBLIC_RESOURCES:
+            return "Public Resources";
+        case LimitId.PRIVATE_RESOURCES:
+            return "Private Resources";
+        case LimitId.MACHINE_CLIENTS:
+            return "Machine Clients";
         case LimitId.TIER1:
             return "Home Lab";
         default:

server/lib/blueprints/applyNewtDockerBlueprint.ts

@@ -116,7 +116,7 @@ export async function applyNewtDockerBlueprint(
             source: "NEWT"
         });
     } catch (error) {
-        logger.error(`Failed to update database from config: ${error}`);
+        logger.debug(`Failed to update database from config: ${error}`);
         await sendToClient(newtId, {
             type: "newt/blueprint/results",
             data: {

server/lib/dbRetry.ts

@@ -0,0 +1,83 @@
+import logger from "@server/logger";
+
+const MAX_RETRIES = 5;
+const BASE_DELAY_MS = 50;
+
+/**
+ * Detect transient errors that are safe to retry (connection drops, deadlocks,
+ * serialization failures). PostgreSQL deadlocks (40P01) are always safe to
+ * retry: the database guarantees exactly one winner per deadlock pair, so the
+ * loser just needs to try again.
+ */
+export function isTransientError(error: any): boolean {
+    if (!error) return false;
+
+    const message = (error.message || "").toLowerCase();
+    const causeMessage = (error.cause?.message || "").toLowerCase();
+    const code = error.code || error.cause?.code || "";
+
+    // Connection timeout / terminated
+    if (
+        message.includes("connection timeout") ||
+        message.includes("connection terminated") ||
+        message.includes("timeout exceeded when trying to connect") ||
+        causeMessage.includes("connection terminated unexpectedly") ||
+        causeMessage.includes("connection timeout")
+    ) {
+        return true;
+    }
+
+    // PostgreSQL deadlock detected - always safe to retry (one winner guaranteed)
+    if (code === "40P01" || message.includes("deadlock")) {
+        return true;
+    }
+
+    // PostgreSQL serialization failure
+    if (code === "40001") {
+        return true;
+    }
+
+    // ECONNRESET, ECONNREFUSED, EPIPE, ETIMEDOUT
+    if (
+        code === "ECONNRESET" ||
+        code === "ECONNREFUSED" ||
+        code === "EPIPE" ||
+        code === "ETIMEDOUT"
+    ) {
+        return true;
+    }
+
+    return false;
+}
+
+/**
+ * Simple retry wrapper with exponential backoff for transient errors
+ * (deadlocks, connection timeouts, unexpected disconnects).
+ */
+export async function withRetry<T>(
+    operation: () => Promise<T>,
+    context: string,
+    maxRetries: number = MAX_RETRIES,
+    baseDelayMs: number = BASE_DELAY_MS
+): Promise<T> {
+    let attempt = 0;
+    while (true) {
+        try {
+            return await operation();
+        } catch (error: any) {
+            if (isTransientError(error) && attempt < maxRetries) {
+                attempt++;
+                const baseDelay = Math.pow(2, attempt - 1) * baseDelayMs;
+                const jitter = Math.random() * baseDelay;
+                const delay = baseDelay + jitter;
+                logger.warn(
+                    `Transient DB error in ${context}, retrying attempt ${attempt}/${maxRetries} after ${delay.toFixed(0)}ms`,
+                    { code: error?.code ?? error?.cause?.code }
+                );
+                await new Promise((resolve) => setTimeout(resolve, delay));
+                continue;
+            }
+            throw error;
+        }
+    }
+}

server/lib/exitNodes/subnet.ts

@@ -1,10 +1,31 @@
-import { db, exitNodes } from "@server/db";
+import { db, exitNodes, Transaction } from "@server/db";
 import config from "@server/lib/config";
 import { findNextAvailableCidr } from "@server/lib/ip";
+import { lockManager } from "#dynamic/lib/lock";
 
-export async function getNextAvailableSubnet(): Promise<string> {
+/**
+ * Reserves the next available exit node subnet.
+ *
+ * Exit node subnets must never overlap with one another - regardless of
+ * which org(s) they belong to - since HA exit nodes can end up routing for
+ * the same org. This acquires a lock that the caller MUST release (via the
+ * returned `release`) only after the chosen address has been durably
+ * persisted (e.g. after the enclosing transaction commits), otherwise
+ * concurrent callers can race and pick the same subnet.
+ */
+export async function getNextAvailableSubnet(
+    trx: Transaction | typeof db = db
+): Promise<{ value: string; release: () => Promise<void> }> {
+    const lockKey = "exit-node-subnet-allocation";
+    const acquired = await lockManager.acquireLockWithRetry(lockKey, 6000);
+    if (!acquired) {
+        throw new Error(`Failed to acquire lock: ${lockKey}`);
+    }
+    const release = () => lockManager.releaseLock(lockKey, acquired);
+
+    try {
         // Get all existing subnets from routes table
-    const existingAddresses = await db
+        const existingAddresses = await trx
             .select({
                 address: exitNodes.address
             })
@@ -26,5 +47,9 @@ export async function getNextAvailableSubnet(): Promise<string> {
             ".1" +
             "/" +
             subnet.split("/")[1];
-    return subnet;
+        return { value: subnet, release };
+    } catch (e) {
+        await release();
+        throw e;
+    }
 }

server/lib/readConfigFile.ts

@@ -184,7 +184,8 @@ export const configSchema = z
                             .number()
                             .positive()
                             .optional()
-                            .default(5000)
+                            .default(5000),
+                        jit_mode: z.boolean().default(true)
                     })
                     .optional()
                     .prefault({})

server/lib/rebuildClientAssociations.ts

@@ -45,6 +45,7 @@ import {
 } from "@server/routers/client/targets";
 import { lockManager } from "#dynamic/lib/lock";
 import { rebuildQueue } from "#dynamic/lib/rebuildQueue";
+import { withRetry, isTransientError } from "@server/lib/dbRetry";
 import {
     checkOrgRebuildRateLimit,
     decrementOrgRebuildCount,
@@ -285,10 +286,20 @@ export async function rebuildClientAssociationsFromSiteResource(
 ) {
     await incrementOrgRebuildCount(siteResource.orgId);
     try {
-        return await lockManager.withLock(
+        // The whole locked rebuild is idempotent (it diffs full expected vs.
+        // actual state each time), so on a transient DB error it's safe to
+        // retry the entire thing rather than just the failed query.
+        return await withRetry(
+            () =>
+                lockManager.withLock(
                     `rebuild-client-associations:site-resource:${siteResource.siteResourceId}`,
-            () => rebuildClientAssociationsFromSiteResourceImpl(siteResource),
+                    () =>
+                        rebuildClientAssociationsFromSiteResourceImpl(
+                            siteResource
+                        ),
                     REBUILD_ASSOCIATIONS_LOCK_TTL_MS
+                ),
+            `rebuildClientAssociationsFromSiteResource:${siteResource.siteResourceId}`
         );
     } catch (err: any) {
         if (
@@ -304,6 +315,17 @@ export async function rebuildClientAssociationsFromSiteResource(
             });
             return { mergedAllClients: [] };
         }
+        if (isTransientError(err)) {
+            logger.warn(
+                `rebuildClientAssociations: transient DB error rebuilding site resource ${siteResource.siteResourceId} persisted after retries, queuing for deferred processing:`,
+                err
+            );
+            await rebuildQueue.enqueue({
+                type: "site-resource",
+                id: siteResource.siteResourceId
+            });
+            return { mergedAllClients: [] };
+        }
         throw err;
     } finally {
         await decrementOrgRebuildCount(siteResource.orgId);
@@ -463,6 +485,7 @@ async function rebuildClientAssociationsFromSiteResourceImpl(
         await trx
             .insert(clientSiteResourcesAssociationsCache)
             .values(clientSiteResourcesToInsert)
+            .onConflictDoNothing()
             .returning();
         logger.debug(
             `rebuildClientAssociations: [rebuildClientAssociationsFromSiteResource] siteResourceId=${siteResource.siteResourceId} inserted clientSiteResource associations`
@@ -510,6 +533,7 @@ async function rebuildClientAssociationsFromSiteResourceImpl(
     for (const site of sitesToProcess) {
         const siteId = site.siteId;
 
+        try {
             logger.debug(
                 `rebuildClientAssociations: [rebuildClientAssociationsFromSiteResource] processing siteId=${siteId} for siteResourceId=${siteResource.siteResourceId}`
             );
@@ -539,11 +563,14 @@ async function rebuildClientAssociationsFromSiteResourceImpl(
                               subnet: clients.subnet
                           })
                           .from(clients)
-                      .where(inArray(clients.clientId, existingClientSiteIds))
+                          .where(
+                              inArray(clients.clientId, existingClientSiteIds)
+                          )
                     : [];
 
             const otherResourceClientIds =
-            clientsFromOtherResourcesBySite.get(siteId) ?? new Set<number>();
+                clientsFromOtherResourcesBySite.get(siteId) ??
+                new Set<number>();
 
             logger.debug(
                 `rebuildClientAssociations: [rebuildClientAssociationsFromSiteResource] siteId=${siteId} otherResourceClientIds=[${[...otherResourceClientIds].join(", ")}] mergedAllClientIds=[${mergedAllClientIds.join(", ")}]`
@@ -555,10 +582,17 @@ async function rebuildClientAssociationsFromSiteResourceImpl(
                 ? mergedAllClientIds
                 : [];
 
+            // Note: we deliberately do NOT exclude clients covered by another
+            // site resource here (unlike clientSitesToRemove below). Doing so
+            // previously caused a permanent gap: if resource A saw resource B's
+            // cache row and skipped adding (assuming B would maintain it), and
+            // B's own rebuild made the same assumption about A, the site-level
+            // row could end up never inserted by anyone even though both
+            // resources' client associations were otherwise correct.
+            // onConflictDoNothing makes a redundant insert harmless, so there's
+            // no correctness reason to skip here.
             const clientSitesToAdd = expectedClientIdsForSite.filter(
-            (clientId) =>
-                !existingClientSiteIds.includes(clientId) &&
-                !otherResourceClientIds.has(clientId) // dont add if already connected via another site resource
+                (clientId) => !existingClientSiteIds.includes(clientId)
             );
 
             const clientSitesToInsert = clientSitesToAdd.map((clientId) => ({
@@ -577,6 +611,7 @@ async function rebuildClientAssociationsFromSiteResourceImpl(
                 await trx
                     .insert(clientSitesAssociationsCache)
                     .values(clientSitesToInsert)
+                    .onConflictDoNothing()
                     .returning();
                 logger.debug(
                     `rebuildClientAssociations: [rebuildClientAssociationsFromSiteResource] siteId=${siteId} inserted clientSite associations`
@@ -625,6 +660,21 @@ async function rebuildClientAssociationsFromSiteResourceImpl(
                 clientSitesToRemove,
                 trx
             );
+        } catch (err) {
+            // Don't let a failure on one site abort processing of every
+            // other site queued after it in this run. Since we're not
+            // re-throwing, the outer wrapper's retry/requeue logic never
+            // sees this failure, so explicitly queue this resource for a
+            // follow-up pass to reconcile whatever this site didn't get to.
+            logger.error(
+                `rebuildClientAssociations: [rebuildClientAssociationsFromSiteResource] siteId=${siteId} failed while processing site for siteResourceId=${siteResource.siteResourceId}, continuing with remaining sites and queuing a follow-up pass:`,
+                err
+            );
+            await rebuildQueue.enqueue({
+                type: "site-resource",
+                id: siteResource.siteResourceId
+            });
+        }
     }
 
     // Handle subnet proxy target updates for the resource associations
@@ -657,7 +707,7 @@ async function handleMessagesForSiteClients(
     trx: Transaction | typeof db = db
 ): Promise<void> {
     if (!site.exitNodeId) {
-        logger.warn(
+        logger.debug(
             `Exit node ID not on site ${site.siteId} so there is no reason to update clients because it must be offline`
         );
         return;
@@ -671,14 +721,14 @@ async function handleMessagesForSiteClients(
         .limit(1);
 
     if (!exitNode) {
-        logger.warn(
+        logger.debug(
             `Exit node not found for site ${site.siteId} so there is no reason to update clients because it must be offline`
         );
         return;
     }
 
     if (!site.publicKey) {
-        logger.warn(
+        logger.debug(
             `Site publicKey not set for site ${site.siteId} so cannot add peers to clients`
         );
         return;
@@ -692,7 +742,7 @@ async function handleMessagesForSiteClients(
         .where(eq(newts.siteId, siteId))
         .limit(1);
     if (!newt) {
-        logger.warn(
+        logger.debug(
             `Newt not found for site ${siteId} so cannot add peers to clients`
         );
         return;
@@ -917,7 +967,7 @@ export async function updateClientSiteDestinations(
 
     for (const site of sitesData) {
         if (!site.sites.subnet) {
-            logger.warn(`Site ${site.sites.siteId} has no subnet, skipping`);
+            logger.debug(`Site ${site.sites.siteId} has no subnet, skipping`);
             continue;
         }
 
@@ -1656,10 +1706,17 @@ export async function rebuildClientAssociationsFromClient(
     await incrementOrgRebuildCount(client.orgId);
     try {
         const trx = primaryDb;
-        return await lockManager.withLock(
+        // The whole locked rebuild is idempotent (it diffs full expected vs.
+        // actual state each time), so on a transient DB error it's safe to
+        // retry the entire thing rather than just the failed query.
+        return await withRetry(
+            () =>
+                lockManager.withLock(
                     `rebuild-client-associations:client:${client.clientId}`,
                     () => rebuildClientAssociationsFromClientImpl(client, trx),
                     REBUILD_ASSOCIATIONS_LOCK_TTL_MS
+                ),
+            `rebuildClientAssociationsFromClient:${client.clientId}`
         );
     } catch (err: any) {
         if (
@@ -1675,6 +1732,17 @@ export async function rebuildClientAssociationsFromClient(
             });
             return;
         }
+        if (isTransientError(err)) {
+            logger.warn(
+                `rebuildClientAssociations: transient DB error rebuilding client ${client.clientId} persisted after retries, queuing for deferred processing:`,
+                err
+            );
+            await rebuildQueue.enqueue({
+                type: "client",
+                id: client.clientId
+            });
+            return;
+        }
         throw err;
     } finally {
         await decrementOrgRebuildCount(client.orgId);
@@ -1826,12 +1894,15 @@ async function rebuildClientAssociationsFromClientImpl(
 
     // Insert new associations
     if (resourcesToAdd.length > 0) {
-        await trx.insert(clientSiteResourcesAssociationsCache).values(
+        await trx
+            .insert(clientSiteResourcesAssociationsCache)
+            .values(
                 resourcesToAdd.map((siteResourceId) => ({
                     clientId: client.clientId,
                     siteResourceId
                 }))
-        );
+            )
+            .onConflictDoNothing();
     }
 
     // Remove old associations
@@ -1869,12 +1940,15 @@ async function rebuildClientAssociationsFromClientImpl(
 
     // Insert new site associations
     if (sitesToAdd.length > 0) {
-        await trx.insert(clientSitesAssociationsCache).values(
+        await trx
+            .insert(clientSitesAssociationsCache)
+            .values(
                 sitesToAdd.map((siteId) => ({
                     clientId: client.clientId,
                     siteId
                 }))
-        );
+            )
+            .onConflictDoNothing();
     }
 
     // Remove old site associations

server/lib/rebuildQueue.ts

@@ -1,10 +1,14 @@
 import logger from "@server/logger";
+import { isTransientError } from "@server/lib/dbRetry";
 
 export type RebuildJobType = "site-resource" | "client";
 
 export interface RebuildJob {
     type: RebuildJobType;
     id: number;
+    // Number of times this job has already been re-queued after a transient
+    // failure. Absent/0 means it has not failed yet.
+    attempt?: number;
 }
 
 export interface RebuildJobHandlers {
@@ -24,6 +28,10 @@ export interface RebuildQueueManager {
 // retried shortly after against fresh DB state.
 const POLL_INTERVAL_MS = 500;
 const BATCH_SIZE = 5;
+// A job that fails with a transient DB error gets re-queued with backoff
+// instead of being dropped, up to this many times.
+const MAX_JOB_ATTEMPTS = 5;
+const JOB_RETRY_BASE_DELAY_MS = 1000;
 
 function dedupeKey(job: RebuildJob): string {
     return `${job.type}:${job.id}`;
@@ -106,12 +114,31 @@ class InMemoryRebuildQueue implements RebuildQueueManager {
                         `Rebuild queue: completed ${job.type}:${job.id}`
                     );
                 } catch (err) {
+                    const attempt = (job.attempt ?? 0) + 1;
+                    if (isTransientError(err) && attempt <= MAX_JOB_ATTEMPTS) {
+                        const delay =
+                            JOB_RETRY_BASE_DELAY_MS * Math.pow(2, attempt - 1);
+                        logger.warn(
+                            `Rebuild queue: job ${job.type}:${job.id} hit a transient error (attempt ${attempt}/${MAX_JOB_ATTEMPTS}), re-queuing in ${delay}ms:`,
+                            err
+                        );
+                        setTimeout(() => {
+                            this.enqueue({ ...job, attempt }).catch(
+                                (enqueueErr) =>
+                                    logger.error(
+                                        `Rebuild queue: failed to re-queue ${job.type}:${job.id} after transient error:`,
+                                        enqueueErr
+                                    )
+                            );
+                        }, delay);
+                    } else {
                         logger.error(
                             `Rebuild queue: job ${job.type}:${job.id} threw an error:`,
                             err
                         );
                     }
                 }
+            }
         } finally {
             this.processing = false;
         }

server/private/lib/orgRebuildCounter.ts

@@ -14,7 +14,7 @@
 import { redis } from "#private/lib/redis";
 import logger from "@server/logger";
 
-export const ORG_REBUILD_CONCURRENCY_LIMIT = 5;
+export const ORG_REBUILD_CONCURRENCY_LIMIT = 10;
 
 // Safety-net TTL: slightly longer than the rebuild lock TTL (120 s). If a
 // server process dies while holding a rebuild, this ensures the counter key

server/private/lib/rebuildQueue.ts

@@ -14,12 +14,16 @@
 import { redis } from "#private/lib/redis";
 import { lockManager } from "#private/lib/lock";
 import logger from "@server/logger";
+import { isTransientError } from "@server/lib/dbRetry";
 
 export type RebuildJobType = "site-resource" | "client";
 
 export interface RebuildJob {
     type: RebuildJobType;
     id: number;
+    // Number of times this job has already been re-queued after a transient
+    // failure. Absent/0 means it has not failed yet.
+    attempt?: number;
 }
 
 export interface RebuildJobHandlers {
@@ -43,6 +47,11 @@ const PROCESSOR_LOCK_TTL_MS = 120000 * BATCH_SIZE + 30000; // ~630 s
 
 const POLL_INTERVAL_MS = 500;
 
+// A job that fails with a transient DB error gets re-queued with backoff
+// instead of being dropped, up to this many times.
+const MAX_JOB_ATTEMPTS = 5;
+const JOB_RETRY_BASE_DELAY_MS = 1000;
+
 class RedisRebuildQueue {
     private processingStarted = false;
 
@@ -180,12 +189,35 @@ class RedisRebuildQueue {
                                 `Rebuild queue: completed ${job.type}:${job.id}`
                             );
                         } catch (err) {
+                            const attempt = (job.attempt ?? 0) + 1;
+                            if (
+                                isTransientError(err) &&
+                                attempt <= MAX_JOB_ATTEMPTS
+                            ) {
+                                const delay =
+                                    JOB_RETRY_BASE_DELAY_MS *
+                                    Math.pow(2, attempt - 1);
+                                logger.warn(
+                                    `Rebuild queue: job ${job.type}:${job.id} hit a transient error (attempt ${attempt}/${MAX_JOB_ATTEMPTS}), re-queuing in ${delay}ms:`,
+                                    err
+                                );
+                                setTimeout(() => {
+                                    this.enqueue({ ...job, attempt }).catch(
+                                        (enqueueErr) =>
+                                            logger.error(
+                                                `Rebuild queue: failed to re-queue ${job.type}:${job.id} after transient error:`,
+                                                enqueueErr
+                                            )
+                                    );
+                                }, delay);
+                            } else {
                                 logger.error(
                                     `Rebuild queue: job ${job.type}:${job.id} threw an error:`,
                                     err
                                 );
                             }
                         }
+                    }
                 },
                 PROCESSOR_LOCK_TTL_MS
             );

server/private/lib/redis.ts

@@ -894,6 +894,19 @@ class RegionalRedisManager {
         return opts;
     }
 
+    // The regional Redis StatefulSet's "redis" service pins to pod redis-0
+    // (primary). The replica (redis-1) is only reachable through the
+    // per-pod headless service: <svc>.<namespace>.svc.cluster.local ->
+    // redis-1.redis-headless.<namespace>.svc.cluster.local. Returns null
+    // if the configured host doesn't match that pattern (e.g. local dev),
+    // in which case callers should fall back to the primary for reads.
+    private getReplicaHost(primaryHost: string): string | null {
+        const match = primaryHost.match(/^redis\.([^.]+)\.svc\.cluster\.local$/);
+        if (!match) return null;
+        const namespace = match[1];
+        return `redis-1.redis-headless.${namespace}.svc.cluster.local`;
+    }
+
     private initializeClients(): void {
         const cfg = this.getConfig();
         const baseOpts = {
@@ -907,35 +920,42 @@ class RegionalRedisManager {
 
         try {
             this.writeClient = new Redis(baseOpts);
-            // redis-1 (replica) handles reads; fall back to primary if not resolvable
-            this.readClient = new Redis({
-                ...baseOpts,
-                host: cfg.host!.replace(/^(.*?)(\.\S+)$/, (_, h, rest) => {
-                    // Derive replica hostname from the headless service pattern:
-                    // redis.redis.svc.cluster.local -> redis-1.redis-headless.redis.svc.cluster.local
-                    // If it doesn't look like a k8s service, just use the same host
-                    return h + rest;
-                })
-            });
 
-            // For simplicity use same host for both; callers can always read from primary
-            // The real replica routing is handled by the StatefulSet headless service
-            this.readClient = this.writeClient;
+            const replicaHost = this.getReplicaHost(cfg.host!);
+            this.readClient = replicaHost
+                ? new Redis({ ...baseOpts, host: replicaHost })
+                : this.writeClient;
 
             this.writeClient.on("ready", () => {
-                logger.info("Regional Redis client ready");
+                logger.info("Regional Redis write client ready");
                 this.isHealthy = true;
             });
             this.writeClient.on("error", (err) => {
-                logger.error("Regional Redis client error:", err);
+                logger.error("Regional Redis write client error:", err);
                 this.isHealthy = false;
             });
             this.writeClient.on("reconnecting", () => {
-                logger.info("Regional Redis client reconnecting...");
+                logger.info("Regional Redis write client reconnecting...");
                 this.isHealthy = false;
             });
 
-            logger.info("Regional Redis client initialized");
+            if (this.readClient !== this.writeClient) {
+                this.readClient.on("ready", () => {
+                    logger.info("Regional Redis read client ready");
+                });
+                this.readClient.on("error", (err) => {
+                    logger.error("Regional Redis read client error:", err);
+                });
+                this.readClient.on("reconnecting", () => {
+                    logger.info("Regional Redis read client reconnecting...");
+                });
+            }
+
+            logger.info(
+                replicaHost
+                    ? `Regional Redis client initialized (reads routed to replica ${replicaHost})`
+                    : "Regional Redis client initialized (no replica resolvable, reads routed to primary)"
+            );
         } catch (error) {
             logger.error("Failed to initialize regional Redis client:", error);
             this.isEnabled = false;
@@ -1041,11 +1061,14 @@ class RegionalRedisManager {
 
     public async disconnect(): Promise<void> {
         try {
+            if (this.readClient && this.readClient !== this.writeClient) {
+                await this.readClient.quit();
+            }
+            this.readClient = null;
             if (this.writeClient) {
                 await this.writeClient.quit();
                 this.writeClient = null;
             }
-            this.readClient = null;
             logger.info("Regional Redis client disconnected");
         } catch (error) {
             logger.error("Error disconnecting regional Redis client:", error);

server/private/middlewares/verifySubscription.ts

@@ -17,6 +17,7 @@ import HttpCode from "@server/types/HttpCode";
 import { build } from "@server/build";
 import { getOrgTierData } from "#private/lib/billing";
 import { Tier } from "@server/types/Tiers";
+import logger from "@server/logger";
 
 export function verifyValidSubscription(tiers: Tier[]) {
     return async function (
@@ -30,9 +31,9 @@ export function verifyValidSubscription(tiers: Tier[]) {
             }
 
             const orgId =
-                req.params.orgId ||
-                req.body.orgId ||
-                req.query.orgId ||
+                req.params?.orgId ||
+                req.body?.orgId ||
+                req.query?.orgId ||
                 req.userOrgId;
 
             if (!orgId) {
@@ -65,6 +66,7 @@ export function verifyValidSubscription(tiers: Tier[]) {
 
             return next();
         } catch (e) {
+            logger.error(e);
             return next(
                 createHttpError(
                     HttpCode.INTERNAL_SERVER_ERROR,

server/private/routers/billing/getOrgUsage.ts

@@ -104,6 +104,18 @@ export async function getOrgUsage(
             orgId,
             LimitId.ORGANIZATIONS
         );
+        const publicResources = await usageService.getUsage(
+            orgId,
+            LimitId.PUBLIC_RESOURCES
+        );
+        const privateResources = await usageService.getUsage(
+            orgId,
+            LimitId.PRIVATE_RESOURCES
+        );
+        const machineClients = await usageService.getUsage(
+            orgId,
+            LimitId.MACHINE_CLIENTS
+        );
         // const egressData = await usageService.getUsage(
         //     orgId,
         //     FeatureId.EGRESS_DATA_MB
@@ -127,6 +139,15 @@ export async function getOrgUsage(
         if (organizations) {
             usageData.push(organizations);
         }
+        if (publicResources) {
+            usageData.push(publicResources);
+        }
+        if (privateResources) {
+            usageData.push(privateResources);
+        }
+        if (machineClients) {
+            usageData.push(machineClients);
+        }
 
         const orgLimits = await db
             .select()

server/private/routers/gerbil/createExitNode.ts

@@ -29,7 +29,8 @@ export async function createExitNode(
         .where(eq(exitNodes.publicKey, publicKey));
     let exitNode: ExitNode;
     if (!exitNodeQuery) {
-        const address = await getNextAvailableSubnet();
+        const { value: address, release } = await getNextAvailableSubnet();
+        try {
             // TODO: eventually we will want to get the next available port so that we can multiple exit nodes
             // const listenPort = await getNextAvailablePort();
             const listenPort = config.getRawConfig().gerbil.start_port;
@@ -60,6 +61,9 @@ export async function createExitNode(
             logger.info(
                 `Created new exit node ${exitNode.name} with address ${exitNode.address} and port ${exitNode.listenPort}`
             );
+        } finally {
+            await release();
+        }
     } else {
         // update the reachable at
         [exitNode] = await db

server/private/routers/remoteExitNode/createRemoteExitNode.ts

@@ -114,8 +114,6 @@ export async function createRemoteExitNode(
         }
 
         const secretHash = await hashPassword(secret);
-        // const address = await getNextAvailableSubnet();
-        const address = "100.89.140.1/24"; // FOR NOW LETS HARDCODE THESE ADDRESSES
 
         const [existingRemoteExitNode] = await db
             .select()
@@ -191,13 +189,27 @@ export async function createRemoteExitNode(
             );
         }
 
+        // If this remote exit node isn't already backing an exit node in
+        // another org, we're about to create a brand new one. Reserve a
+        // subnet for it up front so the allocation lock is held across the
+        // whole insert - this guarantees exit node subnets never overlap,
+        // even under concurrent creation, which matters for HA setups.
+        let releaseSubnetLock: (() => Promise<void>) | null = null;
+        let newExitNodeAddress: string | null = null;
+        if (!existingExitNode) {
+            const { value, release } = await getNextAvailableSubnet();
+            newExitNodeAddress = value;
+            releaseSubnetLock = release;
+        }
+
+        try {
             await db.transaction(async (trx) => {
                 if (!existingExitNode) {
                     const [res] = await trx
                         .insert(exitNodes)
                         .values({
                             name: remoteExitNodeId,
-                        address,
+                            address: newExitNodeAddress!,
                             endpoint: "",
                             publicKey: "",
                             listenPort: 0,
@@ -274,6 +286,9 @@ export async function createRemoteExitNode(
                     }
                 }
             });
+        } finally {
+            await releaseSubnetLock?.();
+        }
 
         const token = generateSessionToken();
         await createRemoteExitNodeSession(token, remoteExitNodeId);

server/routers/blueprints/applyJSONBlueprint.ts

@@ -99,7 +99,7 @@ export async function applyJSONBlueprint(
                 source: "API"
             });
         } catch (error) {
-            logger.error(`Failed to update database from config: ${error}`);
+            logger.debug(`Failed to update database from config: ${error}`);
             return next(
                 createHttpError(
                     HttpCode.BAD_REQUEST,

server/routers/external.ts

@@ -327,6 +327,14 @@ authenticated.get(
     siteResource.listAllSiteResourcesByOrg
 );
 
+authenticated.get(
+    "/org/:orgId/site-resource/:siteResourceId",
+    verifyOrgAccess,
+    verifySiteResourceAccess,
+    verifyUserHasAction(ActionsEnum.getSiteResource),
+    siteResource.getSiteResource
+);
+
 authenticated.get(
     "/site-resource/:siteResourceId",
     verifySiteResourceAccess,
@@ -470,6 +478,12 @@ authenticated.get(
     launcher.listLauncherGroups
 );
 
+authenticated.get(
+    "/org/:orgId/launcher/scale",
+    verifyOrgAccess,
+    launcher.listLauncherScale
+);
+
 authenticated.get(
     "/org/:orgId/launcher/resources",
     verifyOrgAccess,
@@ -494,6 +508,12 @@ authenticated.get(
     launcher.listLauncherViews
 );
 
+authenticated.post(
+    "/org/:orgId/launcher/invalidate-cache",
+    verifyOrgAccess,
+    launcher.invalidateLauncherCache
+);
+
 authenticated.post(
     "/org/:orgId/launcher/views",
     verifyOrgAccess,
@@ -506,6 +526,18 @@ authenticated.put(
     launcher.updateLauncherView
 );
 
+authenticated.put(
+    "/org/:orgId/launcher/default-view",
+    verifyOrgAccess,
+    launcher.upsertLauncherDefaultView
+);
+
+authenticated.delete(
+    "/org/:orgId/launcher/default-view",
+    verifyOrgAccess,
+    launcher.deleteLauncherDefaultView
+);
+
 authenticated.delete(
     "/org/:orgId/launcher/views/:viewId",
     verifyOrgAccess,

server/routers/gerbil/createExitNode.ts

@@ -13,7 +13,8 @@ export async function createExitNode(
     const [exitNodeQuery] = await db.select().from(exitNodes).limit(1);
     let exitNode: ExitNode;
     if (!exitNodeQuery) {
-        const address = await getNextAvailableSubnet();
+        const { value: address, release } = await getNextAvailableSubnet();
+        try {
             // TODO: eventually we will want to get the next available port so that we can multiple exit nodes
             // const listenPort = await getNextAvailablePort();
             const listenPort = config.getRawConfig().gerbil.start_port;
@@ -44,6 +45,9 @@ export async function createExitNode(
             logger.info(
                 `Created new exit node ${exitNode.name} with address ${exitNode.address} and port ${exitNode.listenPort}`
             );
+        } finally {
+            await release();
+        }
     } else {
         // update the existing exit node
         [exitNode] = await db

server/routers/launcher/createLauncherView.ts

@@ -79,7 +79,8 @@ export async function createLauncherView(
                 ),
                 createdAt: created.createdAt,
                 updatedAt: created.updatedAt,
-                isOrgWide: created.userId == null
+                isOrgWide: created.userId == null,
+                isDefault: created.isDefault
             },
             success: true,
             error: false,

server/routers/launcher/deleteLauncherDefaultView.ts

@@ -0,0 +1,104 @@
+import { response } from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { fromZodError } from "zod-validation-error";
+import { z } from "zod";
+import { ActionsEnum, checkUserActionPermission } from "@server/auth/actions";
+import {
+    deleteAllDefaultViewOverrides,
+    deleteDefaultViewOverride
+} from "./launcherDefaultView";
+
+const deleteLauncherDefaultViewBodySchema = z.strictObject({
+    orgWide: z.boolean().optional().default(false),
+    all: z.boolean().optional().default(false)
+});
+
+export async function deleteLauncherDefaultView(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const orgId = req.userOrgId;
+        const userId = req.user!.userId;
+
+        if (!orgId) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
+            );
+        }
+
+        const parsed = deleteLauncherDefaultViewBodySchema.safeParse(req.body);
+        if (!parsed.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromZodError(parsed.error)
+                )
+            );
+        }
+
+        if (parsed.data.all) {
+            const canManageOrgWide = await checkUserActionPermission(
+                ActionsEnum.createOrgWideLauncherView,
+                req
+            );
+            if (!canManageOrgWide) {
+                return next(
+                    createHttpError(
+                        HttpCode.FORBIDDEN,
+                        "User does not have permission perform this action"
+                    )
+                );
+            }
+
+            await deleteAllDefaultViewOverrides(orgId, userId);
+        } else if (parsed.data.orgWide) {
+            const canManageOrgWide = await checkUserActionPermission(
+                ActionsEnum.createOrgWideLauncherView,
+                req
+            );
+            if (!canManageOrgWide) {
+                return next(
+                    createHttpError(
+                        HttpCode.FORBIDDEN,
+                        "User does not have permission perform this action"
+                    )
+                );
+            }
+
+            await deleteDefaultViewOverride({
+                orgId,
+                userId,
+                orgWide: true
+            });
+        } else {
+            await deleteDefaultViewOverride({
+                orgId,
+                userId,
+                orgWide: false
+            });
+        }
+
+        return response(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "Launcher default view reset successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        if (createHttpError.isHttpError(error)) {
+            return next(error);
+        }
+        console.error("Error resetting launcher default view:", error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Internal server error"
+            )
+        );
+    }
+}

server/routers/launcher/deleteLauncherView.ts

@@ -46,6 +46,15 @@ export async function deleteLauncherView(
             );
         }
 
+        if (existing.isDefault) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "The default view cannot be deleted from here"
+                )
+            );
+        }
+
         const isPersonalView = existing.userId === userId;
         const isOrgWideView = existing.userId == null;
         const canManageOrgWide = await checkUserActionPermission(

server/routers/launcher/index.ts

@@ -1,5 +1,6 @@
 export * from "./types";
 export { listLauncherGroups } from "./listLauncherGroups";
+export { listLauncherScale } from "./listLauncherScale";
 export { listLauncherResources } from "./listLauncherResources";
 export { listLauncherSites } from "./listLauncherSites";
 export { listLauncherLabels } from "./listLauncherLabels";
@@ -7,3 +8,6 @@ export { listLauncherViews } from "./listLauncherViews";
 export { createLauncherView } from "./createLauncherView";
 export { updateLauncherView } from "./updateLauncherView";
 export { deleteLauncherView } from "./deleteLauncherView";
+export { upsertLauncherDefaultView } from "./upsertLauncherDefaultView";
+export { deleteLauncherDefaultView } from "./deleteLauncherDefaultView";
+export { invalidateLauncherCache } from "./invalidateLauncherCache";

server/routers/launcher/invalidateLauncherCache.ts

@@ -0,0 +1,65 @@
+import { regionalCache as cache } from "#dynamic/lib/cache";
+import { response } from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+
+async function invalidateLauncherCacheForUser(
+    orgId: string,
+    userId: string
+): Promise<void> {
+    const prefixes = [
+        `launcherAccessibleIds:${orgId}:${userId}:`,
+        `launcher:groups:${orgId}:${userId}:`,
+        `launcher:results:${orgId}:${userId}:`,
+        `launcher:scale:counts:${orgId}:${userId}:`
+    ];
+
+    const keys = (
+        await Promise.all(
+            prefixes.map((prefix) => cache.keysWithPrefix(prefix))
+        )
+    ).flat();
+
+    if (keys.length > 0) {
+        await cache.del(keys);
+    }
+}
+
+export async function invalidateLauncherCache(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const orgId = req.userOrgId;
+        const userId = req.user!.userId;
+
+        if (!orgId) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
+            );
+        }
+
+        await invalidateLauncherCacheForUser(orgId, userId);
+
+        return response(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "Launcher cache invalidated successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        if (createHttpError.isHttpError(error)) {
+            return next(error);
+        }
+        console.error("Error invalidating launcher cache:", error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Internal server error"
+            )
+        );
+    }
+}

server/routers/launcher/launcherDefaultView.ts

@@ -0,0 +1,137 @@
+import { db, launcherViews } from "@server/db";
+import { and, eq, isNull } from "drizzle-orm";
+import moment from "moment";
+import {
+    launcherViewConfigSchema,
+    type LauncherDefaultViewOverrides,
+    type LauncherViewConfig,
+    type LauncherViewRecord
+} from "./types";
+
+export function mapViewRow(
+    row: typeof launcherViews.$inferSelect
+): LauncherViewRecord {
+    return {
+        viewId: row.viewId,
+        orgId: row.orgId,
+        userId: row.userId,
+        name: row.name,
+        config: launcherViewConfigSchema.parse(JSON.parse(row.config)),
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt,
+        isOrgWide: row.userId == null,
+        isDefault: row.isDefault
+    };
+}
+
+export function extractDefaultViewOverrides(
+    rows: Array<typeof launcherViews.$inferSelect>
+): LauncherDefaultViewOverrides {
+    const overrideRows = rows.filter((row) => row.isDefault);
+
+    const personalRow = overrideRows.find((row) => row.userId !== null);
+    const orgWideRow = overrideRows.find((row) => row.userId === null);
+
+    return {
+        personal: personalRow ? mapViewRow(personalRow) : null,
+        orgWide: orgWideRow ? mapViewRow(orgWideRow) : null
+    };
+}
+
+export function listVisibleLauncherViews(
+    rows: Array<typeof launcherViews.$inferSelect>
+): LauncherViewRecord[] {
+    return rows.filter((row) => !row.isDefault).map(mapViewRow);
+}
+
+export async function findDefaultViewOverride(
+    orgId: string,
+    orgWide: boolean,
+    userId: string
+) {
+    const [existing] = await db
+        .select()
+        .from(launcherViews)
+        .where(
+            and(
+                eq(launcherViews.orgId, orgId),
+                eq(launcherViews.isDefault, true),
+                orgWide
+                    ? isNull(launcherViews.userId)
+                    : eq(launcherViews.userId, userId)
+            )
+        )
+        .limit(1);
+
+    return existing ?? null;
+}
+
+export async function upsertDefaultViewOverride({
+    orgId,
+    userId,
+    orgWide,
+    config
+}: {
+    orgId: string;
+    userId: string;
+    orgWide: boolean;
+    config: LauncherViewConfig;
+}) {
+    const now = moment().toISOString();
+    const existing = await findDefaultViewOverride(orgId, orgWide, userId);
+
+    if (existing) {
+        const [updated] = await db
+            .update(launcherViews)
+            .set({
+                config: JSON.stringify(config),
+                updatedAt: now
+            })
+            .where(eq(launcherViews.viewId, existing.viewId))
+            .returning();
+
+        return mapViewRow(updated);
+    }
+
+    const [created] = await db
+        .insert(launcherViews)
+        .values({
+            orgId,
+            userId: orgWide ? null : userId,
+            name: "",
+            isDefault: true,
+            config: JSON.stringify(config),
+            createdAt: now,
+            updatedAt: now
+        })
+        .returning();
+
+    return mapViewRow(created);
+}
+
+export async function deleteDefaultViewOverride({
+    orgId,
+    userId,
+    orgWide
+}: {
+    orgId: string;
+    userId: string;
+    orgWide: boolean;
+}) {
+    const existing = await findDefaultViewOverride(orgId, orgWide, userId);
+    if (!existing) {
+        return;
+    }
+
+    await db
+        .delete(launcherViews)
+        .where(eq(launcherViews.viewId, existing.viewId));
+}
+
+export async function deleteAllDefaultViewOverrides(
+    orgId: string,
+    userId: string
+) {
+    await deleteDefaultViewOverride({ orgId, userId, orgWide: false });
+    await deleteDefaultViewOverride({ orgId, userId, orgWide: true });
+}

server/routers/launcher/launcherResourceAccess.ts

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { db } from "@server/db";
 import {
     exitNodes,
@@ -31,13 +32,15 @@ import {
     isNull,
     like,
     or,
-    sql
+    sql,
+    type SQL
 } from "drizzle-orm";
 import {
     formatPublicResourceAccess,
     formatSiteResourceAccess
 } from "./formatLauncherAccess";
 import {
+    LAUNCHER_FLAT_GROUP_KEY,
     LAUNCHER_NO_SITE_GROUP_KEY,
     LAUNCHER_UNLABELED_GROUP_KEY,
     type LauncherFilterListQuery,
@@ -59,6 +62,68 @@ export type AccessibleIds = {
 };
 
 const LAUNCHER_ACCESSIBLE_IDS_TTL_SEC = 60;
+const LAUNCHER_RESOURCES_RESULT_TTL_SEC = 60;
+const LAUNCHER_GROUPS_RESULT_TTL_SEC = 60;
+
+type LauncherResourcesCacheEntry = {
+    items: LauncherResource[];
+    total: number;
+};
+
+type LauncherGroupsCacheEntry = {
+    groups: LauncherGroup[];
+    total: number;
+};
+
+function launcherListQueryHash(
+    userRoleIds: number[],
+    query: LauncherListQuery,
+    extra?: Record<string, string>
+) {
+    const payload = JSON.stringify({
+        roles: [...userRoleIds].sort((a, b) => a - b),
+        query: query.query,
+        groupBy: query.groupBy,
+        siteIds: query.siteIds ?? "",
+        labelIds: query.labelIds ?? "",
+        sort_by: query.sort_by,
+        order: query.order,
+        ...extra
+    });
+    return createHash("sha256").update(payload).digest("hex").slice(0, 16);
+}
+
+function launcherResourcesQueryHash(
+    userRoleIds: number[],
+    query: LauncherListQuery & { groupKey: string }
+) {
+    return launcherListQueryHash(userRoleIds, query, {
+        groupKey: query.groupKey
+    });
+}
+
+function launcherGroupsQueryHash(
+    userRoleIds: number[],
+    query: LauncherListQuery
+) {
+    return launcherListQueryHash(userRoleIds, query);
+}
+
+function launcherResourcesCacheKey(
+    orgId: string,
+    userId: string,
+    queryHash: string
+) {
+    return `launcher:results:${orgId}:${userId}:${queryHash}`;
+}
+
+function launcherGroupsCacheKey(
+    orgId: string,
+    userId: string,
+    queryHash: string
+) {
+    return `launcher:groups:${orgId}:${userId}:${queryHash}`;
+}
 
 function launcherAccessibleIdsCacheKey(
     orgId: string,
@@ -194,6 +259,21 @@ function searchPattern(query: string) {
     return `%${query.trim()}%`;
 }
 
+function combineOrConditions(
+    ...conditions: (SQL | undefined)[]
+): SQL | undefined {
+    const parts = conditions.filter(
+        (condition): condition is SQL => !!condition
+    );
+    if (parts.length === 0) {
+        return undefined;
+    }
+    if (parts.length === 1) {
+        return parts[0];
+    }
+    return or(...parts);
+}
+
 function buildSearchConditionForPublic(
     query: string,
     labelsFeatureEnabled: boolean
@@ -205,7 +285,17 @@ function buildSearchConditionForPublic(
     const queryList = [
         like(sql`LOWER(${resources.name})`, pattern),
         like(sql`LOWER(${resources.fullDomain})`, pattern),
-        like(sql`LOWER(cast(${resources.proxyPort} as text))`, pattern)
+        like(sql`LOWER(cast(${resources.proxyPort} as text))`, pattern),
+        inArray(
+            resources.resourceId,
+            db
+                .select({ id: resources.resourceId })
+                .from(resources)
+                .leftJoin(targets, eq(targets.resourceId, resources.resourceId))
+                .leftJoin(sites, eq(targets.siteId, sites.siteId))
+                .leftJoin(exitNodes, eq(sites.exitNodeId, exitNodes.exitNodeId))
+                .where(like(sql`LOWER(${exitNodes.endpoint})`, pattern))
+        )
     ];
 
     if (labelsFeatureEnabled) {
@@ -238,6 +328,11 @@ function buildSearchConditionForSiteResource(
     const queryList = [
         like(sql`LOWER(${siteResources.name})`, pattern),
         like(sql`LOWER(${siteResources.destination})`, pattern),
+        like(
+            sql`LOWER(cast(${siteResources.destinationPort} as text))`,
+            pattern
+        ),
+        like(sql`LOWER(${siteResources.scheme})`, pattern),
         like(sql`LOWER(${siteResources.alias})`, pattern),
         like(sql`LOWER(${siteResources.fullDomain})`, pattern),
         like(sql`LOWER(${siteResources.aliasAddress})`, pattern)
@@ -262,6 +357,79 @@ function buildSearchConditionForSiteResource(
     return or(...queryList);
 }
 
+async function filterPublicResourceIdsByTextSearch(
+    orgId: string,
+    resourceIds: number[],
+    query: string,
+    labelsFeatureEnabled: boolean
+): Promise<number[]> {
+    if (!query.trim() || resourceIds.length === 0) {
+        return resourceIds;
+    }
+
+    const textMatch = combineOrConditions(
+        buildSearchConditionForPublic(query, labelsFeatureEnabled),
+        buildSiteNameSearchCondition(query)
+    );
+    if (!textMatch) {
+        return resourceIds;
+    }
+
+    const rows = await db
+        .selectDistinct({ resourceId: resources.resourceId })
+        .from(resources)
+        .leftJoin(targets, eq(targets.resourceId, resources.resourceId))
+        .leftJoin(sites, eq(targets.siteId, sites.siteId))
+        .where(
+            and(
+                inArray(resources.resourceId, resourceIds),
+                eq(resources.orgId, orgId),
+                eq(resources.enabled, true),
+                textMatch
+            )
+        );
+
+    return rows.map((row) => row.resourceId);
+}
+
+async function filterSiteResourceIdsByTextSearch(
+    orgId: string,
+    siteResourceIds: number[],
+    query: string,
+    labelsFeatureEnabled: boolean
+): Promise<number[]> {
+    if (!query.trim() || siteResourceIds.length === 0) {
+        return siteResourceIds;
+    }
+
+    const textMatch = combineOrConditions(
+        buildSearchConditionForSiteResource(query, labelsFeatureEnabled),
+        buildSiteNameSearchCondition(query)
+    );
+    if (!textMatch) {
+        return siteResourceIds;
+    }
+
+    const rows = await db
+        .selectDistinct({ siteResourceId: siteResources.siteResourceId })
+        .from(siteResources)
+        .leftJoin(
+            siteNetworks,
+            eq(siteResources.networkId, siteNetworks.networkId)
+        )
+        .leftJoin(sites, eq(siteNetworks.siteId, sites.siteId))
+        .where(
+            and(
+                inArray(siteResources.siteResourceId, siteResourceIds),
+                eq(siteResources.orgId, orgId),
+                eq(siteResources.enabled, true),
+                textMatch
+            )
+        );
+
+    return rows.map((row) => row.siteResourceId);
+}
+
 async function labelsEnabled(orgId: string): Promise<boolean> {
     return isLicensedOrSubscribed(orgId, tierMatrix.labels);
 }
@@ -588,9 +756,8 @@ async function listSiteGroups(
     });
 
     const total = groups.length;
-    const offset = (query.page - 1) * query.pageSize;
     return {
-        groups: groups.slice(offset, offset + query.pageSize),
+        groups,
         total
     };
 }
@@ -788,26 +955,53 @@ async function listLabelGroups(
     });
 
     const total = groups.length;
-    const offset = (query.page - 1) * query.pageSize;
     return {
-        groups: groups.slice(offset, offset + query.pageSize),
+        groups,
         total
     };
 }
 
+async function listLauncherGroupsForUserUncached(
+    orgId: string,
+    userId: string,
+    userRoleIds: number[],
+    query: LauncherListQuery
+): Promise<LauncherGroupsCacheEntry> {
+    const accessible = await resolveAccessibleIds(orgId, userId, userRoleIds);
+
+    if (query.groupBy === "label") {
+        return listLabelGroups(orgId, accessible, query);
+    }
+
+    return listSiteGroups(orgId, accessible, query);
+}
+
 export async function listLauncherGroupsForUser(
     orgId: string,
     userId: string,
     userRoleIds: number[],
     query: LauncherListQuery
 ): Promise<{ groups: LauncherGroup[]; total: number }> {
-    const accessible = await resolveAccessibleIds(orgId, userId, userRoleIds);
+    const queryHash = launcherGroupsQueryHash(userRoleIds, query);
+    const cacheKey = launcherGroupsCacheKey(orgId, userId, queryHash);
+    const cached = await cache.get<LauncherGroupsCacheEntry>(cacheKey);
 
-    if (query.groupBy === "label") {
-        return listLabelGroups(orgId, accessible, query);
+    let result = cached;
+    if (!result) {
+        result = await listLauncherGroupsForUserUncached(
+            orgId,
+            userId,
+            userRoleIds,
+            query
+        );
+        await cache.set(cacheKey, result, LAUNCHER_GROUPS_RESULT_TTL_SEC);
     }
 
-    return listSiteGroups(orgId, accessible, query);
+    const offset = (query.page - 1) * query.pageSize;
+    return {
+        groups: result.groups.slice(offset, offset + query.pageSize),
+        total: result.total
+    };
 }
 
 async function mapPublicResources(
@@ -1018,26 +1212,6 @@ function filterResourcesByLabel(
     );
 }
 
-function filterResourcesBySearch(
-    items: LauncherResource[],
-    query: string
-): LauncherResource[] {
-    if (!query.trim()) {
-        return items;
-    }
-    const pattern = query.trim().toLowerCase();
-    return items.filter(
-        (item) =>
-            item.name.toLowerCase().includes(pattern) ||
-            item.accessDisplay.toLowerCase().includes(pattern) ||
-            item.accessCopyValue.toLowerCase().includes(pattern) ||
-            item.labels.some((label) =>
-                label.name.toLowerCase().includes(pattern)
-            ) ||
-            item.site?.name.toLowerCase().includes(pattern)
-    );
-}
-
 function sortLauncherResources(
     items: LauncherResource[],
     order: "asc" | "desc"
@@ -1050,12 +1224,12 @@ function sortLauncherResources(
     });
 }
 
-export async function listLauncherResourcesForUser(
+async function listLauncherResourcesForUserUncached(
     orgId: string,
     userId: string,
     userRoleIds: number[],
     query: LauncherListQuery & { groupKey: string }
-): Promise<{ resources: LauncherResource[]; total: number }> {
+): Promise<LauncherResourcesCacheEntry> {
     const accessible = await resolveAccessibleIds(orgId, userId, userRoleIds);
 
     const siteFilterIds = parseIdListParam(query.siteIds);
@@ -1128,6 +1302,27 @@ export async function listLauncherResourcesForUser(
         }
     }
 
+    const labelsFeatureEnabled = await labelsEnabled(orgId);
+
+    if (query.query.trim()) {
+        if (filteredResourceIds.length > 0) {
+            filteredResourceIds = await filterPublicResourceIdsByTextSearch(
+                orgId,
+                filteredResourceIds,
+                query.query,
+                labelsFeatureEnabled
+            );
+        }
+        if (filteredSiteResourceIds.length > 0) {
+            filteredSiteResourceIds = await filterSiteResourceIdsByTextSearch(
+                orgId,
+                filteredSiteResourceIds,
+                query.query,
+                labelsFeatureEnabled
+            );
+        }
+    }
+
     const labelMaps = await fetchLabelsForResources(
         orgId,
         filteredResourceIds,
@@ -1159,21 +1354,48 @@ export async function listLauncherResourcesForUser(
     ]);
 
     let items = [...publicItems, ...siteItems];
-    items = filterResourcesBySearch(items, query.query);
 
+    if (query.groupKey !== LAUNCHER_FLAT_GROUP_KEY) {
         if (query.groupBy === "label") {
             items = filterResourcesByLabel(items, query.groupKey);
         } else if (query.groupBy === "site") {
             items = filterResourcesBySite(items, query.groupKey);
         }
+    }
 
     items = sortLauncherResources(items, query.order);
 
-    const total = items.length;
+    return {
+        items,
+        total: items.length
+    };
+}
+
+export async function listLauncherResourcesForUser(
+    orgId: string,
+    userId: string,
+    userRoleIds: number[],
+    query: LauncherListQuery & { groupKey: string }
+): Promise<{ resources: LauncherResource[]; total: number }> {
+    const queryHash = launcherResourcesQueryHash(userRoleIds, query);
+    const cacheKey = launcherResourcesCacheKey(orgId, userId, queryHash);
+    const cached = await cache.get<LauncherResourcesCacheEntry>(cacheKey);
+
+    let result = cached;
+    if (!result) {
+        result = await listLauncherResourcesForUserUncached(
+            orgId,
+            userId,
+            userRoleIds,
+            query
+        );
+        await cache.set(cacheKey, result, LAUNCHER_RESOURCES_RESULT_TTL_SEC);
+    }
+
     const offset = (query.page - 1) * query.pageSize;
     return {
-        resources: items.slice(offset, offset + query.pageSize),
-        total
+        resources: result.items.slice(offset, offset + query.pageSize),
+        total: result.total
     };
 }
 

server/routers/launcher/launcherScale.ts

@@ -0,0 +1,133 @@
+import { regionalCache as cache } from "#dynamic/lib/cache";
+import {
+    listLauncherGroupsForUser,
+    resolveAccessibleIds
+} from "./launcherResourceAccess";
+import {
+    parseIdListParam,
+    type LauncherScaleInfo,
+    type LauncherScaleQuery
+} from "./types";
+
+export const LAUNCHER_FULL_MAX_RESOURCES = 2000;
+export const LAUNCHER_FULL_MAX_SITE_GROUPS = 200;
+export const LAUNCHER_FULL_MAX_LABEL_GROUPS = 100;
+export const LAUNCHER_FILTERED_SITE_GROUPING_MAX = 20;
+
+const LAUNCHER_SCALE_COUNTS_TTL_SEC = 60;
+
+type LauncherScaleCountsCacheEntry = {
+    resourceCount: number;
+    siteGroupCount: number;
+    labelGroupCount: number;
+    mode: LauncherScaleInfo["mode"];
+};
+
+function launcherScaleCountsCacheKey(
+    orgId: string,
+    userId: string,
+    roleIds: number[]
+) {
+    const rolesKey = [...roleIds].sort((a, b) => a - b).join(",");
+    return `launcher:scale:counts:${orgId}:${userId}:${rolesKey}`;
+}
+
+function buildScaleCapabilities(
+    counts: LauncherScaleCountsCacheEntry,
+    query: LauncherScaleQuery
+): LauncherScaleInfo["capabilities"] {
+    const siteFilterIds = parseIdListParam(query.siteIds);
+    const labelFilterIds = parseIdListParam(query.labelIds);
+
+    return {
+        allowSiteGrouping:
+            counts.siteGroupCount <= LAUNCHER_FULL_MAX_SITE_GROUPS ||
+            (siteFilterIds.length > 0 &&
+                siteFilterIds.length <= LAUNCHER_FILTERED_SITE_GROUPING_MAX),
+        allowLabelGrouping:
+            counts.labelGroupCount <= LAUNCHER_FULL_MAX_LABEL_GROUPS ||
+            (labelFilterIds.length > 0 &&
+                labelFilterIds.length <= LAUNCHER_FILTERED_SITE_GROUPING_MAX),
+        requireSearchOrFilter:
+            counts.mode === "compact" &&
+            counts.resourceCount > LAUNCHER_FULL_MAX_RESOURCES
+    };
+}
+
+async function getLauncherScaleCountsForUser(
+    orgId: string,
+    userId: string,
+    userRoleIds: number[]
+): Promise<LauncherScaleCountsCacheEntry> {
+    const cacheKey = launcherScaleCountsCacheKey(orgId, userId, userRoleIds);
+    const cached = await cache.get<LauncherScaleCountsCacheEntry>(cacheKey);
+    if (cached) {
+        return cached;
+    }
+
+    const accessible = await resolveAccessibleIds(orgId, userId, userRoleIds);
+    const resourceCount =
+        accessible.resourceIds.length + accessible.siteResourceIds.length;
+
+    const baselineQuery = {
+        query: "",
+        groupBy: "site" as const,
+        siteIds: undefined,
+        labelIds: undefined,
+        sort_by: "name" as const,
+        order: "asc" as const,
+        page: 1,
+        pageSize: 1
+    };
+
+    const [{ total: siteGroupCount }, { total: labelGroupCount }] =
+        await Promise.all([
+            listLauncherGroupsForUser(
+                orgId,
+                userId,
+                userRoleIds,
+                baselineQuery
+            ),
+            listLauncherGroupsForUser(orgId, userId, userRoleIds, {
+                ...baselineQuery,
+                groupBy: "label"
+            })
+        ]);
+
+    const mode =
+        resourceCount <= LAUNCHER_FULL_MAX_RESOURCES &&
+        siteGroupCount <= LAUNCHER_FULL_MAX_SITE_GROUPS
+            ? "full"
+            : "compact";
+
+    const result: LauncherScaleCountsCacheEntry = {
+        resourceCount,
+        siteGroupCount,
+        labelGroupCount,
+        mode
+    };
+
+    await cache.set(cacheKey, result, LAUNCHER_SCALE_COUNTS_TTL_SEC);
+    return result;
+}
+
+export async function getLauncherScaleForUser(
+    orgId: string,
+    userId: string,
+    userRoleIds: number[],
+    query: LauncherScaleQuery
+): Promise<LauncherScaleInfo> {
+    const counts = await getLauncherScaleCountsForUser(
+        orgId,
+        userId,
+        userRoleIds
+    );
+
+    return {
+        mode: counts.mode,
+        resourceCount: counts.resourceCount,
+        siteGroupCount: counts.siteGroupCount,
+        labelGroupCount: counts.labelGroupCount,
+        capabilities: buildScaleCapabilities(counts, query)
+    };
+}

server/routers/launcher/listLauncherScale.ts

@@ -0,0 +1,60 @@
+import { response } from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { fromZodError } from "zod-validation-error";
+import { getLauncherScaleForUser } from "./launcherScale";
+import { launcherScaleQuerySchema } from "./types";
+
+export async function listLauncherScale(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const orgId = req.userOrgId;
+        const userId = req.user!.userId;
+
+        if (!orgId) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
+            );
+        }
+
+        const parsed = launcherScaleQuerySchema.safeParse(req.query);
+        if (!parsed.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromZodError(parsed.error)
+                )
+            );
+        }
+
+        const scale = await getLauncherScaleForUser(
+            orgId,
+            userId,
+            req.userOrgRoleIds ?? [],
+            parsed.data
+        );
+
+        return response(res, {
+            data: { scale },
+            success: true,
+            error: false,
+            message: "Launcher scale retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        if (createHttpError.isHttpError(error)) {
+            return next(error);
+        }
+        console.error("Error listing launcher scale:", error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Internal server error"
+            )
+        );
+    }
+}

server/routers/launcher/listLauncherViews.ts

@@ -4,22 +4,10 @@ import HttpCode from "@server/types/HttpCode";
 import { and, eq, isNull, or } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
 import createHttpError from "http-errors";
-import { launcherViewConfigSchema, type LauncherViewRecord } from "./types";
-
-function mapViewRow(
-    row: typeof launcherViews.$inferSelect
-): LauncherViewRecord {
-    return {
-        viewId: row.viewId,
-        orgId: row.orgId,
-        userId: row.userId,
-        name: row.name,
-        config: launcherViewConfigSchema.parse(JSON.parse(row.config)),
-        createdAt: row.createdAt,
-        updatedAt: row.updatedAt,
-        isOrgWide: row.userId == null
-    };
-}
+import {
+    extractDefaultViewOverrides,
+    listVisibleLauncherViews
+} from "./launcherDefaultView";
 
 export async function listLauncherViews(
     req: Request,
@@ -51,7 +39,8 @@ export async function listLauncherViews(
 
         return response(res, {
             data: {
-                views: rows.map(mapViewRow)
+                views: listVisibleLauncherViews(rows),
+                defaultViewOverrides: extractDefaultViewOverrides(rows)
             },
             success: true,
             error: false,

server/routers/launcher/types.ts

@@ -2,9 +2,10 @@ import { z } from "zod";
 
 export const LAUNCHER_UNLABELED_GROUP_KEY = "unlabeled";
 export const LAUNCHER_NO_SITE_GROUP_KEY = "no-site";
+export const LAUNCHER_FLAT_GROUP_KEY = "__all__";
 
 export const launcherViewConfigSchema = z.object({
-    groupBy: z.enum(["site", "label"]).default("site"),
+    groupBy: z.enum(["site", "label", "none"]).default("site"),
     layout: z.enum(["grid", "list"]).default("grid"),
     sortBy: z.literal("name").default("name"),
     order: z.enum(["asc", "desc"]).default("asc"),
@@ -88,10 +89,31 @@ export type LauncherViewRecord = {
     createdAt: string;
     updatedAt: string;
     isOrgWide: boolean;
+    isDefault: boolean;
 };
 
+export type LauncherDefaultViewOverrides = {
+    personal: LauncherViewRecord | null;
+    orgWide: LauncherViewRecord | null;
+};
+
+export function getEffectiveDefaultLauncherConfig(
+    overrides: LauncherDefaultViewOverrides
+): LauncherViewConfig {
+    if (overrides.personal) {
+        return overrides.personal.config;
+    }
+
+    if (overrides.orgWide) {
+        return overrides.orgWide.config;
+    }
+
+    return defaultLauncherViewConfig;
+}
+
 export type ListLauncherViewsResponse = {
     views: LauncherViewRecord[];
+    defaultViewOverrides: LauncherDefaultViewOverrides;
 };
 
 export const launcherFilterListQuerySchema = z.strictObject({
@@ -100,8 +122,8 @@ export const launcherFilterListQuerySchema = z.strictObject({
         .int()
         .positive()
         .optional()
-        .catch(500)
-        .default(500),
+        .catch(20)
+        .default(20),
     page: z.coerce.number().int().min(1).optional().catch(1).default(1),
     query: z.string().optional().default("")
 });
@@ -138,7 +160,7 @@ export const launcherListQuerySchema = z.strictObject({
         .default(20),
     page: z.coerce.number().int().min(1).optional().catch(1).default(1),
     query: z.string().optional().default(""),
-    groupBy: z.enum(["site", "label"]).optional().default("site"),
+    groupBy: z.enum(["site", "label", "none"]).optional().default("site"),
     groupKey: z.string().optional(),
     siteIds: z.string().optional(),
     labelIds: z.string().optional(),
@@ -163,3 +185,32 @@ export const DEFAULT_LAUNCHER_VIEW_ID = "default" as const;
 export type LauncherViewSelection =
     | { type: "default" }
     | { type: "saved"; viewId: number };
+
+export type LauncherScaleCapabilities = {
+    allowSiteGrouping: boolean;
+    allowLabelGrouping: boolean;
+    requireSearchOrFilter: boolean;
+};
+
+export type LauncherScaleInfo = {
+    mode: "full" | "compact";
+    resourceCount: number;
+    siteGroupCount: number;
+    labelGroupCount: number;
+    capabilities: LauncherScaleCapabilities;
+};
+
+export type ListLauncherScaleResponse = {
+    scale: LauncherScaleInfo;
+};
+
+export const launcherScaleQuerySchema = z.strictObject({
+    query: z.string().optional().default(""),
+    groupBy: z.enum(["site", "label", "none"]).optional().default("site"),
+    siteIds: z.string().optional(),
+    labelIds: z.string().optional(),
+    sort_by: z.literal("name").optional().default("name"),
+    order: z.enum(["asc", "desc"]).optional().default("asc")
+});
+
+export type LauncherScaleQuery = z.infer<typeof launcherScaleQuerySchema>;

server/routers/launcher/updateLauncherView.ts

@@ -66,6 +66,15 @@ export async function updateLauncherView(
             );
         }
 
+        if (existing.isDefault) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Use the default view save endpoint for this view"
+                )
+            );
+        }
+
         const isPersonalView = existing.userId === userId;
         const isOrgWideView = existing.userId == null;
         const canManageOrgWide = await checkUserActionPermission(
@@ -135,7 +144,8 @@ export async function updateLauncherView(
                 ),
                 createdAt: updated.createdAt,
                 updatedAt: updated.updatedAt,
-                isOrgWide: updated.userId == null
+                isOrgWide: updated.userId == null,
+                isDefault: updated.isDefault
             },
             success: true,
             error: false,

server/routers/launcher/upsertLauncherDefaultView.ts

@@ -0,0 +1,82 @@
+import { response } from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { fromZodError } from "zod-validation-error";
+import { z } from "zod";
+import { ActionsEnum, checkUserActionPermission } from "@server/auth/actions";
+import { upsertDefaultViewOverride } from "./launcherDefaultView";
+import { launcherViewConfigSchema } from "./types";
+
+const upsertLauncherDefaultViewBodySchema = z.strictObject({
+    config: launcherViewConfigSchema,
+    orgWide: z.boolean().optional().default(false)
+});
+
+export async function upsertLauncherDefaultView(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const orgId = req.userOrgId;
+        const userId = req.user!.userId;
+
+        if (!orgId) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
+            );
+        }
+
+        const parsed = upsertLauncherDefaultViewBodySchema.safeParse(req.body);
+        if (!parsed.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromZodError(parsed.error)
+                )
+            );
+        }
+
+        if (parsed.data.orgWide) {
+            const canManageOrgWide = await checkUserActionPermission(
+                ActionsEnum.createOrgWideLauncherView,
+                req
+            );
+            if (!canManageOrgWide) {
+                return next(
+                    createHttpError(
+                        HttpCode.FORBIDDEN,
+                        "User does not have permission perform this action"
+                    )
+                );
+            }
+        }
+
+        const view = await upsertDefaultViewOverride({
+            orgId,
+            userId,
+            orgWide: parsed.data.orgWide,
+            config: parsed.data.config
+        });
+
+        return response(res, {
+            data: view,
+            success: true,
+            error: false,
+            message: "Launcher default view saved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        if (createHttpError.isHttpError(error)) {
+            return next(error);
+        }
+        console.error("Error saving launcher default view:", error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Internal server error"
+            )
+        );
+    }
+}

server/routers/newt/buildConfiguration.ts

@@ -52,13 +52,13 @@ export async function buildClientConfigurationForNewtClient(
             clientsRes
                 .filter((client) => {
                     if (!client.clients.pubKey) {
-                        logger.warn(
+                        logger.debug(
                             `Client ${client.clients.clientId} has no public key, skipping`
                         );
                         return false;
                     }
                     if (!client.clients.subnet) {
-                        logger.warn(
+                        logger.debug(
                             `Client ${client.clients.clientId} has no subnet, skipping`
                         );
                         return false;

server/routers/newt/handleApplyBlueprintMessage.ts

@@ -50,7 +50,7 @@ export const handleApplyBlueprintMessage: MessageHandler = async (context) => {
             source: "NEWT"
         });
     } catch (error) {
-        logger.error(`Failed to update database from config: ${error}`);
+        logger.debug(`Failed to update database from config: ${error}`);
         return {
             message: {
                 type: "newt/blueprint/results",

server/routers/newt/handleNewtDisconnectingMessage.ts

@@ -19,7 +19,7 @@ export const handleNewtDisconnectingMessage: MessageHandler = async (
     }
 
     if (!newt.siteId) {
-        logger.warn("Newt has no client ID!");
+        logger.warn("Newt has no site ID!");
         return;
     }
 
@@ -34,6 +34,12 @@ export const handleNewtDisconnectingMessage: MessageHandler = async (
                 .where(eq(sites.siteId, newt.siteId!))
                 .returning();
 
+            if (!site) {
+                throw new Error(
+                    `Could not find site ${newt.siteId} to update disconnection from disconnect message`
+                );
+            }
+
             await fireSiteOfflineAlert(
                 site.orgId,
                 site.siteId,
@@ -43,6 +49,6 @@ export const handleNewtDisconnectingMessage: MessageHandler = async (
             );
         });
     } catch (error) {
-        logger.error("Error handling disconnecting message", { error });
+        logger.error("Error handling site disconnecting message", error);
     }
 };

server/routers/newt/handleNewtPingMessage.ts

@@ -5,8 +5,21 @@ import { Newt } from "@server/db";
 import { eq } from "drizzle-orm";
 import logger from "@server/logger";
 import { sendNewtSyncMessage } from "./sync";
+import semver from "semver";
 import { recordSitePing } from "./pingAccumulator";
 
+const NEWT_SUPPORTS_SYNC_VERSION = ">=1.14.0";
+const PONG = {
+    message: {
+        type: "pong",
+        data: {
+            timestamp: new Date().toISOString()
+        }
+    },
+    broadcast: false,
+    excludeSender: false
+};
+
 /**
  * Handles ping messages from newt clients.
  *
@@ -37,6 +50,14 @@ export const handleNewtPingMessage: MessageHandler = async (context) => {
     // cross-region latency to the database.
     recordSitePing(newt.siteId);
 
+    if (
+        newt.version &&
+        !semver.satisfies(newt.version, NEWT_SUPPORTS_SYNC_VERSION)
+    ) {
+        // Newt does not support the sync message so not checking - stop here -
+        return PONG;
+    }
+
     // Check config version and sync if stale.
     const configVersion = await getClientConfigVersion(newt.newtId);
 
@@ -65,14 +86,5 @@ export const handleNewtPingMessage: MessageHandler = async (context) => {
         await sendNewtSyncMessage(newt, site);
     }
 
-    return {
-        message: {
-            type: "pong",
-            data: {
-                timestamp: new Date().toISOString()
-            }
-        },
-        broadcast: false,
-        excludeSender: false
-    };
+    return PONG;
 };

server/routers/newt/pingAccumulator.ts

@@ -3,6 +3,7 @@ import { sites, clients, olms } from "@server/db";
 import { and, eq, inArray } from "drizzle-orm";
 import logger from "@server/logger";
 import { fireSiteOnlineAlert } from "@server/lib/alerts";
+import { withRetry } from "@server/lib/dbRetry";
 
 /**
  * Ping Accumulator
@@ -22,8 +23,6 @@ import { fireSiteOnlineAlert } from "@server/lib/alerts";
  */
 
 const FLUSH_INTERVAL_MS = 10_000; // Flush every 10 seconds
-const MAX_RETRIES = 5;
-const BASE_DELAY_MS = 50;
 
 // ── Site (newt) pings ──────────────────────────────────────────────────
 // Map of siteId -> latest ping timestamp (unix seconds)
@@ -266,85 +265,7 @@ export async function flushPingsToDb(): Promise<void> {
 }
 
 // ── Retry / Error Helpers ──────────────────────────────────────────────
-
-/**
- * Simple retry wrapper with exponential backoff for transient errors
- * (deadlocks, connection timeouts, unexpected disconnects).
- *
- * PostgreSQL deadlocks (40P01) are always safe to retry: the database
- * guarantees exactly one winner per deadlock pair, so the loser just needs
- * to try again. MAX_RETRIES is intentionally higher than typical connection
- * retry budgets to give deadlock victims enough chances to succeed.
- */
-async function withRetry<T>(
-    operation: () => Promise<T>,
-    context: string
-): Promise<T> {
-    let attempt = 0;
-    while (true) {
-        try {
-            return await operation();
-        } catch (error: any) {
-            if (isTransientError(error) && attempt < MAX_RETRIES) {
-                attempt++;
-                const baseDelay = Math.pow(2, attempt - 1) * BASE_DELAY_MS;
-                const jitter = Math.random() * baseDelay;
-                const delay = baseDelay + jitter;
-                logger.warn(
-                    `Transient DB error in ${context}, retrying attempt ${attempt}/${MAX_RETRIES} after ${delay.toFixed(0)}ms`,
-                    { code: error?.code ?? error?.cause?.code }
-                );
-                await new Promise((resolve) => setTimeout(resolve, delay));
-                continue;
-            }
-            throw error;
-        }
-    }
-}
-
-/**
- * Detect transient errors that are safe to retry.
- */
-function isTransientError(error: any): boolean {
-    if (!error) return false;
-
-    const message = (error.message || "").toLowerCase();
-    const causeMessage = (error.cause?.message || "").toLowerCase();
-    const code = error.code || error.cause?.code || "";
-
-    // Connection timeout / terminated
-    if (
-        message.includes("connection timeout") ||
-        message.includes("connection terminated") ||
-        message.includes("timeout exceeded when trying to connect") ||
-        causeMessage.includes("connection terminated unexpectedly") ||
-        causeMessage.includes("connection timeout")
-    ) {
-        return true;
-    }
-
-    // PostgreSQL deadlock detected - always safe to retry (one winner guaranteed)
-    if (code === "40P01" || message.includes("deadlock")) {
-        return true;
-    }
-
-    // PostgreSQL serialization failure
-    if (code === "40001") {
-        return true;
-    }
-
-    // ECONNRESET, ECONNREFUSED, EPIPE, ETIMEDOUT
-    if (
-        code === "ECONNRESET" ||
-        code === "ECONNREFUSED" ||
-        code === "EPIPE" ||
-        code === "ETIMEDOUT"
-    ) {
-        return true;
-    }
-
-    return false;
-}
+// See @server/lib/dbRetry for the shared withRetry/isTransientError helpers.
 
 // ── Lifecycle ──────────────────────────────────────────────────────────
 

server/routers/newt/sync.ts

@@ -9,45 +9,45 @@ import {
 import { canCompress } from "@server/lib/clientVersionChecks";
 
 export async function sendNewtSyncMessage(newt: Newt, site: Site) {
-    // const {
-    //     tcpTargets,
-    //     udpTargets,
-    //     validHealthCheckTargets,
-    //     browserGatewayTargets,
-    //     remoteExitNodeSubnets
-    // } = await buildTargetConfigurationForNewtClient(site.siteId);
-    // let exitNode: ExitNode | undefined;
-    // if (site.exitNodeId) {
-    //     [exitNode] = await db
-    //         .select()
-    //         .from(exitNodes)
-    //         .where(eq(exitNodes.exitNodeId, site.exitNodeId))
-    //         .limit(1);
-    // }
-    // const { peers, targets } = await buildClientConfigurationForNewtClient(
-    //     site,
-    //     exitNode
-    // );
-    // await sendToClient(
-    //     newt.newtId,
-    //     {
-    //         type: "newt/sync",
-    //         data: {
-    //             proxyTargets: {
-    //                 udp: udpTargets,
-    //                 tcp: tcpTargets
-    //             },
-    //             healthCheckTargets: validHealthCheckTargets,
-    //             peers: peers,
-    //             clientTargets: targets,
-    //             browserGatewayTargets: browserGatewayTargets,
-    //             remoteExitNodeSubnets: remoteExitNodeSubnets
-    //         }
-    //     },
-    //     {
-    //         compress: canCompress(newt.version, "newt")
-    //     }
-    // ).catch((error) => {
-    //     logger.warn(`Error sending newt sync message:`, error);
-    // });
+    const {
+        tcpTargets,
+        udpTargets,
+        validHealthCheckTargets,
+        browserGatewayTargets,
+        remoteExitNodeSubnets
+    } = await buildTargetConfigurationForNewtClient(site.siteId);
+    let exitNode: ExitNode | undefined;
+    if (site.exitNodeId) {
+        [exitNode] = await db
+            .select()
+            .from(exitNodes)
+            .where(eq(exitNodes.exitNodeId, site.exitNodeId))
+            .limit(1);
+    }
+    const { peers, targets } = await buildClientConfigurationForNewtClient(
+        site,
+        exitNode
+    );
+    await sendToClient(
+        newt.newtId,
+        {
+            type: "newt/sync",
+            data: {
+                proxyTargets: {
+                    udp: udpTargets,
+                    tcp: tcpTargets
+                },
+                healthCheckTargets: validHealthCheckTargets,
+                peers: peers,
+                clientTargets: targets,
+                browserGatewayTargets: browserGatewayTargets,
+                remoteExitNodeSubnets: remoteExitNodeSubnets
+            }
+        },
+        {
+            compress: canCompress(newt.version, "newt")
+        }
+    ).catch((error) => {
+        logger.warn(`Error sending newt sync message:`, error);
+    });
 }

server/routers/olm/buildConfiguration.ts

@@ -161,7 +161,7 @@ export async function buildSiteConfigurationForOlmClient(
         }
 
         if (!site.subnet) {
-            logger.warn(`Site ${site.siteId} has no subnet, skipping`);
+            logger.debug(`Site ${site.siteId} has no subnet, skipping`);
             continue;
         }
 

server/routers/olm/handleOlmDisconnectingMessage.ts

@@ -6,7 +6,9 @@ import logger from "@server/logger";
 /**
  * Handles disconnecting messages from clients to show disconnected in the ui
  */
-export const handleOlmDisconnectingMessage: MessageHandler = async (context) => {
+export const handleOlmDisconnectingMessage: MessageHandler = async (
+    context
+) => {
     const { message, client: c, sendToClient } = context;
     const olm = c as Olm;
 
@@ -29,6 +31,6 @@ export const handleOlmDisconnectingMessage: MessageHandler = async (context) =>
             })
             .where(eq(clients.clientId, olm.clientId));
     } catch (error) {
-        logger.error("Error handling disconnecting message", { error });
+        logger.error("Error handling client disconnecting message", error);
     }
 };

server/routers/resource/addEmailToResourceWhitelist.ts

@@ -1,7 +1,12 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db } from "@server/db";
-import { resources, resourceWhitelist } from "@server/db";
+import {
+    resources,
+    resourceWhitelist,
+    resourcePolicies,
+    resourcePolicyWhiteList
+} from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
@@ -103,6 +108,64 @@ export async function addEmailToResourceWhitelist(
             );
         }
 
+        // A shared policy takes precedence over the resource's inline
+        // (default) policy, which takes precedence over the resource's own
+        // direct whitelist fields. This mirrors the precedence used at
+        // request time in authWithWhitelist.ts / getResourceAuthInfo.ts.
+        const policyId =
+            resource.resourcePolicyId ?? resource.defaultResourcePolicyId;
+
+        if (policyId !== null) {
+            const [policy] = await db
+                .select()
+                .from(resourcePolicies)
+                .where(eq(resourcePolicies.resourcePolicyId, policyId));
+
+            if (!policy) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        "Resource policy not found"
+                    )
+                );
+            }
+
+            if (!policy.emailWhitelistEnabled) {
+                return next(
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        "Email whitelist is not enabled for this resource"
+                    )
+                );
+            }
+
+            const existingEntry = await db
+                .select()
+                .from(resourcePolicyWhiteList)
+                .where(
+                    and(
+                        eq(
+                            resourcePolicyWhiteList.resourcePolicyId,
+                            policyId
+                        ),
+                        eq(resourcePolicyWhiteList.email, email)
+                    )
+                );
+
+            if (existingEntry.length > 0) {
+                return next(
+                    createHttpError(
+                        HttpCode.CONFLICT,
+                        "Email already exists in whitelist"
+                    )
+                );
+            }
+
+            await db.insert(resourcePolicyWhiteList).values({
+                email,
+                resourcePolicyId: policyId
+            });
+        } else {
             if (!resource.emailWhitelistEnabled) {
                 return next(
                     createHttpError(
@@ -136,6 +199,7 @@ export async function addEmailToResourceWhitelist(
                 email,
                 resourceId
             });
+        }
 
         return response(res, {
             data: {},

server/routers/resource/getResourceWhitelist.ts

@@ -96,12 +96,16 @@ export async function getResourceWhitelist(
             );
         }
 
-        const isInlinePolicy =
-            resource.resourcePolicyId === null &&
-            resource.defaultResourcePolicyId !== null;
+        // A shared policy takes precedence over the resource's inline
+        // (default) policy, which takes precedence over the resource's own
+        // direct whitelist fields. This mirrors the precedence used at
+        // request time in authWithWhitelist.ts / getResourceAuthInfo.ts.
+        const policyId =
+            resource.resourcePolicyId ?? resource.defaultResourcePolicyId;
 
-        const whitelist = isInlinePolicy
-            ? await queryPolicyWhitelist(resource.defaultResourcePolicyId!)
+        const whitelist =
+            policyId !== null
+                ? await queryPolicyWhitelist(policyId)
                 : await queryWhitelist(resourceId);
 
         return response<GetResourceWhitelistResponse>(res, {

server/routers/resource/listResources.ts

@@ -616,8 +616,8 @@ export async function listResources(
                         and(
                             inArray(resources.mode, browserGatewayModes),
                             or(
-                                eq(effectiveSso, true),
-                                eq(effectiveWhitelist, true),
+                                effectiveSso,
+                                effectiveWhitelist,
                                 not(isNull(effectiveHeaderAuthId)),
                                 not(isNull(effectivePincodeId)),
                                 not(isNull(effectivePasswordId))
@@ -629,8 +629,8 @@ export async function listResources(
                     conditions.push(
                         and(
                             inArray(resources.mode, browserGatewayModes),
-                            not(eq(effectiveSso, true)),
-                            not(eq(effectiveWhitelist, true)),
+                            not(effectiveSso),
+                            not(effectiveWhitelist),
                             isNull(effectiveHeaderAuthId),
                             isNull(effectivePincodeId),
                             isNull(effectivePasswordId)

server/routers/resource/removeEmailFromResourceWhitelist.ts

@@ -1,7 +1,12 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db } from "@server/db";
-import { resources, resourceWhitelist } from "@server/db";
+import {
+    resources,
+    resourceWhitelist,
+    resourcePolicies,
+    resourcePolicyWhiteList
+} from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
@@ -102,6 +107,71 @@ export async function removeEmailFromResourceWhitelist(
             );
         }
 
+        // A shared policy takes precedence over the resource's inline
+        // (default) policy, which takes precedence over the resource's own
+        // direct whitelist fields. This mirrors the precedence used at
+        // request time in authWithWhitelist.ts / getResourceAuthInfo.ts.
+        const policyId =
+            resource.resourcePolicyId ?? resource.defaultResourcePolicyId;
+
+        if (policyId !== null) {
+            const [policy] = await db
+                .select()
+                .from(resourcePolicies)
+                .where(eq(resourcePolicies.resourcePolicyId, policyId));
+
+            if (!policy) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        "Resource policy not found"
+                    )
+                );
+            }
+
+            if (!policy.emailWhitelistEnabled) {
+                return next(
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        "Email whitelist is not enabled for this resource"
+                    )
+                );
+            }
+
+            const existingEntry = await db
+                .select()
+                .from(resourcePolicyWhiteList)
+                .where(
+                    and(
+                        eq(
+                            resourcePolicyWhiteList.resourcePolicyId,
+                            policyId
+                        ),
+                        eq(resourcePolicyWhiteList.email, email)
+                    )
+                );
+
+            if (existingEntry.length === 0) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        "Email not found in whitelist"
+                    )
+                );
+            }
+
+            await db
+                .delete(resourcePolicyWhiteList)
+                .where(
+                    and(
+                        eq(
+                            resourcePolicyWhiteList.resourcePolicyId,
+                            policyId
+                        ),
+                        eq(resourcePolicyWhiteList.email, email)
+                    )
+                );
+        } else {
             if (!resource.emailWhitelistEnabled) {
                 return next(
                     createHttpError(
@@ -139,6 +209,7 @@ export async function removeEmailFromResourceWhitelist(
                         eq(resourceWhitelist.email, email)
                     )
                 );
+        }
 
         return response(res, {
             data: {},

server/routers/resource/setResourceWhitelist.ts

@@ -109,13 +109,14 @@ export async function setResourceWhitelist(
             );
         }
 
-        const isInlinePolicy =
-            resource.resourcePolicyId === null &&
-            resource.defaultResourcePolicyId !== null;
-
-        if (isInlinePolicy) {
-            const policyId = resource.defaultResourcePolicyId!;
+        // A shared policy takes precedence over the resource's inline
+        // (default) policy, which takes precedence over the resource's own
+        // direct whitelist fields. This mirrors the precedence used at
+        // request time in authWithWhitelist.ts / getResourceAuthInfo.ts.
+        const policyId =
+            resource.resourcePolicyId ?? resource.defaultResourcePolicyId;
 
+        if (policyId !== null) {
             const [policy] = await db
                 .select()
                 .from(resourcePolicies)

server/routers/site/createSite.ts

@@ -268,7 +268,11 @@ export async function createSite(
 
         let newSite: Site | undefined;
         try {
-            if (subnet && exitNodeId) {
+            if (type === "wireguard" && subnet && exitNodeId) {
+                // Only wireguard sites actually persist the provided subnet/exitNodeId.
+                // Newt sites have their subnet/exit node chosen (under a lock) when the
+                // newt connects, so validating them here is both unnecessary and racy,
+                // since pickSiteDefaults does not lock the subnet it suggests.
                 //make sure the subnet is in the range of the exit node if provided
                 const [exitNode] = await db
                     .select()

server/routers/siteResource/updateSiteResource.ts

@@ -68,9 +68,9 @@ const updateSiteResourceSchema = z
                     "Fully qualified domain name with optional wildcards, e.g., example.internal, *.example.internal, or host-0?.example.internal",
                 example: "service.example.internal"
             }),
-        userIds: z.array(z.string()),
-        roleIds: z.array(z.int()),
-        clientIds: z.array(z.int()),
+        userIds: z.array(z.string()).optional(),
+        roleIds: z.array(z.int()).optional(),
+        clientIds: z.array(z.int()).optional(),
         tcpPortRangeString: portRangeStringSchema,
         udpPortRangeString: portRangeStringSchema,
         disableIcmp: z.boolean().optional(),
@@ -167,6 +167,10 @@ const updateSiteResourceSchema = z
     )
     .refine(
         (data) => {
+            // if neither is provided, the existing site associations are left unchanged
+            if (data.siteIds === undefined && data.siteId === undefined) {
+                return true;
+            }
             return (
                 (data.siteIds !== undefined && data.siteIds.length > 0) ||
                 data.siteId !== undefined
@@ -263,7 +267,7 @@ export async function updateSiteResource(
         const { siteResourceId } = parsedParams.data;
         const {
             name,
-            siteIds: siteIdsInput = [], // because it can change
+            siteIds: siteIdsInput,
             siteId,
             niceId,
             mode,
@@ -287,10 +291,15 @@ export async function updateSiteResource(
         } = parsedBody.data;
 
         // Backward compatibility: merge deprecated siteId into siteIds array
-        const siteIds = [...siteIdsInput];
+        const siteIdsProvided =
+            siteIdsInput !== undefined || siteId !== undefined;
+        let siteIds: number[] | undefined;
+        if (siteIdsProvided) {
+            siteIds = [...(siteIdsInput ?? [])];
             if (siteId !== undefined && !siteIds.includes(siteId)) {
                 siteIds.push(siteId);
             }
+        }
 
         // Check if site resource exists
         const [existingSiteResource] = await db
@@ -356,6 +365,7 @@ export async function updateSiteResource(
         }
 
         // Verify the site exists and belongs to the org
+        if (siteIds !== undefined) {
             const sitesToAssign = await db
                 .select()
                 .from(sites)
@@ -371,6 +381,7 @@ export async function updateSiteResource(
                     createHttpError(HttpCode.NOT_FOUND, "Some site not found")
                 );
             }
+        }
 
         // Only check if destination is an IP address
         const isIp = z
@@ -463,7 +474,8 @@ export async function updateSiteResource(
         }
 
         let updatedSiteResource: SiteResource | undefined;
-        let updatedSiteIds: number[] = [];
+        // defaults to the existing sites; only overwritten below if siteIds/siteId was provided
+        let updatedSiteIds: number[] = [...existingSiteIds];
         await db.transaction(async (trx) => {
             // Update the site resource
             const sshPamSet =
@@ -522,13 +534,18 @@ export async function updateSiteResource(
 
             //////////////////// update the associations ////////////////////
 
+            if (siteIds !== undefined) {
                 // delete the site - site resources associations
                 await trx
                     .delete(siteNetworks)
                     .where(
-                    eq(siteNetworks.networkId, updatedSiteResource.networkId!)
+                        eq(
+                            siteNetworks.networkId,
+                            updatedSiteResource.networkId!
+                        )
                     );
 
+                updatedSiteIds = [];
                 for (const siteId of siteIds) {
                     await trx.insert(siteNetworks).values({
                         siteId: siteId,
@@ -536,10 +553,14 @@ export async function updateSiteResource(
                     });
                     updatedSiteIds.push(siteId);
                 }
+            }
 
+            if (clientIds !== undefined) {
                 await trx
                     .delete(clientSiteResources)
-                .where(eq(clientSiteResources.siteResourceId, siteResourceId));
+                    .where(
+                        eq(clientSiteResources.siteResourceId, siteResourceId)
+                    );
 
                 if (clientIds.length > 0) {
                     await trx.insert(clientSiteResources).values(
@@ -549,10 +570,14 @@ export async function updateSiteResource(
                         }))
                     );
                 }
+            }
 
+            if (userIds !== undefined) {
                 await trx
                     .delete(userSiteResources)
-                .where(eq(userSiteResources.siteResourceId, siteResourceId));
+                    .where(
+                        eq(userSiteResources.siteResourceId, siteResourceId)
+                    );
 
                 if (userIds.length > 0) {
                     await trx.insert(userSiteResources).values(
@@ -562,7 +587,9 @@ export async function updateSiteResource(
                         }))
                     );
                 }
+            }
 
+            if (roleIds !== undefined) {
                 // Get all admin role IDs for this org to exclude from deletion
                 const adminRoles = await trx
                     .select()
@@ -578,7 +605,10 @@ export async function updateSiteResource(
                 if (adminRoleIds.length > 0) {
                     await trx.delete(roleSiteResources).where(
                         and(
-                        eq(roleSiteResources.siteResourceId, siteResourceId),
+                            eq(
+                                roleSiteResources.siteResourceId,
+                                siteResourceId
+                            ),
                             ne(roleSiteResources.roleId, adminRoleIds[0]) // delete all but the admin role
                         )
                     );
@@ -586,7 +616,10 @@ export async function updateSiteResource(
                     await trx
                         .delete(roleSiteResources)
                         .where(
-                        eq(roleSiteResources.siteResourceId, siteResourceId)
+                            eq(
+                                roleSiteResources.siteResourceId,
+                                siteResourceId
+                            )
                         );
                 }
 
@@ -598,6 +631,7 @@ export async function updateSiteResource(
                         }))
                     );
                 }
+            }
 
             logger.info(`Updated site resource ${siteResourceId}`);
         });

server/setup/ensureActions.ts

@@ -3,8 +3,12 @@ import { db, orgs } from "@server/db";
 import { actions, roles, roleActions } from "@server/db";
 import { eq, inArray } from "drizzle-orm";
 import logger from "@server/logger";
+import { build } from "@server/build";
 
 export async function ensureActions() {
+    if (build == "saas") {
+        return;
+    }
     await db.transaction(async (trx) => {
         const actionIds = Object.values(ActionsEnum);
         const existingActions = await trx.select().from(actions).execute();

src/app/[orgId]/page.tsx

@@ -82,9 +82,11 @@ export default async function OrgPage(props: OrgPageProps) {
                         orgId={orgId}
                         isAdmin={isAdminOrOwner}
                         views={launcherData.views}
+                        defaultViewOverrides={launcherData.defaultViewOverrides}
                         activeViewId={launcherData.activeViewId}
                         config={launcherData.config}
                         savedConfig={launcherData.savedConfig}
+                        scale={launcherData.scale}
                         groups={launcherData.groups}
                         groupsPagination={launcherData.groupsPagination}
                     />

src/app/[orgId]/settings/(private)/billing/page.tsx

@@ -158,6 +158,9 @@ const tierLimits: Record<
         domains: number;
         remoteNodes: number;
         organizations: number;
+        publicResources: number;
+        privateResources: number;
+        machineClients: number;
     }
 > = {
     basic: {
@@ -165,35 +168,50 @@ const tierLimits: Record<
         sites: freeLimitSet[LimitId.SITES]?.value ?? 0,
         domains: freeLimitSet[LimitId.DOMAINS]?.value ?? 0,
         remoteNodes: freeLimitSet[LimitId.REMOTE_EXIT_NODES]?.value ?? 0,
-        organizations: freeLimitSet[LimitId.ORGANIZATIONS]?.value ?? 0
+        organizations: freeLimitSet[LimitId.ORGANIZATIONS]?.value ?? 0,
+        publicResources: freeLimitSet[LimitId.PUBLIC_RESOURCES]?.value ?? 0,
+        privateResources: freeLimitSet[LimitId.PRIVATE_RESOURCES]?.value ?? 0,
+        machineClients: freeLimitSet[LimitId.MACHINE_CLIENTS]?.value ?? 0
     },
     tier1: {
         users: tier1LimitSet[LimitId.USERS]?.value ?? 0,
         sites: tier1LimitSet[LimitId.SITES]?.value ?? 0,
         domains: tier1LimitSet[LimitId.DOMAINS]?.value ?? 0,
         remoteNodes: tier1LimitSet[LimitId.REMOTE_EXIT_NODES]?.value ?? 0,
-        organizations: tier1LimitSet[LimitId.ORGANIZATIONS]?.value ?? 0
+        organizations: tier1LimitSet[LimitId.ORGANIZATIONS]?.value ?? 0,
+        publicResources: tier1LimitSet[LimitId.PUBLIC_RESOURCES]?.value ?? 0,
+        privateResources: tier1LimitSet[LimitId.PRIVATE_RESOURCES]?.value ?? 0,
+        machineClients: tier1LimitSet[LimitId.MACHINE_CLIENTS]?.value ?? 0
     },
     tier2: {
         users: tier2LimitSet[LimitId.USERS]?.value ?? 0,
         sites: tier2LimitSet[LimitId.SITES]?.value ?? 0,
         domains: tier2LimitSet[LimitId.DOMAINS]?.value ?? 0,
         remoteNodes: tier2LimitSet[LimitId.REMOTE_EXIT_NODES]?.value ?? 0,
-        organizations: tier2LimitSet[LimitId.ORGANIZATIONS]?.value ?? 0
+        organizations: tier2LimitSet[LimitId.ORGANIZATIONS]?.value ?? 0,
+        publicResources: tier2LimitSet[LimitId.PUBLIC_RESOURCES]?.value ?? 0,
+        privateResources: tier2LimitSet[LimitId.PRIVATE_RESOURCES]?.value ?? 0,
+        machineClients: tier2LimitSet[LimitId.MACHINE_CLIENTS]?.value ?? 0
     },
     tier3: {
         users: tier3LimitSet[LimitId.USERS]?.value ?? 0,
         sites: tier3LimitSet[LimitId.SITES]?.value ?? 0,
         domains: tier3LimitSet[LimitId.DOMAINS]?.value ?? 0,
         remoteNodes: tier3LimitSet[LimitId.REMOTE_EXIT_NODES]?.value ?? 0,
-        organizations: tier3LimitSet[LimitId.ORGANIZATIONS]?.value ?? 0
+        organizations: tier3LimitSet[LimitId.ORGANIZATIONS]?.value ?? 0,
+        publicResources: tier3LimitSet[LimitId.PUBLIC_RESOURCES]?.value ?? 0,
+        privateResources: tier3LimitSet[LimitId.PRIVATE_RESOURCES]?.value ?? 0,
+        machineClients: tier3LimitSet[LimitId.MACHINE_CLIENTS]?.value ?? 0
     },
     enterprise: {
         users: 0, // Custom for enterprise
         sites: 0, // Custom for enterprise
         domains: 0, // Custom for enterprise
         remoteNodes: 0, // Custom for enterprise
-        organizations: 0 // Custom for enterprise
+        organizations: 0, // Custom for enterprise
+        publicResources: 0, // Custom for enterprise
+        privateResources: 0, // Custom for enterprise
+        machineClients: 0 // Custom for enterprise
     }
 };
 
@@ -234,6 +252,9 @@ export default function BillingPage() {
     const DOMAINS = "domains";
     const REMOTE_EXIT_NODES = "remoteExitNodes";
     const ORGINIZATIONS = "organizations";
+    const PUBLIC_RESOURCES = "publicResources";
+    const PRIVATE_RESOURCES = "privateResources";
+    const MACHINE_CLIENTS = "machineClients";
 
     // Confirmation dialog state
     const [showConfirmDialog, setShowConfirmDialog] = useState(false);
@@ -269,7 +290,13 @@ export default function BillingPage() {
                     setHasSubscription(
                         tierSub.subscription.status === "active"
                     );
-                    setIsTrial(tierSub.subscription.expiresAt != null);
+                    // expiresAt is only meaningful while the trial hasn't
+                    // actually run out yet; a stale row with a past
+                    // expiresAt should no longer be treated as a live trial
+                    const expiresAt = tierSub.subscription.expiresAt;
+                    setIsTrial(
+                        expiresAt != null && expiresAt * 1000 > Date.now()
+                    );
                 }
 
                 // Find license subscription
@@ -797,6 +824,45 @@ export default function BillingPage() {
             });
         }
 
+        // Check public resources
+        const publicResourcesUsage = getUsageValue(PUBLIC_RESOURCES);
+        if (
+            limits.publicResources > 0 &&
+            publicResourcesUsage > limits.publicResources
+        ) {
+            violations.push({
+                feature: "Public Resources",
+                currentUsage: publicResourcesUsage,
+                newLimit: limits.publicResources
+            });
+        }
+
+        // Check private resources
+        const privateResourcesUsage = getUsageValue(PRIVATE_RESOURCES);
+        if (
+            limits.privateResources > 0 &&
+            privateResourcesUsage > limits.privateResources
+        ) {
+            violations.push({
+                feature: "Private Resources",
+                currentUsage: privateResourcesUsage,
+                newLimit: limits.privateResources
+            });
+        }
+
+        // Check machine clients
+        const machineClientsUsage = getUsageValue(MACHINE_CLIENTS);
+        if (
+            limits.machineClients > 0 &&
+            machineClientsUsage > limits.machineClients
+        ) {
+            violations.push({
+                feature: "Machine Clients",
+                currentUsage: machineClientsUsage,
+                newLimit: limits.machineClients
+            });
+        }
+
         return violations;
     };
 
@@ -997,12 +1063,13 @@ export default function BillingPage() {
                     </SettingsSectionDescription>
                 </SettingsSectionHeader>
                 <SettingsSectionBody>
-                    <div className="grid grid-cols-1 md:grid-cols-2 gap-6">
+                    <div className="grid grid-cols-1 md:grid-cols-4 gap-6">
                         {/* Current Usage */}
-                        <div className="border rounded-lg p-4">
+                        <div className="border rounded-lg p-4 md:col-span-1">
                             <div className="text-sm text-muted-foreground mb-2">
                                 {t("billingCurrentUsage") || "Current Usage"}
                             </div>
+                            <div className="flex flex-col items-start gap-1">
                                 <div className="flex items-baseline gap-2">
                                     <span className="text-3xl font-semibold">
                                         {getUserCount()}
@@ -1010,8 +1077,9 @@ export default function BillingPage() {
                                     <span className="text-lg">
                                         {t("billingUsers") || "Users"}
                                     </span>
+                                </div>
                                 {hasSubscription && getPricePerUser() > 0 && (
-                                    <div className="text-sm text-muted-foreground mt-1">
+                                    <div className="text-sm text-muted-foreground">
                                         x ${getPricePerUser()} / month = $
                                         {getUserCount() * getPricePerUser()} /
                                         month
@@ -1021,11 +1089,11 @@ export default function BillingPage() {
                         </div>
 
                         {/* Maximum Limits */}
-                        <div className="border rounded-lg p-4">
+                        <div className="border rounded-lg p-4 md:col-span-3">
                             <div className="text-sm text-muted-foreground mb-3">
                                 {t("billingMaximumLimits") || "Maximum Limits"}
                             </div>
-                            <InfoSections cols={5}>
+                            <InfoSections cols={8}>
                                 <InfoSection>
                                     <InfoSectionTitle className="flex items-center gap-1 text-xs">
                                         {t("billingUsers") || "Users"}
@@ -1308,6 +1376,168 @@ export default function BillingPage() {
                                         )}
                                     </InfoSectionContent>
                                 </InfoSection>
+                                <InfoSection>
+                                    <InfoSectionTitle className="flex items-center gap-1 text-xs">
+                                        {t("billingPublicResources") ||
+                                            "Public Resources"}
+                                    </InfoSectionTitle>
+                                    <InfoSectionContent className="text-sm">
+                                        {isOverLimit(PUBLIC_RESOURCES) ? (
+                                            <Tooltip>
+                                                <TooltipTrigger className="flex items-center gap-1">
+                                                    <AlertTriangle className="h-3 w-3 text-orange-400" />
+                                                    <span
+                                                        className={cn(
+                                                            "text-orange-600 dark:text-orange-400 font-medium"
+                                                        )}
+                                                    >
+                                                        {getLimitValue(
+                                                            PUBLIC_RESOURCES
+                                                        ) ??
+                                                            t(
+                                                                "billingUnlimited"
+                                                            ) ??
+                                                            "∞"}
+                                                    </span>
+                                                </TooltipTrigger>
+                                                <TooltipContent>
+                                                    <p>
+                                                        {t(
+                                                            "billingUsageExceedsLimit",
+                                                            {
+                                                                current:
+                                                                    getUsageValue(
+                                                                        PUBLIC_RESOURCES
+                                                                    ),
+                                                                limit:
+                                                                    getLimitValue(
+                                                                        PUBLIC_RESOURCES
+                                                                    ) ?? 0
+                                                            }
+                                                        ) ||
+                                                            `Current usage (${getUsageValue(PUBLIC_RESOURCES)}) exceeds limit (${getLimitValue(PUBLIC_RESOURCES)})`}
+                                                    </p>
+                                                </TooltipContent>
+                                            </Tooltip>
+                                        ) : (
+                                            <>
+                                                {getLimitValue(
+                                                    PUBLIC_RESOURCES
+                                                ) ??
+                                                    t("billingUnlimited") ??
+                                                    "∞"}
+                                            </>
+                                        )}
+                                    </InfoSectionContent>
+                                </InfoSection>
+                                <InfoSection>
+                                    <InfoSectionTitle className="flex items-center gap-1 text-xs">
+                                        {t("billingPrivateResources") ||
+                                            "Private Resources"}
+                                    </InfoSectionTitle>
+                                    <InfoSectionContent className="text-sm">
+                                        {isOverLimit(PRIVATE_RESOURCES) ? (
+                                            <Tooltip>
+                                                <TooltipTrigger className="flex items-center gap-1">
+                                                    <AlertTriangle className="h-3 w-3 text-orange-400" />
+                                                    <span
+                                                        className={cn(
+                                                            "text-orange-600 dark:text-orange-400 font-medium"
+                                                        )}
+                                                    >
+                                                        {getLimitValue(
+                                                            PRIVATE_RESOURCES
+                                                        ) ??
+                                                            t(
+                                                                "billingUnlimited"
+                                                            ) ??
+                                                            "∞"}
+                                                    </span>
+                                                </TooltipTrigger>
+                                                <TooltipContent>
+                                                    <p>
+                                                        {t(
+                                                            "billingUsageExceedsLimit",
+                                                            {
+                                                                current:
+                                                                    getUsageValue(
+                                                                        PRIVATE_RESOURCES
+                                                                    ),
+                                                                limit:
+                                                                    getLimitValue(
+                                                                        PRIVATE_RESOURCES
+                                                                    ) ?? 0
+                                                            }
+                                                        ) ||
+                                                            `Current usage (${getUsageValue(PRIVATE_RESOURCES)}) exceeds limit (${getLimitValue(PRIVATE_RESOURCES)})`}
+                                                    </p>
+                                                </TooltipContent>
+                                            </Tooltip>
+                                        ) : (
+                                            <>
+                                                {getLimitValue(
+                                                    PRIVATE_RESOURCES
+                                                ) ??
+                                                    t("billingUnlimited") ??
+                                                    "∞"}
+                                            </>
+                                        )}
+                                    </InfoSectionContent>
+                                </InfoSection>
+                                <InfoSection>
+                                    <InfoSectionTitle className="flex items-center gap-1 text-xs">
+                                        {t("billingMachineClients") ||
+                                            "Machine Clients"}
+                                    </InfoSectionTitle>
+                                    <InfoSectionContent className="text-sm">
+                                        {isOverLimit(MACHINE_CLIENTS) ? (
+                                            <Tooltip>
+                                                <TooltipTrigger className="flex items-center gap-1">
+                                                    <AlertTriangle className="h-3 w-3 text-orange-400" />
+                                                    <span
+                                                        className={cn(
+                                                            "text-orange-600 dark:text-orange-400 font-medium"
+                                                        )}
+                                                    >
+                                                        {getLimitValue(
+                                                            MACHINE_CLIENTS
+                                                        ) ??
+                                                            t(
+                                                                "billingUnlimited"
+                                                            ) ??
+                                                            "∞"}
+                                                    </span>
+                                                </TooltipTrigger>
+                                                <TooltipContent>
+                                                    <p>
+                                                        {t(
+                                                            "billingUsageExceedsLimit",
+                                                            {
+                                                                current:
+                                                                    getUsageValue(
+                                                                        MACHINE_CLIENTS
+                                                                    ),
+                                                                limit:
+                                                                    getLimitValue(
+                                                                        MACHINE_CLIENTS
+                                                                    ) ?? 0
+                                                            }
+                                                        ) ||
+                                                            `Current usage (${getUsageValue(MACHINE_CLIENTS)}) exceeds limit (${getLimitValue(MACHINE_CLIENTS)})`}
+                                                    </p>
+                                                </TooltipContent>
+                                            </Tooltip>
+                                        ) : (
+                                            <>
+                                                {getLimitValue(
+                                                    MACHINE_CLIENTS
+                                                ) ??
+                                                    t("billingUnlimited") ??
+                                                    "∞"}
+                                            </>
+                                        )}
+                                    </InfoSectionContent>
+                                </InfoSection>
                             </InfoSections>
                         </div>
                     </div>
@@ -1507,6 +1737,45 @@ export default function BillingPage() {
                                                         "Remote Nodes"}
                                                 </span>
                                             </div>
+                                            <div className="flex items-center gap-2">
+                                                <span className="w-1.5 h-1.5 rounded-full bg-muted-foreground/50 shrink-0" />
+                                                <span>
+                                                    {
+                                                        tierLimits[
+                                                            pendingTier.tier
+                                                        ].publicResources
+                                                    }{" "}
+                                                    {t(
+                                                        "billingPublicResources"
+                                                    ) || "Public Resources"}
+                                                </span>
+                                            </div>
+                                            <div className="flex items-center gap-2">
+                                                <span className="w-1.5 h-1.5 rounded-full bg-muted-foreground/50 shrink-0" />
+                                                <span>
+                                                    {
+                                                        tierLimits[
+                                                            pendingTier.tier
+                                                        ].privateResources
+                                                    }{" "}
+                                                    {t(
+                                                        "billingPrivateResources"
+                                                    ) || "Private Resources"}
+                                                </span>
+                                            </div>
+                                            <div className="flex items-center gap-2">
+                                                <span className="w-1.5 h-1.5 rounded-full bg-muted-foreground/50 shrink-0" />
+                                                <span>
+                                                    {
+                                                        tierLimits[
+                                                            pendingTier.tier
+                                                        ].machineClients
+                                                    }{" "}
+                                                    {t(
+                                                        "billingMachineClients"
+                                                    ) || "Machine Clients"}
+                                                </span>
+                                            </div>
                                         </div>
                                     </div>
                                 )}

src/app/[orgId]/settings/resources/public/[niceId]/http/page.tsx

@@ -41,7 +41,7 @@ import {
 import { AxiosResponse } from "axios";
 import { useTranslations } from "next-intl";
 import { useParams, useRouter } from "next/navigation";
-import { useActionState } from "react";
+import { useActionState, useState } from "react";
 import { useForm } from "react-hook-form";
 import { z } from "zod";
 
@@ -137,11 +137,21 @@ function ProxyResourceHttpForm({
     });
 
     const [, formAction, saveLoading] = useActionState(onSubmit, null);
+    const [headersValid, setHeadersValid] = useState(true);
 
     async function onSubmit() {
         const isValid = await form.trigger();
         if (!isValid) return;
 
+        if (!headersValid) {
+            toast({
+                variant: "destructive",
+                title: t("settingsErrorUpdate"),
+                description: t("headersValidationError")
+            });
+            return;
+        }
+
         const data = form.getValues();
 
         const res = await api
@@ -318,6 +328,9 @@ function ProxyResourceHttpForm({
                                                         onChange={
                                                             field.onChange
                                                         }
+                                                        onValidityChange={
+                                                            setHeadersValid
+                                                        }
                                                         rows={4}
                                                     />
                                                 </FormControl>
@@ -341,7 +354,7 @@ function ProxyResourceHttpForm({
                 <Button
                     type="submit"
                     loading={saveLoading}
-                    disabled={saveLoading}
+                    disabled={saveLoading || !headersValid}
                     form="http-settings-form"
                 >
                     {t("saveSettings")}

src/components/CopyToClipboard.tsx

@@ -1,3 +1,4 @@
+import { cn } from "@app/lib/cn";
 import { Check, Copy } from "lucide-react";
 import Link from "next/link";
 import { useState } from "react";
@@ -7,12 +8,14 @@ type CopyToClipboardProps = {
     text: string;
     displayText?: string;
     isLink?: boolean;
+    className?: string;
 };
 
 const CopyToClipboard = ({
     text,
     displayText,
-    isLink
+    isLink,
+    className
 }: CopyToClipboardProps) => {
     const [copied, setCopied] = useState(false);
 
@@ -48,14 +51,20 @@ const CopyToClipboard = ({
                     href={text}
                     target="_blank"
                     rel="noopener noreferrer"
-                    className="truncate hover:underline text-sm min-w-0 max-w-full"
+                    className={cn(
+                        "truncate hover:underline text-sm min-w-0 max-w-full",
+                        className
+                    )}
                     title={text} // Shows full text on hover
                 >
                     {displayValue}
                 </Link>
             ) : (
                 <span
-                    className="truncate text-sm min-w-0 max-w-full"
+                    className={cn(
+                        "truncate text-sm min-w-0 max-w-full",
+                        className
+                    )}
                     style={{
                         whiteSpace: "nowrap",
                         overflow: "hidden",

src/components/HeadersInput.tsx

@@ -2,24 +2,36 @@
 
 import { useEffect, useState, useRef } from "react";
 import { Textarea } from "@/components/ui/textarea";
+import { useTranslations } from "next-intl";
 
 interface HeadersInputProps {
     value?: { name: string; value: string }[] | null;
     onChange: (value: { name: string; value: string }[] | null) => void;
+    onValidityChange?: (isValid: boolean) => void;
     placeholder?: string;
     rows?: number;
     className?: string;
 }
 
+// Mirrors the server side validation in updateResource.ts so that invalid
+// input is caught (and shown to the user) before it is ever submitted,
+// instead of being silently dropped in favor of the last known good value.
+const validHeaderNamePattern = /^[a-zA-Z0-9!#$%&'*+\-.^_`|~]+$/;
+const validHeaderValuePattern = /^[\t\x20-\x7E]*$/;
+const templatePattern = /\{\{[^}]+\}\}/;
+
 export function HeadersInput({
     value = [],
     onChange,
+    onValidityChange,
     placeholder = `X-Example-Header: example-value
 X-Another-Header: another-value`,
     rows = 4,
     className
 }: HeadersInputProps) {
+    const t = useTranslations();
     const [internalValue, setInternalValue] = useState("");
+    const [error, setError] = useState<string | null>(null);
     const textareaRef = useRef<HTMLTextAreaElement>(null);
     const isUserEditingRef = useRef(false);
 
@@ -34,37 +46,56 @@ X-Another-Header: another-value`,
             .join("\n");
     };
 
-    // Convert newline-separated string to header objects array
-    const convertToHeadersArray = (
+    // Parse newline-separated text into header objects, validating each line
+    // against the same rules enforced by the server. Returns either the
+    // parsed headers or an error message describing the first invalid line.
+    const parseHeaders = (
         newlineSeparated: string
-    ): { name: string; value: string }[] | null => {
-        if (!newlineSeparated || newlineSeparated.trim() === "") return [];
+    ):
+        | { headers: { name: string; value: string }[]; error: null }
+        | { headers: null; error: string } => {
+        if (!newlineSeparated || newlineSeparated.trim() === "") {
+            return { headers: [], error: null };
+        }
 
-        return newlineSeparated
+        const lines = newlineSeparated
             .split("\n")
             .map((line) => line.trim())
-            .filter((line) => line.length > 0 && line.includes(":"))
-            .map((line) => {
+            .filter((line) => line.length > 0);
+
+        const headers: { name: string; value: string }[] = [];
+
+        for (const line of lines) {
             const colonIndex = line.indexOf(":");
+            if (colonIndex === -1) {
+                return { headers: null, error: t("headersValidationError") };
+            }
+
             const name = line.substring(0, colonIndex).trim();
             const value = line.substring(colonIndex + 1).trim();
 
-                // Ensure header name conforms to HTTP header requirements
-                // Header names should be case-insensitive, contain only ASCII letters, digits, and hyphens
-                const normalizedName = name
-                    .replace(/[^a-zA-Z0-9\-]/g, "")
-                    .toLowerCase();
+            if (
+                !validHeaderNamePattern.test(name) ||
+                !validHeaderValuePattern.test(value) ||
+                templatePattern.test(name) ||
+                templatePattern.test(value)
+            ) {
+                return { headers: null, error: t("headersValidationError") };
+            }
 
-                return { name: normalizedName, value };
-            })
-            .filter((header) => header.name.length > 0); // Filter out headers with invalid names
+            headers.push({ name, value });
+        }
+
+        return { headers, error: null };
     };
 
     // Update internal value when external value changes
     // But only if the user is not currently editing (textarea not focused)
     useEffect(() => {
         if (!isUserEditingRef.current) {
-            setInternalValue(convertToNewlineSeparated(value));
+            setInternalValue(convertToNewlineSeparated(value ?? []));
+            setError(null);
+            onValidityChange?.(true);
         }
     }, [value]);
 
@@ -75,31 +106,20 @@ X-Another-Header: another-value`,
         // Mark that user is actively editing
         isUserEditingRef.current = true;
 
-        // Only update parent if the input is in a valid state
-        // Valid states: empty/whitespace only, or contains properly formatted headers
+        const result = parseHeaders(newValue);
 
-        if (newValue.trim() === "") {
-            // Empty input is valid - represents no headers
-            onChange([]);
-        } else {
-            // Check if all non-empty lines are properly formatted (contain ':')
-            const lines = newValue.split("\n");
-            const nonEmptyLines = lines
-                .map((line) => line.trim())
-                .filter((line) => line.length > 0);
-
-            // If there are no non-empty lines, or all non-empty lines contain ':', it's valid
-            const isValid =
-                nonEmptyLines.length === 0 ||
-                nonEmptyLines.every((line) => line.includes(":"));
-
-            if (isValid) {
-                // Safe to convert and update parent
-                const headersArray = convertToHeadersArray(newValue);
-                onChange(headersArray);
-            }
-            // If not valid, don't call onChange - let user continue typing
+        if (result.error) {
+            // Surface the error and do not touch the last known good value.
+            // Silently dropping the update here (without telling the user)
+            // is what previously let stale data get saved without warning.
+            setError(result.error);
+            onValidityChange?.(false);
+            return;
         }
+
+        setError(null);
+        onValidityChange?.(true);
+        onChange(result.headers);
     };
 
     const handleFocus = () => {
@@ -114,6 +134,7 @@ X-Another-Header: another-value`,
     };
 
     return (
+        <div>
             <Textarea
                 ref={textareaRef}
                 value={internalValue}
@@ -124,5 +145,9 @@ X-Another-Header: another-value`,
                 rows={rows}
                 className={className}
             />
+            {error && (
+                <p className="text-sm text-destructive mt-1.5">{error}</p>
+            )}
+        </div>
     );
 }

src/components/InfoSection.tsx

@@ -5,12 +5,15 @@ import { cn } from "@app/lib/cn";
 export function InfoSections({
     children,
     cols,
-    columnSizing = "content"
+    columnSizing = "content",
+    layout = "default"
 }: {
     children: React.ReactNode;
     cols?: number;
     /** content (default): fixed gap, columns hug content, left-aligned; fill: equal-width columns across the row */
     columnSizing?: "fill" | "content";
+    /** panel: 2 columns until xl for narrow containers such as side panels */
+    layout?: "default" | "panel";
 }) {
     const n = cols || 1;
     const track =
@@ -19,9 +22,14 @@ export function InfoSections({
     return (
         <div
             className={cn(
-                "grid w-full min-w-0 grid-cols-2 md:grid-cols-(--columns) md:space-x-16 gap-4 md:items-start",
+                "grid w-full min-w-0 gap-4",
+                layout === "panel"
+                    ? "grid-cols-2 xl:grid-cols-(--columns) xl:items-start xl:space-x-16"
+                    : "grid-cols-2 md:grid-cols-(--columns) md:items-start md:space-x-16",
                 columnSizing === "content" &&
-                    "md:justify-items-start md:justify-start"
+                    (layout === "panel"
+                        ? "xl:justify-items-start xl:justify-start"
+                        : "md:justify-items-start md:justify-start")
             )}
             style={{
                 // @ts-expect-error dynamic props don't work with tailwind, but we can set the

src/components/LabelsFilterSelector.tsx

@@ -11,7 +11,7 @@ import {
 import { launcherQueries, orgQueries } from "@app/lib/queries";
 import { useQuery } from "@tanstack/react-query";
 import { useTranslations } from "next-intl";
-import { useState } from "react";
+import { useMemo, useState } from "react";
 import { useDebounce } from "use-debounce";
 import { Checkbox } from "./ui/checkbox";
 
@@ -25,6 +25,7 @@ type LabelsFilterSelectorProps = {
     orgId: string;
     isSelected: (label: LabelFilterOption) => boolean;
     onToggle: (label: LabelFilterOption) => void;
+    selectedLabels?: LabelFilterOption[];
     onClear?: () => void;
     showClear?: boolean;
     scope?: "org" | "launcher";
@@ -34,6 +35,7 @@ export function LabelsFilterSelector({
     orgId,
     isSelected,
     onToggle,
+    selectedLabels = [],
     onClear,
     showClear = false,
     scope = "org"
@@ -54,7 +56,7 @@ export function LabelsFilterSelector({
         ...launcherQueries.labels({
             orgId,
             query: debouncedQuery,
-            perPage: 500
+            perPage: 20
         }),
         enabled: scope === "launcher"
     });
@@ -63,6 +65,18 @@ export function LabelsFilterSelector({
             ? (launcherLabelsQuery.data ?? [])
             : (orgLabelsQuery.data ?? []);
 
+    const labelsShown = useMemo(() => {
+        const base = [...labels];
+        if (debouncedQuery.trim().length === 0 && selectedLabels.length > 0) {
+            const selectedNotInBase = selectedLabels.filter(
+                (selected) =>
+                    !base.some((label) => label.labelId === selected.labelId)
+            );
+            return [...selectedNotInBase, ...base];
+        }
+        return base;
+    }, [debouncedQuery, labels, selectedLabels]);
+
     return (
         <Command shouldFilter={false}>
             <CommandInput
@@ -81,7 +95,7 @@ export function LabelsFilterSelector({
                             {t("accessFilterClear")}
                         </CommandItem>
                     )}
-                    {labels.map((label) => (
+                    {labelsShown.map((label) => (
                         <CommandItem
                             key={label.labelId}
                             value={label.name}

src/components/multi-site-selector.tsx

@@ -20,6 +20,8 @@ export type MultiSitesSelectorProps = {
     onSelectionChange: (sites: Selectedsite[]) => void;
     filterTypes?: string[];
     scope?: "org" | "launcher";
+    onClear?: () => void;
+    showClear?: boolean;
 };
 
 export function formatMultiSitesSelectorLabel(
@@ -42,7 +44,9 @@ export function MultiSitesSelector({
     selectedSites,
     onSelectionChange,
     filterTypes,
-    scope = "org"
+    scope = "org",
+    onClear,
+    showClear = false
 }: MultiSitesSelectorProps) {
     const t = useTranslations();
     const [siteSearchQuery, setSiteSearchQuery] = useState("");
@@ -60,7 +64,7 @@ export function MultiSitesSelector({
         ...launcherQueries.sites({
             orgId,
             query: debouncedQuery,
-            perPage: 500
+            perPage: 20
         }),
         enabled: scope === "launcher"
     });
@@ -107,6 +111,14 @@ export function MultiSitesSelector({
             <CommandList>
                 <CommandEmpty>{t("siteNotFound")}</CommandEmpty>
                 <CommandGroup>
+                    {showClear && onClear && (
+                        <CommandItem
+                            onSelect={onClear}
+                            className="text-muted-foreground"
+                        >
+                            {t("accessFilterClear")}
+                        </CommandItem>
+                    )}
                     {sitesShown.map((site) => (
                         <CommandItem
                             key={site.siteId}

src/components/resource-launcher/LauncherFilterPopover.tsx

@@ -10,6 +10,7 @@ import {
     type SelectedLabel
 } from "@app/components/labels-selector";
 import { LabelsFilterSelector } from "@app/components/LabelsFilterSelector";
+import { Badge } from "@app/components/ui/badge";
 import { Button } from "@app/components/ui/button";
 import {
     Popover,
@@ -46,14 +47,14 @@ export function LauncherFilterPopover({
     const { data: labels = [] } = useQuery(
         launcherQueries.labels({
             orgId,
-            perPage: 500
+            perPage: 20
         })
     );
 
     const { data: sites = [] } = useQuery(
         launcherQueries.sites({
             orgId,
-            perPage: 500
+            perPage: 20
         })
     );
 
@@ -96,14 +97,32 @@ export function LauncherFilterPopover({
         [labels, selectedLabels]
     );
 
+    const activeFilterCount = selectedSites.length + selectedLabels.length;
+
     return (
         <Popover modal={false}>
             <PopoverTrigger asChild>
-                <Button variant="outline" size="icon" className="shrink-0">
+                <Button
+                    variant="outline"
+                    size="icon"
+                    className="relative shrink-0"
+                >
                     <Funnel className="size-4" />
                     <span className="sr-only">
-                        {t("resourceLauncherFilter")}
+                        {activeFilterCount > 0
+                            ? t("resourceLauncherFilterWithCount", {
+                                  count: activeFilterCount
+                              })
+                            : t("resourceLauncherFilter")}
                     </span>
+                    {activeFilterCount > 0 && (
+                        <Badge
+                            variant="secondary"
+                            className="absolute -top-1 -right-1 flex h-5 min-w-5 items-center justify-center px-1.5 text-xs"
+                        >
+                            {activeFilterCount > 99 ? "99+" : activeFilterCount}
+                        </Badge>
+                    )}
                 </Button>
             </PopoverTrigger>
             <PopoverContent align="end" className="w-72">
@@ -139,6 +158,10 @@ export function LauncherFilterPopover({
                                     selectedSites={resolvedSelectedSites}
                                     onSelectionChange={onSitesChange}
                                     scope="launcher"
+                                    showClear={selectedSites.length > 0}
+                                    onClear={() => {
+                                        onSitesChange([]);
+                                    }}
                                 />
                             </PopoverContent>
                         </Popover>
@@ -172,6 +195,7 @@ export function LauncherFilterPopover({
                                 <LabelsFilterSelector
                                     orgId={orgId}
                                     scope="launcher"
+                                    selectedLabels={resolvedSelectedLabels}
                                     isSelected={(label) =>
                                         selectedLabelIds.has(label.labelId)
                                     }

src/components/resource-launcher/LauncherFlatResourceList.tsx

@@ -0,0 +1,125 @@
+"use client";
+
+import type { LauncherActiveViewId } from "@app/lib/launcherLocalStorage";
+import { hasActiveLauncherFilters } from "@app/lib/launcherScale";
+import { launcherQueries } from "@app/lib/queries";
+import type {
+    LauncherResource,
+    LauncherViewConfig
+} from "@server/routers/launcher/types";
+import { LAUNCHER_FLAT_GROUP_KEY } from "@server/routers/launcher/types";
+import { useInfiniteQuery } from "@tanstack/react-query";
+import { Loader2 } from "lucide-react";
+import { useEffect, useMemo, useRef } from "react";
+import { LauncherEmptyState } from "./LauncherEmptyState";
+import { LauncherResourceGrid } from "./LauncherResourceGrid";
+import { LauncherResourceList } from "./LauncherResourceList";
+
+type LauncherFlatResourceListProps = {
+    orgId: string;
+    activeViewId: LauncherActiveViewId;
+    config: LauncherViewConfig;
+    onClearFilters?: () => void;
+    onResourceSelect?: (resource: LauncherResource) => void;
+};
+
+export function LauncherFlatResourceList({
+    orgId,
+    config,
+    onClearFilters,
+    onResourceSelect
+}: LauncherFlatResourceListProps) {
+    const loadMoreRef = useRef<HTMLDivElement | null>(null);
+
+    const resourceFilters = useMemo(
+        () => ({
+            query: config.query,
+            groupBy: config.groupBy,
+            groupKey: LAUNCHER_FLAT_GROUP_KEY,
+            siteIds: config.siteIds,
+            labelIds: config.labelIds,
+            sort_by: config.sortBy,
+            order: config.order,
+            pageSize: 20
+        }),
+        [
+            config.groupBy,
+            config.labelIds,
+            config.order,
+            config.query,
+            config.siteIds,
+            config.sortBy
+        ]
+    );
+
+    const { data, fetchNextPage, hasNextPage, isFetchingNextPage, isFetching } =
+        useInfiniteQuery({
+            ...launcherQueries.resources(orgId, resourceFilters)
+        });
+
+    const resources = data?.pages.flatMap((page) => page.resources) ?? [];
+
+    useEffect(() => {
+        const node = loadMoreRef.current;
+        if (!node || !hasNextPage) {
+            return;
+        }
+
+        const observer = new IntersectionObserver(
+            (entries) => {
+                if (entries[0]?.isIntersecting && !isFetchingNextPage) {
+                    void fetchNextPage();
+                }
+            },
+            { rootMargin: "200px" }
+        );
+
+        observer.observe(node);
+        return () => observer.disconnect();
+    }, [fetchNextPage, hasNextPage, isFetchingNextPage]);
+
+    if (resources.length === 0) {
+        if (isFetching) {
+            return (
+                <div className="flex items-center justify-center py-16 text-muted-foreground">
+                    <Loader2 className="size-6 animate-spin" />
+                </div>
+            );
+        }
+
+        return (
+            <LauncherEmptyState
+                variant={
+                    hasActiveLauncherFilters(config) ? "noResults" : "empty"
+                }
+                layout={config.layout}
+                query={config.query}
+                onClearFilters={onClearFilters}
+            />
+        );
+    }
+
+    return (
+        <div className="flex flex-col gap-2.5">
+            {config.layout === "grid" ? (
+                <LauncherResourceGrid
+                    resources={resources}
+                    showLabels={config.showLabels}
+                    onResourceSelect={onResourceSelect}
+                />
+            ) : (
+                <LauncherResourceList
+                    resources={resources}
+                    showLabels={config.showLabels}
+                    onResourceSelect={onResourceSelect}
+                />
+            )}
+            <div ref={loadMoreRef} className="h-4" />
+            {isFetchingNextPage ? (
+                <div className="flex justify-center py-2">
+                    <Loader2 className="size-4 animate-spin text-muted-foreground" />
+                </div>
+            ) : null}
+        </div>
+    );
+}

src/components/resource-launcher/LauncherGroupList.tsx

@@ -69,6 +69,8 @@ export function LauncherGroupList({
     const { data, fetchNextPage, hasNextPage, isFetchingNextPage, isFetching } =
         useInfiniteQuery({
             ...launcherQueries.groups(orgId, groupFilters),
+            ...(initialGroups.length > 0
+                ? {
                       initialData: {
                           pages: [
                               {
@@ -78,7 +80,9 @@ export function LauncherGroupList({
                           ],
                           pageParams: [1]
                       },
-            refetchOnMount: false
+                      refetchOnMount: false as const
+                  }
+                : {})
         });
 
     const groups = data?.pages.flatMap((page) => page.groups) ?? [];

src/components/resource-launcher/LauncherRefreshButton.tsx

@@ -23,9 +23,8 @@ export function LauncherRefreshButton({
             className="shrink-0"
         >
             <RefreshCw
-                className={`mr-0 sm:mr-2 h-4 w-4 ${isRefreshing ? "animate-spin" : ""}`}
+                className={`size-4 ${isRefreshing ? "animate-spin" : ""}`}
             />
-            <span className="hidden sm:inline">{t("refresh")}</span>
         </Button>
     );
 }

src/components/resource-launcher/LauncherResourcePanel.tsx

@@ -1,17 +1,55 @@
 "use client";
 
+import CopyToClipboard from "@app/components/CopyToClipboard";
+import {
+    InfoSection,
+    InfoSectionContent,
+    InfoSections,
+    InfoSectionTitle
+} from "@app/components/InfoSection";
+import {
+    SettingsSection,
+    SettingsSectionBody,
+    SettingsSectionDescription,
+    SettingsSectionHeader,
+    SettingsSectionTitle
+} from "@app/components/Settings";
 import {
     SidePanel,
     SidePanelBody,
     SidePanelContent,
-    SidePanelDescription,
     SidePanelFooter,
     SidePanelHeader,
     SidePanelTitle
 } from "@app/components/SidePanel";
+import { Alert, AlertDescription, AlertTitle } from "@app/components/ui/alert";
 import { Button } from "@app/components/ui/button";
+import {
+    derivePublicAuthState,
+    formatPortRestrictionDisplay,
+    formatPublicResourceType
+} from "@app/lib/launcherResourceDetails";
 import { getLauncherResourceAdminHref } from "@app/lib/launcherResourceAdminHref";
+import {
+    formatSiteResourceDestinationDisplay,
+    isSafeUrlForLink
+} from "@app/lib/launcherResourceAccess";
+import { launcherQueries } from "@app/lib/queries";
 import type { LauncherResource } from "@server/routers/launcher/types";
+import type { GetResourceAuthInfoResponse } from "@server/routers/resource/getResourceAuthInfo";
+import type { GetResourceResponse } from "@server/routers/resource/getResource";
+import type { GetSiteResourceResponse } from "@server/routers/siteResource/getSiteResource";
+import { useQuery } from "@tanstack/react-query";
+import {
+    AlertCircle,
+    CheckCircle2,
+    Clock,
+    ExternalLink,
+    Loader2,
+    ShieldCheck,
+    ShieldOff,
+    XCircle
+} from "lucide-react";
 import { useTranslations } from "next-intl";
 import Link from "next/link";
 
@@ -23,6 +61,460 @@ type LauncherResourcePanelProps = {
     isAdmin: boolean;
 };
 
+type LauncherResourceDetailResult =
+    | {
+          resourceType: "public";
+          data: GetResourceResponse;
+          authInfo: GetResourceAuthInfoResponse;
+      }
+    | { resourceType: "site"; data: GetSiteResourceResponse };
+
+function AccessMethodContent({
+    accessDisplay,
+    accessCopyValue,
+    accessUrl
+}: {
+    accessDisplay: string;
+    accessCopyValue: string;
+    accessUrl?: string | null;
+}) {
+    if (!accessDisplay) {
+        return <span>-</span>;
+    }
+
+    const href = accessUrl ?? undefined;
+    const canLink = Boolean(href && isSafeUrlForLink(href));
+
+    if (canLink && href) {
+        return (
+            <CopyToClipboard
+                text={href}
+                displayText={accessDisplay}
+                isLink={true}
+                className="text-base"
+            />
+        );
+    }
+
+    return (
+        <CopyToClipboard
+            text={accessCopyValue || accessDisplay}
+            displayText={accessDisplay}
+            isLink={false}
+            className="text-base"
+        />
+    );
+}
+
+function HealthStatusDisplay({
+    health
+}: {
+    health: string | null | undefined;
+}) {
+    const t = useTranslations();
+    const status = health ?? "unknown";
+
+    if (status === "healthy") {
+        return (
+            <div className="flex items-center space-x-2">
+                <CheckCircle2 className="size-4 shrink-0 text-green-500" />
+                <span>{t("resourcesTableHealthy")}</span>
+            </div>
+        );
+    }
+
+    if (status === "degraded") {
+        return (
+            <div className="flex items-center space-x-2">
+                <CheckCircle2 className="size-4 shrink-0 text-yellow-500" />
+                <span>{t("resourcesTableDegraded")}</span>
+            </div>
+        );
+    }
+
+    if (status === "unhealthy") {
+        return (
+            <div className="flex items-center space-x-2">
+                <XCircle className="size-4 shrink-0 text-destructive" />
+                <span>{t("resourcesTableUnhealthy")}</span>
+            </div>
+        );
+    }
+
+    return (
+        <div className="flex items-center space-x-2">
+            <Clock className="size-4 shrink-0 text-muted-foreground" />
+            <span>{t("resourcesTableUnknown")}</span>
+        </div>
+    );
+}
+
+const PUBLIC_AUTH_BROWSER_MODES = ["http", "ssh", "rdp", "vnc"];
+
+function AuthMethodStatusDisplay({ enabled }: { enabled: boolean }) {
+    const t = useTranslations();
+
+    return (
+        <div className="flex items-center gap-2">
+            {enabled ? (
+                <CheckCircle2 className="size-4 text-green-600" />
+            ) : (
+                <XCircle className="size-4 text-red-600" />
+            )}
+            <span>{enabled ? t("enabled") : t("disabled")}</span>
+        </div>
+    );
+}
+
+function PublicResourceAuthMethods({
+    authInfo
+}: {
+    authInfo: GetResourceAuthInfoResponse;
+}) {
+    const t = useTranslations();
+
+    const authMethods = [
+        {
+            key: "sso",
+            title: t("policyAuthSsoTitle"),
+            enabled: authInfo.sso
+        },
+        {
+            key: "password",
+            title: t("policyAuthPasscodeTitle"),
+            enabled: authInfo.password
+        },
+        {
+            key: "pincode",
+            title: t("policyAuthPincodeTitle"),
+            enabled: authInfo.pincode
+        },
+        {
+            key: "whitelist",
+            title: t("policyAuthEmailTitle"),
+            enabled: authInfo.whitelist
+        },
+        {
+            key: "headerAuth",
+            title: t("policyAuthHeaderAuthTitle"),
+            enabled: authInfo.headerAuth
+        }
+    ];
+
+    return (
+        <SettingsSection>
+            <SettingsSectionHeader>
+                <SettingsSectionTitle>
+                    {t("authentication")}
+                </SettingsSectionTitle>
+                <SettingsSectionDescription>
+                    {t("resourceLauncherAuthMethodsDescription")}
+                </SettingsSectionDescription>
+            </SettingsSectionHeader>
+            <SettingsSectionBody>
+                <InfoSections cols={authMethods.length} layout="panel">
+                    {authMethods.map((method) => (
+                        <InfoSection key={method.key}>
+                            <InfoSectionTitle>{method.title}</InfoSectionTitle>
+                            <InfoSectionContent>
+                                <AuthMethodStatusDisplay
+                                    enabled={method.enabled}
+                                />
+                            </InfoSectionContent>
+                        </InfoSection>
+                    ))}
+                </InfoSections>
+            </SettingsSectionBody>
+        </SettingsSection>
+    );
+}
+
+function PublicResourceDetails({
+    launcherResource,
+    resource,
+    authInfo
+}: {
+    launcherResource: LauncherResource;
+    resource: GetResourceResponse;
+    authInfo: GetResourceAuthInfoResponse;
+}) {
+    const t = useTranslations();
+    const supportsAuth = PUBLIC_AUTH_BROWSER_MODES.includes(
+        resource.mode || ""
+    );
+    const authState = derivePublicAuthState(resource.mode, authInfo);
+    const infoSectionCount = supportsAuth ? 4 : 3;
+
+    return (
+        <div className="space-y-4">
+            <SettingsSection>
+                <SettingsSectionHeader>
+                    <SettingsSectionTitle>
+                        {t("resourceLauncherResourceDetails")}
+                    </SettingsSectionTitle>
+                    <SettingsSectionDescription>
+                        {t("resourceLauncherResourceDetailsDescription")}
+                    </SettingsSectionDescription>
+                </SettingsSectionHeader>
+                <SettingsSectionBody>
+                    <InfoSections cols={infoSectionCount} layout="panel">
+                        <InfoSection>
+                            <InfoSectionTitle>{t("type")}</InfoSectionTitle>
+                            <InfoSectionContent>
+                                {formatPublicResourceType(resource)}
+                            </InfoSectionContent>
+                        </InfoSection>
+                        <InfoSection>
+                            <InfoSectionTitle>{t("access")}</InfoSectionTitle>
+                            <InfoSectionContent>
+                                <AccessMethodContent
+                                    accessDisplay={
+                                        launcherResource.accessDisplay
+                                    }
+                                    accessCopyValue={
+                                        launcherResource.accessCopyValue
+                                    }
+                                    accessUrl={launcherResource.accessUrl}
+                                />
+                            </InfoSectionContent>
+                        </InfoSection>
+                        {supportsAuth ? (
+                            <InfoSection>
+                                <InfoSectionTitle>
+                                    {t("authentication")}
+                                </InfoSectionTitle>
+                                <InfoSectionContent>
+                                    {authState === "protected" ? (
+                                        <div className="flex items-center space-x-2">
+                                            <ShieldCheck className="size-4 shrink-0 text-green-500" />
+                                            <span>{t("protected")}</span>
+                                        </div>
+                                    ) : (
+                                        <div className="flex items-center space-x-2">
+                                            <ShieldOff className="size-4 shrink-0 text-yellow-500" />
+                                            <span>{t("notProtected")}</span>
+                                        </div>
+                                    )}
+                                </InfoSectionContent>
+                            </InfoSection>
+                        ) : null}
+                        <InfoSection>
+                            <InfoSectionTitle>{t("health")}</InfoSectionTitle>
+                            <InfoSectionContent>
+                                <HealthStatusDisplay health={resource.health} />
+                            </InfoSectionContent>
+                        </InfoSection>
+                    </InfoSections>
+                </SettingsSectionBody>
+            </SettingsSection>
+            {supportsAuth ? (
+                <PublicResourceAuthMethods authInfo={authInfo} />
+            ) : null}
+        </div>
+    );
+}
+
+function PrivateResourceDetails({
+    launcherResource,
+    resource
+}: {
+    launcherResource: LauncherResource;
+    resource: GetSiteResourceResponse;
+}) {
+    const t = useTranslations();
+    const modeLabel: Record<GetSiteResourceResponse["mode"], string> = {
+        host: t("editInternalResourceDialogModeHost"),
+        cidr: t("editInternalResourceDialogModeCidr"),
+        http: t("editInternalResourceDialogModeHttp"),
+        ssh: t("editInternalResourceDialogModeSsh")
+    };
+    const destination = formatSiteResourceDestinationDisplay({
+        mode: resource.mode,
+        destination: resource.destination,
+        destinationPort: resource.destinationPort,
+        scheme: resource.scheme
+    });
+    const portRestrictions = formatPortRestrictionDisplay(resource);
+    const showAlias = resource.mode !== "cidr" && resource.mode !== "http";
+    const showDestination = !(
+        resource.mode === "ssh" && resource.authDaemonMode === "native"
+    );
+    const infoSectionCount =
+        2 + (showDestination ? 1 : 0) + (showAlias ? 1 : 0) + 1;
+
+    return (
+        <div className="space-y-4">
+            <Alert variant="default">
+                <AlertCircle className="size-4" />
+                <AlertTitle>
+                    {t("resourceLauncherPrivateClientRequiredTitle")}
+                </AlertTitle>
+                <AlertDescription>
+                    <span>
+                        {t("resourceLauncherPrivateClientRequired")}{" "}
+                        <a
+                            href="https://pangolin.net/downloads"
+                            target="_blank"
+                            rel="noopener noreferrer"
+                            className="inline-flex items-center gap-1 text-primary hover:underline"
+                        >
+                            {t("resourceLauncherDownloadClient")}
+                            <ExternalLink className="size-3.5 shrink-0" />
+                        </a>
+                    </span>
+                </AlertDescription>
+            </Alert>
+
+            <SettingsSection>
+                <SettingsSectionHeader>
+                    <SettingsSectionTitle>
+                        {t("resourceLauncherResourceDetails")}
+                    </SettingsSectionTitle>
+                    <SettingsSectionDescription>
+                        {t("resourceLauncherResourceDetailsDescription")}
+                    </SettingsSectionDescription>
+                </SettingsSectionHeader>
+                <SettingsSectionBody>
+                    <InfoSections cols={infoSectionCount} layout="panel">
+                        <InfoSection>
+                            <InfoSectionTitle>{t("type")}</InfoSectionTitle>
+                            <InfoSectionContent>
+                                {modeLabel[resource.mode]}
+                            </InfoSectionContent>
+                        </InfoSection>
+                        <InfoSection>
+                            <InfoSectionTitle>{t("access")}</InfoSectionTitle>
+                            <InfoSectionContent>
+                                <AccessMethodContent
+                                    accessDisplay={
+                                        launcherResource.accessDisplay
+                                    }
+                                    accessCopyValue={
+                                        launcherResource.accessCopyValue
+                                    }
+                                    accessUrl={launcherResource.accessUrl}
+                                />
+                            </InfoSectionContent>
+                        </InfoSection>
+                        {showDestination ? (
+                            <InfoSection>
+                                <InfoSectionTitle>
+                                    {t("editInternalResourceDialogDestination")}
+                                </InfoSectionTitle>
+                                <InfoSectionContent>
+                                    {destination || "-"}
+                                </InfoSectionContent>
+                            </InfoSection>
+                        ) : null}
+                        {showAlias ? (
+                            <InfoSection>
+                                <InfoSectionTitle>
+                                    {t("editInternalResourceDialogAlias")}
+                                </InfoSectionTitle>
+                                <InfoSectionContent>
+                                    {resource.alias?.trim()
+                                        ? resource.alias
+                                        : "-"}
+                                </InfoSectionContent>
+                            </InfoSection>
+                        ) : null}
+                        <InfoSection>
+                            <InfoSectionTitle>
+                                {t("portRestrictions")}
+                            </InfoSectionTitle>
+                            <InfoSectionContent>
+                                {!portRestrictions.hasNonDefaultPorts ? (
+                                    <span>
+                                        {t(
+                                            "resourceLauncherNoPortRestrictions"
+                                        )}
+                                    </span>
+                                ) : (
+                                    <div className="space-y-1">
+                                        {portRestrictions.tcp.state !==
+                                        "all" ? (
+                                            <div>
+                                                {t("resourceLauncherTcp")}:{" "}
+                                                {portRestrictions.tcp.state ===
+                                                "blocked"
+                                                    ? t("blocked")
+                                                    : portRestrictions.tcp
+                                                          .ports}
+                                            </div>
+                                        ) : null}
+                                        {portRestrictions.udp.state !==
+                                        "all" ? (
+                                            <div>
+                                                {t("resourceLauncherUdp")}:{" "}
+                                                {portRestrictions.udp.state ===
+                                                "blocked"
+                                                    ? t("blocked")
+                                                    : portRestrictions.udp
+                                                          .ports}
+                                            </div>
+                                        ) : null}
+                                    </div>
+                                )}
+                            </InfoSectionContent>
+                        </InfoSection>
+                    </InfoSections>
+                </SettingsSectionBody>
+            </SettingsSection>
+        </div>
+    );
+}
+
+function LauncherResourcePanelBody({
+    orgId,
+    resource,
+    open
+}: {
+    orgId: string;
+    resource: LauncherResource;
+    open: boolean;
+}) {
+    const t = useTranslations();
+    const { data, isPending, isError } = useQuery({
+        ...launcherQueries.resourceDetail(orgId, resource),
+        enabled: open
+    });
+
+    if (isPending) {
+        return (
+            <div className="flex items-center justify-center py-12 text-muted-foreground">
+                <Loader2 className="size-6 animate-spin" />
+            </div>
+        );
+    }
+
+    if (isError || !data) {
+        return (
+            <p className="text-sm text-muted-foreground">
+                {t("resourceLauncherFailedToLoadDetails")}
+            </p>
+        );
+    }
+
+    const detail = data as LauncherResourceDetailResult;
+
+    if (detail.resourceType === "public") {
+        return (
+            <PublicResourceDetails
+                launcherResource={resource}
+                resource={detail.data}
+                authInfo={detail.authInfo}
+            />
+        );
+    }
+
+    return (
+        <PrivateResourceDetails
+            launcherResource={resource}
+            resource={detail.data}
+        />
+    );
+}
+
 export function LauncherResourcePanel({
     open,
     onOpenChange,
@@ -37,11 +529,16 @@ export function LauncherResourcePanel({
             <SidePanelContent>
                 <SidePanelHeader>
                     <SidePanelTitle>{resource?.name ?? ""}</SidePanelTitle>
-                    <SidePanelDescription>
-                        {t("resourceLauncherResourceDetailsDescription")}
-                    </SidePanelDescription>
                 </SidePanelHeader>
-                <SidePanelBody />
+                <SidePanelBody>
+                    {resource ? (
+                        <LauncherResourcePanelBody
+                            orgId={orgId}
+                            resource={resource}
+                            open={open}
+                        />
+                    ) : null}
+                </SidePanelBody>
                 <SidePanelFooter>
                     <Button
                         variant="outline"

src/components/resource-launcher/LauncherSearchFirstGate.tsx

@@ -0,0 +1,86 @@
+"use client";
+
+import { cn } from "@app/lib/cn";
+import { Search } from "lucide-react";
+import { useTranslations } from "next-intl";
+
+type LauncherSearchFirstGateProps = {
+    layout: "grid" | "list";
+};
+
+function GhostResourceGrid() {
+    return (
+        <div
+            className="grid w-full grid-cols-1 gap-2.5 sm:grid-cols-2 lg:grid-cols-3 xl:grid-cols-4 [&>*]:min-w-0"
+            aria-hidden
+        >
+            {Array.from({ length: 4 }).map((_, index) => (
+                <div
+                    key={index}
+                    className="flex min-w-0 flex-col gap-2.5 rounded-xl border border-border/60 bg-muted/20 p-4"
+                >
+                    <div className="flex items-center gap-5">
+                        <div className="size-10 shrink-0 rounded-lg bg-muted/60" />
+                        <div className="flex min-w-0 flex-1 flex-col gap-1.5">
+                            <div className="h-3.5 w-3/5 rounded bg-muted/60" />
+                            <div className="h-3 w-2/5 rounded bg-muted/40" />
+                        </div>
+                    </div>
+                </div>
+            ))}
+        </div>
+    );
+}
+
+function GhostResourceList() {
+    return (
+        <div className="flex w-full flex-col" aria-hidden>
+            {Array.from({ length: 3 }).map((_, index) => (
+                <div
+                    key={index}
+                    className={cn(
+                        "flex items-center gap-4 px-4 py-3",
+                        index < 2 && "border-b border-border/60"
+                    )}
+                >
+                    <div className="size-8 shrink-0 rounded-lg bg-muted/60" />
+                    <div className="flex min-w-0 flex-1 flex-col gap-1.5">
+                        <div className="h-3.5 w-2/5 rounded bg-muted/60" />
+                        <div className="h-3 w-1/4 rounded bg-muted/40" />
+                    </div>
+                </div>
+            ))}
+        </div>
+    );
+}
+
+export function LauncherSearchFirstGate({
+    layout
+}: LauncherSearchFirstGateProps) {
+    const t = useTranslations();
+
+    return (
+        <div className="relative w-full overflow-hidden rounded-xl border border-dashed border-border">
+            <div className="pointer-events-none absolute inset-0 opacity-50">
+                {layout === "grid" ? (
+                    <GhostResourceGrid />
+                ) : (
+                    <GhostResourceList />
+                )}
+            </div>
+            <div className="relative flex min-h-56 flex-col items-center justify-center gap-4 px-6 py-12 text-center">
+                <div className="flex size-12 items-center justify-center rounded-full bg-muted">
+                    <Search className="size-5 text-muted-foreground" />
+                </div>
+                <div className="max-w-md space-y-1.5">
+                    <h3 className="text-base font-semibold text-foreground">
+                        {t("resourceLauncherSearchFirstTitle")}
+                    </h3>
+                    <p className="text-sm text-muted-foreground">
+                        {t("resourceLauncherSearchFirstDescription")}
+                    </p>
+                </div>
+            </div>
+        </div>
+    );
+}

src/components/resource-launcher/LauncherSettingsMenu.tsx

@@ -15,22 +15,27 @@ import {
     SelectValue
 } from "@app/components/ui/select";
 import { Switch } from "@app/components/ui/switch";
-import type { LauncherViewConfig } from "@server/routers/launcher/types";
+import type {
+    LauncherScaleCapabilities,
+    LauncherViewConfig
+} from "@server/routers/launcher/types";
 import { useTranslations } from "next-intl";
 import { Settings } from "lucide-react";
 
 type LauncherSettingsMenuProps = {
     config: LauncherViewConfig;
-    isDefaultView: boolean;
+    capabilities: LauncherScaleCapabilities;
+    isCompactMode: boolean;
+    selectedGroupBy: LauncherViewConfig["groupBy"];
     onConfigChange: (patch: Partial<LauncherViewConfig>) => void;
-    onDeleteView: () => void;
 };
 
 export function LauncherSettingsMenu({
     config,
-    isDefaultView,
-    onConfigChange,
-    onDeleteView
+    capabilities,
+    isCompactMode,
+    selectedGroupBy,
+    onConfigChange
 }: LauncherSettingsMenuProps) {
     const t = useTranslations();
 
@@ -51,7 +56,7 @@ export function LauncherSettingsMenu({
                             {t("resourceLauncherGroupBy")}
                         </p>
                         <Select
-                            value={config.groupBy}
+                            value={selectedGroupBy}
                             onValueChange={(value) =>
                                 onConfigChange({
                                     groupBy:
@@ -63,14 +68,46 @@ export function LauncherSettingsMenu({
                                 <SelectValue />
                             </SelectTrigger>
                             <SelectContent>
-                                <SelectItem value="site">
+                                <SelectItem value="none">
+                                    {t("resourceLauncherGroupByNone")}
+                                </SelectItem>
+                                <SelectItem
+                                    value="site"
+                                    disabled={
+                                        !capabilities.allowSiteGrouping ||
+                                        (isCompactMode &&
+                                            config.siteIds.length === 0)
+                                    }
+                                >
                                     {t("resourceLauncherGroupBySite")}
                                 </SelectItem>
-                                <SelectItem value="label">
+                                <SelectItem
+                                    value="label"
+                                    disabled={
+                                        !capabilities.allowLabelGrouping ||
+                                        (isCompactMode &&
+                                            config.labelIds.length === 0)
+                                    }
+                                >
                                     {t("resourceLauncherGroupByLabel")}
                                 </SelectItem>
                             </SelectContent>
                         </Select>
+                        {isCompactMode ? (
+                            <p className="text-xs text-muted-foreground">
+                                {t("resourceLauncherCompactGroupingHint")}
+                            </p>
+                        ) : null}
+                        {!isCompactMode && !capabilities.allowSiteGrouping ? (
+                            <p className="text-xs text-muted-foreground">
+                                {t("resourceLauncherSiteGroupingDisabled")}
+                            </p>
+                        ) : null}
+                        {!isCompactMode && !capabilities.allowLabelGrouping ? (
+                            <p className="text-xs text-muted-foreground">
+                                {t("resourceLauncherLabelGroupingDisabled")}
+                            </p>
+                        ) : null}
                     </div>
 
                     <div className="space-y-2">
@@ -116,16 +153,6 @@ export function LauncherSettingsMenu({
                             />
                         </div>
                     </div>
-
-                    {!isDefaultView ? (
-                        <Button
-                            variant="destructive"
-                            className="w-full rounded-xl"
-                            onClick={onDeleteView}
-                        >
-                            {t("resourceLauncherDeleteView")}
-                        </Button>
-                    ) : null}
                 </div>
             </PopoverContent>
         </Popover>

src/components/resource-launcher/LauncherViewTabs.tsx

@@ -68,11 +68,14 @@ type LauncherSaveViewMenuProps = {
     isAdmin: boolean;
     isOrgWideView: boolean;
     hasUnsavedChanges: boolean;
+    canResetSystemDefault: boolean;
     onSaveToCurrent: () => void;
     onSaveAsNew: () => void;
     onSaveForEveryone: () => void;
     onMakePersonal: () => void;
     onResetView: () => void;
+    onResetSystemDefault: () => void;
+    onDeleteView: () => void;
 };
 
 export function LauncherSaveViewMenu({
@@ -80,13 +83,17 @@ export function LauncherSaveViewMenu({
     isAdmin,
     isOrgWideView,
     hasUnsavedChanges,
+    canResetSystemDefault,
     onSaveToCurrent,
     onSaveAsNew,
     onSaveForEveryone,
     onMakePersonal,
-    onResetView
+    onResetView,
+    onResetSystemDefault,
+    onDeleteView
 }: LauncherSaveViewMenuProps) {
     const t = useTranslations();
+    const canDeleteView = !isDefaultView && (isAdmin || !isOrgWideView);
 
     return (
         <DropdownMenu>
@@ -108,7 +115,26 @@ export function LauncherSaveViewMenu({
                         <DropdownMenuSeparator />
                     </>
                 ) : null}
-                {!isDefaultView && (isAdmin || !isOrgWideView) ? (
+                {isDefaultView && canResetSystemDefault ? (
+                    <>
+                        <DropdownMenuItem onSelect={onResetSystemDefault}>
+                            {t("resourceLauncherResetSystemDefault")}
+                        </DropdownMenuItem>
+                        <DropdownMenuSeparator />
+                    </>
+                ) : null}
+                {isDefaultView && hasUnsavedChanges ? (
+                    <>
+                        <DropdownMenuItem onSelect={onSaveToCurrent}>
+                            {t("resourceLauncherSaveDefaultPersonal")}
+                        </DropdownMenuItem>
+                        {isAdmin ? (
+                            <DropdownMenuItem onSelect={onSaveForEveryone}>
+                                {t("resourceLauncherSaveForEveryone")}
+                            </DropdownMenuItem>
+                        ) : null}
+                    </>
+                ) : !isDefaultView && (isAdmin || !isOrgWideView) ? (
                     <DropdownMenuItem onSelect={onSaveToCurrent}>
                         {t("resourceLauncherSaveToCurrentView")}
                     </DropdownMenuItem>
@@ -126,6 +152,17 @@ export function LauncherSaveViewMenu({
                         {t("resourceLauncherMakePersonal")}
                     </DropdownMenuItem>
                 ) : null}
+                {canDeleteView ? (
+                    <>
+                        <DropdownMenuSeparator />
+                        <DropdownMenuItem
+                            onSelect={onDeleteView}
+                            className="text-destructive focus:text-destructive"
+                        >
+                            {t("resourceLauncherDeleteView")}
+                        </DropdownMenuItem>
+                    </>
+                ) : null}
             </DropdownMenuContent>
         </DropdownMenu>
     );

src/components/resource-launcher/ResourceLauncher.tsx

@@ -29,12 +29,23 @@ import {
 } from "@app/lib/launcherUrlState";
 import { useToast } from "@app/hooks/useToast";
 import { useEnvContext } from "@app/hooks/useEnvContext";
-import type {
-    LauncherGroup,
-    LauncherViewConfig,
-    LauncherViewRecord
+import {
+    getEffectiveLauncherConfig,
+    shouldShowFlatResourceList,
+    shouldShowLauncherGroupList,
+    shouldShowSearchFirstGate
+} from "@app/lib/launcherScale";
+import { launcherQueries } from "@app/lib/queries";
+import {
+    getEffectiveDefaultLauncherConfig,
+    type LauncherDefaultViewOverrides,
+    type LauncherGroup,
+    type LauncherResource,
+    type LauncherScaleInfo,
+    type LauncherViewConfig,
+    type LauncherViewRecord
 } from "@server/routers/launcher/types";
-import { useMutation } from "@tanstack/react-query";
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import { Search } from "lucide-react";
 import { useTranslations } from "next-intl";
 import { useRouter } from "next/navigation";
@@ -52,20 +63,26 @@ import type { SelectedLabel } from "@app/components/labels-selector";
 import { useMediaQuery } from "@app/hooks/useMediaQuery";
 import { cn } from "@app/lib/cn";
 import { LauncherFilterPopover } from "./LauncherFilterPopover";
+import { LauncherFlatResourceList } from "./LauncherFlatResourceList";
 import { LauncherGroupList } from "./LauncherGroupList";
+import { LauncherSearchFirstGate } from "./LauncherSearchFirstGate";
 import { LauncherRefreshButton } from "./LauncherRefreshButton";
+import { LauncherResourcePanel } from "./LauncherResourcePanel";
 import { LauncherSettingsMenu } from "./LauncherSettingsMenu";
 import { LauncherSortButton } from "./LauncherSortButton";
 import { LauncherSaveViewMenu, LauncherViewTabs } from "./LauncherViewTabs";
+import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
 import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
 
 type ResourceLauncherProps = {
     orgId: string;
     isAdmin: boolean;
     views: LauncherViewRecord[];
+    defaultViewOverrides: LauncherDefaultViewOverrides;
     activeViewId: LauncherActiveViewId;
     config: LauncherViewConfig;
     savedConfig: LauncherViewConfig;
+    scale: LauncherScaleInfo;
     groups: LauncherGroup[];
     groupsPagination: {
         total: number;
@@ -78,9 +95,11 @@ export default function ResourceLauncher({
     orgId,
     isAdmin,
     views,
+    defaultViewOverrides,
     activeViewId,
     config,
     savedConfig,
+    scale: initialScale,
     groups,
     groupsPagination
 }: ResourceLauncherProps) {
@@ -88,6 +107,7 @@ export default function ResourceLauncher({
     const { toast } = useToast();
     const { env } = useEnvContext();
     const api = createApiClient({ env });
+    const queryClient = useQueryClient();
     const router = useRouter();
     const { navigate, isNavigating, searchParams } = useNavigationContext();
     const [isRefreshing, startRefreshTransition] = useTransition();
@@ -95,11 +115,47 @@ export default function ResourceLauncher({
 
     const [searchInputResetKey, setSearchInputResetKey] = useState(0);
     const [saveDialogOpen, setSaveDialogOpen] = useState(false);
+    const [deleteDialogOpen, setDeleteDialogOpen] = useState(false);
     const [newViewName, setNewViewName] = useState("");
     const [saveOrgWide, setSaveOrgWide] = useState(false);
+    const [selectedResource, setSelectedResource] =
+        useState<LauncherResource | null>(null);
+    const [panelOpen, setPanelOpen] = useState(false);
 
     const isDesktop = useMediaQuery("(min-width: 768px)");
 
+    const scaleFilters = useMemo(
+        () => ({
+            query: config.query,
+            groupBy: config.groupBy,
+            siteIds: config.siteIds,
+            labelIds: config.labelIds,
+            sort_by: config.sortBy,
+            order: config.order
+        }),
+        [
+            config.groupBy,
+            config.labelIds,
+            config.order,
+            config.query,
+            config.siteIds,
+            config.sortBy
+        ]
+    );
+
+    const { data: scale = initialScale } = useQuery({
+        ...launcherQueries.scale(orgId, scaleFilters),
+        initialData: initialScale
+    });
+
+    const showGroupList = shouldShowLauncherGroupList(scale, config);
+    const showSearchFirstGate = shouldShowSearchFirstGate(scale, config);
+    const showFlatResourceList = shouldShowFlatResourceList(scale, config);
+    const effectiveConfig = useMemo(
+        () => getEffectiveLauncherConfig(scale, config),
+        [config, scale]
+    );
+
     const configRef = useRef(config);
     configRef.current = config;
     const searchInputRef = useRef(config.query);
@@ -129,13 +185,24 @@ export default function ResourceLauncher({
             return;
         }
 
-        const baseConfig = getLauncherUrlBaseConfig(lastView, views);
+        const baseConfig = getLauncherUrlBaseConfig(
+            lastView,
+            views,
+            defaultViewOverrides
+        );
         const params = serializeLauncherUrlState({
             viewId: lastView,
             config: baseConfig
         });
         navigate({ searchParams: params, replace: true });
-    }, [activeViewId, navigate, orgId, searchParams, views]);
+    }, [
+        activeViewId,
+        defaultViewOverrides,
+        navigate,
+        orgId,
+        searchParams,
+        views
+    ]);
 
     const navigateToConfig = useCallback(
         (viewId: LauncherActiveViewId, nextConfig: LauncherViewConfig) => {
@@ -158,10 +225,14 @@ export default function ResourceLauncher({
     const selectView = useCallback(
         (viewId: LauncherActiveViewId) => {
             writeLauncherLastView(orgId, viewId);
-            const baseConfig = getLauncherUrlBaseConfig(viewId, views);
+            const baseConfig = getLauncherUrlBaseConfig(
+                viewId,
+                views,
+                defaultViewOverrides
+            );
             navigateToConfig(viewId, baseConfig);
         },
-        [navigateToConfig, orgId, views]
+        [defaultViewOverrides, navigateToConfig, orgId, views]
     );
 
     const activeSavedView = useMemo(
@@ -175,6 +246,10 @@ export default function ResourceLauncher({
     const isDefaultView = activeViewId === "default";
     const isOrgWideView = Boolean(activeSavedView?.isOrgWide);
     const hasUnsavedChanges = !isLauncherConfigEqual(config, savedConfig);
+    const canResetSystemDefault =
+        isDefaultView &&
+        (Boolean(defaultViewOverrides.personal) ||
+            (isAdmin && Boolean(defaultViewOverrides.orgWide)));
 
     const selectedSites: Selectedsite[] = useMemo(
         () =>
@@ -270,6 +345,87 @@ export default function ResourceLauncher({
         }
     });
 
+    const saveDefaultViewMutation = useMutation({
+        mutationFn: async (payload: {
+            config: LauncherViewConfig;
+            orgWide: boolean;
+        }) => {
+            const res = await api.put(
+                `/org/${orgId}/launcher/default-view`,
+                payload
+            );
+            return res.data.data as LauncherViewRecord;
+        },
+        onSuccess: () => {
+            writeLauncherLastView(orgId, "default");
+            const params = serializeLauncherUrlState({
+                viewId: "default",
+                config
+            });
+            navigate({ searchParams: params, replace: true });
+            router.refresh();
+            toast({
+                title: t("resourceLauncherViewSaved"),
+                description: t("resourceLauncherViewSavedDescription")
+            });
+        },
+        onError: (error) => {
+            toast({
+                variant: "destructive",
+                title: t("resourceLauncherViewSaveFailed"),
+                description: formatAxiosError(
+                    error,
+                    t("resourceLauncherViewSaveFailedDescription")
+                )
+            });
+        }
+    });
+
+    const resetSystemDefaultMutation = useMutation({
+        mutationFn: async () => {
+            const resetAll = isAdmin && Boolean(defaultViewOverrides.orgWide);
+            await api.delete(`/org/${orgId}/launcher/default-view`, {
+                data: resetAll ? { all: true } : { orgWide: false }
+            });
+        },
+        onSuccess: () => {
+            writeLauncherLastView(orgId, "default");
+            const nextOverrides: LauncherDefaultViewOverrides = {
+                personal: null,
+                orgWide:
+                    isAdmin && defaultViewOverrides.orgWide
+                        ? null
+                        : defaultViewOverrides.orgWide
+            };
+            const targetConfig =
+                getEffectiveDefaultLauncherConfig(nextOverrides);
+            searchInputRef.current = targetConfig.query;
+            setSearchInputResetKey((key) => key + 1);
+            const params = serializeLauncherUrlState({
+                viewId: "default",
+                config: targetConfig
+            });
+            navigate({ searchParams: params, replace: true });
+            router.refresh();
+            toast({
+                title: t("resourceLauncherSystemDefaultRestored"),
+                description: t(
+                    "resourceLauncherSystemDefaultRestoredDescription"
+                )
+            });
+        },
+        onError: (error) => {
+            toast({
+                variant: "destructive",
+                title: t("resourceLauncherViewSaveFailed"),
+                description: formatAxiosError(
+                    error,
+                    t("resourceLauncherViewSaveFailedDescription")
+                )
+            });
+        }
+    });
+
     const deleteViewMutation = useMutation({
         mutationFn: async (viewId: number) => {
             await api.delete(`/org/${orgId}/launcher/views/${viewId}`);
@@ -278,7 +434,11 @@ export default function ResourceLauncher({
             writeLauncherLastView(orgId, "default");
             const params = serializeLauncherUrlState({
                 viewId: "default",
-                config: getLauncherUrlBaseConfig("default", views)
+                config: getLauncherUrlBaseConfig(
+                    "default",
+                    views,
+                    defaultViewOverrides
+                )
             });
             navigate({ searchParams: params, replace: true });
             router.refresh();
@@ -328,9 +488,17 @@ export default function ResourceLauncher({
         navigateToConfig(activeViewIdRef.current, savedConfig);
     }, [navigateToConfig, savedConfig]);
 
+    const handleResetSystemDefault = useCallback(() => {
+        resetSystemDefaultMutation.mutate();
+    }, [resetSystemDefaultMutation]);
+
     const refreshData = () => {
         startRefreshTransition(async () => {
             try {
+                await api.post(`/org/${orgId}/launcher/invalidate-cache`);
+                await queryClient.invalidateQueries({
+                    queryKey: ["ORG", orgId, "LAUNCHER"]
+                });
                 router.refresh();
             } catch {
                 toast({
@@ -343,7 +511,14 @@ export default function ResourceLauncher({
     };
 
     const handleSaveToCurrent = () => {
-        if (isDefaultView || (isOrgWideView && !isAdmin)) {
+        if (isDefaultView) {
+            saveDefaultViewMutation.mutate({
+                config,
+                orgWide: false
+            });
+            return;
+        }
+        if (isOrgWideView && !isAdmin) {
             return;
         }
         updateViewMutation.mutate({
@@ -360,6 +535,10 @@ export default function ResourceLauncher({
 
     const handleSaveForEveryone = () => {
         if (isDefaultView) {
+            saveDefaultViewMutation.mutate({
+                config,
+                orgWide: true
+            });
             return;
         }
         updateViewMutation.mutate({
@@ -389,6 +568,18 @@ export default function ResourceLauncher({
         });
     };
 
+    const handleResourceSelect = useCallback((resource: LauncherResource) => {
+        setSelectedResource(resource);
+        setPanelOpen(true);
+    }, []);
+
+    const handlePanelOpenChange = useCallback((open: boolean) => {
+        setPanelOpen(open);
+        if (!open) {
+            setSelectedResource(null);
+        }
+    }, []);
+
     const savedViewTabs = views.map((view) => ({
         viewId: view.viewId,
         name: view.name
@@ -412,19 +603,8 @@ export default function ResourceLauncher({
         </div>
     );
 
-    const renderToolbarActions = () => (
+    const renderToolbarFilterSort = () => (
         <>
-            <LauncherSaveViewMenu
-                isDefaultView={isDefaultView}
-                isAdmin={isAdmin}
-                isOrgWideView={isOrgWideView}
-                hasUnsavedChanges={hasUnsavedChanges}
-                onSaveToCurrent={handleSaveToCurrent}
-                onSaveAsNew={handleSaveAsNew}
-                onSaveForEveryone={handleSaveForEveryone}
-                onMakePersonal={handleMakePersonal}
-                onResetView={handleResetView}
-            />
             <LauncherFilterPopover
                 orgId={orgId}
                 selectedSites={selectedSites}
@@ -448,15 +628,31 @@ export default function ResourceLauncher({
                     })
                 }
             />
+        </>
+    );
+
+    const renderToolbarActions = () => (
+        <>
+            <LauncherSaveViewMenu
+                isDefaultView={isDefaultView}
+                isAdmin={isAdmin}
+                isOrgWideView={isOrgWideView}
+                hasUnsavedChanges={hasUnsavedChanges}
+                canResetSystemDefault={canResetSystemDefault}
+                onSaveToCurrent={handleSaveToCurrent}
+                onSaveAsNew={handleSaveAsNew}
+                onSaveForEveryone={handleSaveForEveryone}
+                onMakePersonal={handleMakePersonal}
+                onResetView={handleResetView}
+                onResetSystemDefault={handleResetSystemDefault}
+                onDeleteView={() => setDeleteDialogOpen(true)}
+            />
             <LauncherSettingsMenu
                 config={config}
-                isDefaultView={isDefaultView}
+                capabilities={scale.capabilities}
+                isCompactMode={scale.mode === "compact"}
+                selectedGroupBy={effectiveConfig.groupBy}
                 onConfigChange={applyConfigPatch}
-                onDeleteView={() => {
-                    if (!isDefaultView) {
-                        deleteViewMutation.mutate(activeViewId);
-                    }
-                }}
             />
             <LauncherRefreshButton
                 onRefresh={refreshData}
@@ -483,6 +679,9 @@ export default function ResourceLauncher({
             {isDesktop ? (
                 <div className="mb-6 flex w-full min-w-0 items-center gap-3">
                     {renderToolbarSearch("w-64")}
+                    <div className="flex shrink-0 items-center gap-2">
+                        {renderToolbarFilterSort()}
+                    </div>
                     <div className="min-w-0 flex-1 overflow-x-auto">
                         {renderToolbarViews()}
                     </div>
@@ -495,21 +694,63 @@ export default function ResourceLauncher({
                     <div className="flex items-center gap-2 overflow-x-auto">
                         {renderToolbarActions()}
                     </div>
+                    <div className="flex items-center gap-2">
+                        <div className="min-w-0 flex-1">
                             {renderToolbarSearch("w-full")}
+                        </div>
+                        {renderToolbarFilterSort()}
+                    </div>
                     <div className="overflow-x-auto">
                         {renderToolbarViews()}
                     </div>
                 </div>
             )}
 
+            {showSearchFirstGate ? (
+                <LauncherSearchFirstGate layout={config.layout} />
+            ) : showGroupList ? (
                 <LauncherGroupList
                     orgId={orgId}
                     activeViewId={activeViewId}
-                config={config}
+                    config={effectiveConfig}
                     initialGroups={groups}
                     groupsPagination={groupsPagination}
                     onClearFilters={handleClearFilters}
+                    onResourceSelect={handleResourceSelect}
                 />
+            ) : showFlatResourceList ? (
+                <LauncherFlatResourceList
+                    orgId={orgId}
+                    activeViewId={activeViewId}
+                    config={effectiveConfig}
+                    onClearFilters={handleClearFilters}
+                    onResourceSelect={handleResourceSelect}
+                />
+            ) : null}
+
+            <LauncherResourcePanel
+                open={panelOpen}
+                onOpenChange={handlePanelOpenChange}
+                resource={selectedResource}
+                orgId={orgId}
+                isAdmin={isAdmin}
+            />
+
+            {activeSavedView ? (
+                <ConfirmDeleteDialog
+                    open={deleteDialogOpen}
+                    setOpen={setDeleteDialogOpen}
+                    string={activeSavedView.name}
+                    title={t("resourceLauncherDeleteViewTitle")}
+                    buttonText={t("resourceLauncherDeleteViewConfirm")}
+                    dialog={<p>{t("resourceLauncherDeleteViewQuestion")}</p>}
+                    onConfirm={async () => {
+                        await deleteViewMutation.mutateAsync(
+                            activeSavedView.viewId
+                        );
+                    }}
+                />
+            ) : null}
 
             <Credenza open={saveDialogOpen} onOpenChange={setSaveDialogOpen}>
                 <CredenzaContent>

src/lib/launcherLocalStorage.ts

@@ -10,7 +10,7 @@ function lastViewKey(orgId: string) {
 function groupOpenKey(
     orgId: string,
     viewId: LauncherActiveViewId,
-    groupBy: "site" | "label"
+    groupBy: "site" | "label" | "none"
 ) {
     return `${GROUP_OPEN_PREFIX}${orgId}:${viewId}:${groupBy}`;
 }
@@ -64,7 +64,7 @@ export function writeLauncherLastView(
 export function readLauncherGroupOpenState(
     orgId: string,
     viewId: LauncherActiveViewId,
-    groupBy: "site" | "label"
+    groupBy: "site" | "label" | "none"
 ): Record<string, boolean> {
     return readJson<Record<string, boolean>>(
         groupOpenKey(orgId, viewId, groupBy),
@@ -75,7 +75,7 @@ export function readLauncherGroupOpenState(
 export function readLauncherGroupOpen(
     orgId: string,
     viewId: LauncherActiveViewId,
-    groupBy: "site" | "label",
+    groupBy: "site" | "label" | "none",
     groupKey: string,
     defaultOpen: boolean
 ): boolean {
@@ -86,7 +86,7 @@ export function readLauncherGroupOpen(
 export function writeLauncherGroupOpen(
     orgId: string,
     viewId: LauncherActiveViewId,
-    groupBy: "site" | "label",
+    groupBy: "site" | "label" | "none",
     groupKey: string,
     isOpen: boolean
 ) {

src/lib/launcherResourceDetails.ts

@@ -0,0 +1,93 @@
+import type { GetResourceResponse } from "@server/routers/resource/getResource";
+import type { GetResourceAuthInfoResponse } from "@server/routers/resource/getResourceAuthInfo";
+import type { GetSiteResourceResponse } from "@server/routers/siteResource/getSiteResource";
+
+export type PublicAuthState = "protected" | "not_protected" | "none";
+
+const BROWSER_MODES = ["http", "ssh", "rdp", "vnc"];
+
+export function derivePublicAuthState(
+    mode: string | null,
+    authInfo: Pick<
+        GetResourceAuthInfoResponse,
+        "password" | "pincode" | "sso" | "whitelist" | "headerAuth"
+    >
+): PublicAuthState {
+    if (!BROWSER_MODES.includes(mode || "")) {
+        return "none";
+    }
+
+    if (
+        authInfo.password ||
+        authInfo.pincode ||
+        authInfo.sso ||
+        authInfo.whitelist ||
+        authInfo.headerAuth
+    ) {
+        return "protected";
+    }
+
+    return "not_protected";
+}
+
+export function formatPublicResourceType(
+    resource: Pick<GetResourceResponse, "mode" | "ssl">
+): string {
+    if (resource.mode === "http") {
+        return resource.ssl ? "HTTPS" : "HTTP";
+    }
+
+    const mode = (resource.mode || "").toLowerCase();
+    if (mode === "tcp") {
+        return "TCP";
+    }
+    if (mode === "udp") {
+        return "UDP";
+    }
+
+    return (resource.mode || "—").toUpperCase();
+}
+
+export type PortProtocolState = "all" | "blocked" | "custom";
+
+function getPortProtocolState(
+    value: string | null | undefined
+): PortProtocolState {
+    if (value === "*") {
+        return "all";
+    }
+
+    if (!value || value.trim() === "") {
+        return "blocked";
+    }
+
+    return "custom";
+}
+
+export type PortRestrictionDisplay = {
+    hasNonDefaultPorts: boolean;
+    tcp: { state: PortProtocolState; ports: string | null };
+    udp: { state: PortProtocolState; ports: string | null };
+};
+
+export function formatPortRestrictionDisplay(
+    resource: Pick<
+        GetSiteResourceResponse,
+        "tcpPortRangeString" | "udpPortRangeString"
+    >
+): PortRestrictionDisplay {
+    const tcpState = getPortProtocolState(resource.tcpPortRangeString);
+    const udpState = getPortProtocolState(resource.udpPortRangeString);
+
+    return {
+        hasNonDefaultPorts: tcpState !== "all" || udpState !== "all",
+        tcp: {
+            state: tcpState,
+            ports: tcpState === "custom" ? resource.tcpPortRangeString : null
+        },
+        udp: {
+            state: udpState,
+            ports: udpState === "custom" ? resource.udpPortRangeString : null
+        }
+    };
+}

src/lib/launcherScale.ts

@@ -0,0 +1,114 @@
+import type {
+    LauncherScaleInfo,
+    LauncherViewConfig
+} from "@server/routers/launcher/types";
+
+export function hasActiveLauncherFilters(config: LauncherViewConfig): boolean {
+    return (
+        config.query.trim().length > 0 ||
+        config.siteIds.length > 0 ||
+        config.labelIds.length > 0
+    );
+}
+
+export function getEffectiveGroupBy(
+    scale: LauncherScaleInfo,
+    config: LauncherViewConfig
+): LauncherViewConfig["groupBy"] {
+    if (scale.mode !== "compact") {
+        return config.groupBy;
+    }
+
+    if (
+        config.groupBy === "site" &&
+        config.siteIds.length > 0 &&
+        scale.capabilities.allowSiteGrouping
+    ) {
+        return "site";
+    }
+
+    if (
+        config.groupBy === "label" &&
+        config.labelIds.length > 0 &&
+        scale.capabilities.allowLabelGrouping
+    ) {
+        return "label";
+    }
+
+    return "none";
+}
+
+export function getEffectiveLauncherConfig(
+    scale: LauncherScaleInfo,
+    config: LauncherViewConfig
+): LauncherViewConfig {
+    const groupBy = getEffectiveGroupBy(scale, config);
+    if (groupBy === config.groupBy) {
+        return config;
+    }
+
+    return { ...config, groupBy };
+}
+
+export function shouldFetchLauncherGroups(
+    scale: LauncherScaleInfo,
+    config: LauncherViewConfig
+): boolean {
+    const groupBy = getEffectiveGroupBy(scale, config);
+
+    if (groupBy === "none") {
+        return false;
+    }
+
+    if (scale.mode === "full") {
+        return true;
+    }
+
+    return (
+        (scale.capabilities.allowSiteGrouping &&
+            groupBy === "site" &&
+            config.siteIds.length > 0) ||
+        (scale.capabilities.allowLabelGrouping &&
+            groupBy === "label" &&
+            config.labelIds.length > 0)
+    );
+}
+
+export function shouldShowLauncherGroupList(
+    scale: LauncherScaleInfo,
+    config: LauncherViewConfig
+): boolean {
+    return shouldFetchLauncherGroups(scale, config);
+}
+
+export function shouldShowSearchFirstGate(
+    scale: LauncherScaleInfo,
+    config: LauncherViewConfig
+): boolean {
+    return (
+        scale.mode === "compact" &&
+        scale.capabilities.requireSearchOrFilter &&
+        !hasActiveLauncherFilters(config)
+    );
+}
+
+export function shouldShowFlatResourceList(
+    scale: LauncherScaleInfo,
+    config: LauncherViewConfig
+): boolean {
+    if (shouldShowSearchFirstGate(scale, config)) {
+        return false;
+    }
+
+    const groupBy = getEffectiveGroupBy(scale, config);
+
+    if (groupBy === "none") {
+        return true;
+    }
+
+    if (scale.mode === "full") {
+        return false;
+    }
+
+    return !shouldShowLauncherGroupList(scale, config);
+}

src/lib/launcherServerData.ts

@@ -1,21 +1,27 @@
 import { internal } from "@app/lib/api";
 import type { LauncherActiveViewId } from "@app/lib/launcherLocalStorage";
+import { shouldFetchLauncherGroups } from "@app/lib/launcherScale";
 import { resolveLauncherStateFromUrl } from "@app/lib/launcherUrlState";
 import { buildLauncherSearchParams } from "@app/lib/launcherSearchParams";
 import type {
     LauncherGroup,
+    LauncherScaleInfo,
+    LauncherDefaultViewOverrides,
     LauncherViewConfig,
     LauncherViewRecord,
     ListLauncherGroupsResponse,
+    ListLauncherScaleResponse,
     ListLauncherViewsResponse
 } from "@server/routers/launcher/types";
 import { AxiosResponse } from "axios";
 
 export type LauncherPageData = {
     views: LauncherViewRecord[];
+    defaultViewOverrides: LauncherDefaultViewOverrides;
     activeViewId: LauncherActiveViewId;
     config: LauncherViewConfig;
     savedConfig: LauncherViewConfig;
+    scale: LauncherScaleInfo;
     groups: LauncherGroup[];
     groupsPagination: {
         total: number;
@@ -32,19 +38,56 @@ export async function fetchLauncherPageData(
     >
 ): Promise<LauncherPageData> {
     let views: LauncherViewRecord[] = [];
+    let defaultViewOverrides: LauncherDefaultViewOverrides = {
+        personal: null,
+        orgWide: null
+    };
     try {
         const viewsRes = await internal.get<
             AxiosResponse<ListLauncherViewsResponse>
         >(`/org/${orgId}/launcher/views`, cookieHeader);
         views = viewsRes.data.data.views;
+        defaultViewOverrides = viewsRes.data.data.defaultViewOverrides;
     } catch (e) {}
 
     const { activeViewId, config, savedConfig } = resolveLauncherStateFromUrl(
         searchParams,
         views,
-        null
+        null,
+        defaultViewOverrides
     );
 
+    const scaleFilters = {
+        query: config.query,
+        groupBy: config.groupBy,
+        siteIds: config.siteIds,
+        labelIds: config.labelIds,
+        sort_by: config.sortBy,
+        order: config.order
+    };
+
+    let scale: LauncherScaleInfo = {
+        mode: "full",
+        resourceCount: 0,
+        siteGroupCount: 0,
+        labelGroupCount: 0,
+        capabilities: {
+            allowSiteGrouping: true,
+            allowLabelGrouping: true,
+            requireSearchOrFilter: false
+        }
+    };
+
+    try {
+        const sp = buildLauncherSearchParams(scaleFilters, 1);
+        sp.delete("page");
+        sp.delete("pageSize");
+        const scaleRes = await internal.get<
+            AxiosResponse<ListLauncherScaleResponse>
+        >(`/org/${orgId}/launcher/scale?${sp.toString()}`, cookieHeader);
+        scale = scaleRes.data.data.scale;
+    } catch (e) {}
+
     const groupFilters = {
         query: config.query,
         groupBy: config.groupBy,
@@ -62,6 +105,7 @@ export async function fetchLauncherPageData(
         pageSize: 20
     };
 
+    if (shouldFetchLauncherGroups(scale, config)) {
         try {
             const sp = buildLauncherSearchParams(groupFilters, 1);
             const groupsRes = await internal.get<
@@ -70,12 +114,15 @@ export async function fetchLauncherPageData(
             groups = groupsRes.data.data.groups;
             groupsPagination = groupsRes.data.data.pagination;
         } catch (e) {}
+    }
 
     return {
         views,
+        defaultViewOverrides,
         activeViewId,
         config,
         savedConfig,
+        scale,
         groups,
         groupsPagination
     };

src/lib/launcherUrlState.ts

@@ -1,7 +1,9 @@
 import type { LauncherActiveViewId } from "@app/lib/launcherLocalStorage";
 import {
     defaultLauncherViewConfig,
+    getEffectiveDefaultLauncherConfig,
     parseIdListParam,
+    type LauncherDefaultViewOverrides,
     type LauncherViewConfig,
     type LauncherViewRecord
 } from "@server/routers/launcher/types";
@@ -64,10 +66,13 @@ export function isLauncherConfigEqual(
 
 export function getLauncherUrlBaseConfig(
     viewId: LauncherActiveViewId,
-    views: LauncherViewRecord[]
+    views: LauncherViewRecord[],
+    defaultViewOverrides?: LauncherDefaultViewOverrides
 ): LauncherViewConfig {
     if (viewId === "default") {
-        return defaultLauncherViewConfig;
+        return defaultViewOverrides
+            ? getEffectiveDefaultLauncherConfig(defaultViewOverrides)
+            : defaultLauncherViewConfig;
     }
 
     const savedView = views.find((view) => view.viewId === viewId);
@@ -113,7 +118,7 @@ function parseConfigOverrides(
     }
 
     const groupBy = searchParams.get("groupBy");
-    if (groupBy === "site" || groupBy === "label") {
+    if (groupBy === "site" || groupBy === "label" || groupBy === "none") {
         overrides.groupBy = groupBy;
     }
 
@@ -172,7 +177,8 @@ function isValidActiveViewId(
 export function resolveLauncherStateFromUrl(
     searchParams: URLSearchParams,
     views: LauncherViewRecord[],
-    fallbackViewId: LauncherActiveViewId | null
+    fallbackViewId: LauncherActiveViewId | null,
+    defaultViewOverrides?: LauncherDefaultViewOverrides
 ): ResolvedLauncherState {
     const parsed = parseLauncherUrlState(searchParams);
 
@@ -188,18 +194,26 @@ export function resolveLauncherStateFromUrl(
             : "default";
     }
 
-    const savedConfig = getLauncherUrlBaseConfig(activeViewId, views);
+    const savedConfig = getLauncherUrlBaseConfig(
+        activeViewId,
+        views,
+        defaultViewOverrides
+    );
 
     let config: LauncherViewConfig;
     if (hasLauncherConfigParams(searchParams)) {
         config = resolveLauncherConfig(
-            defaultLauncherViewConfig,
+            getEffectiveDefaultLauncherConfig(
+                defaultViewOverrides ?? { personal: null, orgWide: null }
+            ),
             parsed.configOverrides
         );
     } else if (activeViewId !== "default") {
         config = savedConfig;
     } else {
-        config = defaultLauncherViewConfig;
+        config = getEffectiveDefaultLauncherConfig(
+            defaultViewOverrides ?? { personal: null, orgWide: null }
+        );
     }
 
     return {

src/lib/queries.ts

@@ -50,11 +50,16 @@ import type {
     ListLauncherGroupsResponse,
     ListLauncherLabelsResponse,
     ListLauncherResourcesResponse,
+    ListLauncherScaleResponse,
     ListLauncherSitesResponse,
     ListLauncherViewsResponse,
     LauncherListQuery,
+    LauncherResource,
     LauncherViewConfig
 } from "@server/routers/launcher/types";
+import type { GetResourceResponse } from "@server/routers/resource/getResource";
+import type { GetResourceAuthInfoResponse } from "@server/routers/resource/getResourceAuthInfo";
+import type { GetSiteResourceResponse } from "@server/routers/siteResource/getSiteResource";
 import type { LauncherQueryFilters } from "@app/lib/launcherSearchParams";
 import { buildLauncherSearchParams } from "@app/lib/launcherSearchParams";
 
@@ -1189,13 +1194,13 @@ export const launcherQueries = {
                 const res = await meta!.api.get<
                     AxiosResponse<ListLauncherViewsResponse>
                 >(`/org/${orgId}/launcher/views`, { signal });
-                return res.data.data.views;
+                return res.data.data;
             }
         }),
     sites: ({
         orgId,
         query,
-        perPage = 500
+        perPage = 20
     }: {
         orgId: string;
         query?: string;
@@ -1227,7 +1232,7 @@ export const launcherQueries = {
     labels: ({
         orgId,
         query,
-        perPage = 500
+        perPage = 20
     }: {
         orgId: string;
         query?: string;
@@ -1298,5 +1303,62 @@ export const launcherQueries = {
                 const nextPage = page + 1;
                 return page * pageSize < total ? nextPage : undefined;
             }
+        }),
+    scale: (orgId: string, filters: LauncherQueryFilters) =>
+        queryOptions({
+            queryKey: ["ORG", orgId, "LAUNCHER", "SCALE", filters] as const,
+            queryFn: async ({ signal, meta }) => {
+                const sp = buildLauncherSearchParams(filters, 1);
+                sp.delete("page");
+                sp.delete("pageSize");
+                sp.delete("groupKey");
+                const res = await meta!.api.get<
+                    AxiosResponse<ListLauncherScaleResponse>
+                >(`/org/${orgId}/launcher/scale?${sp.toString()}`, { signal });
+                return res.data.data.scale;
+            }
+        }),
+    resourceDetail: (orgId: string, resource: LauncherResource | null) =>
+        queryOptions({
+            queryKey: [
+                "ORG",
+                orgId,
+                "LAUNCHER",
+                "RESOURCE_DETAIL",
+                resource?.launcherResourceKey ?? null
+            ] as const,
+            enabled: resource != null,
+            queryFn: async ({ signal, meta }) => {
+                if (!resource) {
+                    throw new Error("Resource is required");
+                }
+
+                if (resource.resourceType === "public") {
+                    const res = await meta!.api.get<
+                        AxiosResponse<GetResourceResponse>
+                    >(`/org/${orgId}/resource/${resource.niceId}`, { signal });
+                    const resourceData = res.data.data;
+                    const authRes = await meta!.api.get<
+                        AxiosResponse<GetResourceAuthInfoResponse>
+                    >(`/resource/${resourceData.resourceGuid}/auth`, {
+                        signal
+                    });
+                    return {
+                        resourceType: "public" as const,
+                        data: resourceData,
+                        authInfo: authRes.data.data
+                    };
+                }
+
+                const siteResourceId =
+                    resource.siteResourceId ?? resource.resourceId;
+                const res = await meta!.api.get<
+                    AxiosResponse<GetSiteResourceResponse>
+                >(`/org/${orgId}/site-resource/${siteResourceId}`, { signal });
+                return {
+                    resourceType: "site" as const,
+                    data: res.data.data
+                };
+            }
         })
 };