🚧 wip

♻️ Only show the username instead of the name+username
✨ List of orgs, with all columns
2026-09-01 16:59:22 +02:00 · 2026-08-28 22:49:51 +02:00 · 2026-08-28 22:09:01 +02:00 · 2026-08-28 22:00:06 +02:00 · 2026-08-28 21:42:20 +02:00 · 2026-08-27 00:03:56 +02:00
58 changed files with 2210 additions and 3582 deletions
@@ -77,7 +77,7 @@ jobs:
                  fi

            - name: Log in to Docker Hub
-              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+              uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
              with:
                  registry: docker.io
                  username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -149,7 +149,7 @@ jobs:
                  fi

            - name: Log in to Docker Hub
-              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+              uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
              with:
                  registry: docker.io
                  username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -204,7 +204,7 @@ jobs:
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

            - name: Log in to Docker Hub
-              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+              uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
              with:
                  registry: docker.io
                  username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -407,7 +407,7 @@ jobs:
              shell: bash

            - name: Login to GitHub Container Registry (for cosign)
-              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+              uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
              with:
                registry: ghcr.io
                username: ${{ github.actor }}
@@ -14,7 +14,7 @@ jobs:
  stale:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
        with:
          days-before-stale: 14
          days-before-close: 14
@@ -99,19 +99,6 @@ Access private resources like SSH servers, databases, RDP, and entire network ra

 <img src="public/screenshots/private-resources.png" alt="Private resources" width="100%" />

-### Identity-aware AI gateway
-
-Put an identity-aware proxy in front of public cloud (OpenAI, Anthropic, Gemini, etc.) and self-hosted model servers (Ollama, vLLM, Mistral, etc.) so coding agents and AI clients call a single Pangolin URL. Publish it as a public resource with personal API keys, or keep it private on a client tunnel where the connected client is the credential for keyless access. Budgets, session history, and usage analytics sit in front of every call.
-
-* Access self-hosted models (vLLM, Ollama, etc) alongside cloud models (OpenAI, Anthropic, etc) in one place
-* Keyless access by authenticating users with the Pangolin desktop client
-* Or, provide users with personal API keys
-* Control costs and token usage by setting budgets
-* Audit with detailed session history and analytics
-* Integrate AI clients and coding agents (Claude Code, Codex, OpenCode, etc)
-
-<img src="public/screenshots/expanded-session-logs.png" alt="AI Session Logs" width="100%" />
-
 ### Give users and roles access to resources

 Use Pangolin's built-in users or bring your own identity provider and set up role-based access control (RBAC). Grant users access to specific resources, not entire networks. Unlike traditional VPNs that expose full network access, Pangolin's zero-trust model ensures users can only reach the applications, services, and routes you explicitly define.
@@ -16,7 +16,7 @@ experimental:
      version: "{{.BadgerVersion}}"
    crowdsec: # CrowdSec plugin configuration added
      moduleName: "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      version: "v1.7.1"
+      version: "v1.4.4"

 log:
  level: "INFO"
@@ -1573,8 +1573,6 @@
    "search": "Търси…",
    "searchPlaceholder": "Търсене...",
    "emptySearchOptions": "Няма намерени опции",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Създаване",
    "orgs": "Организации",
    "loginError": "Възникна неочаквана грешка. Моля, опитайте отново.",
@@ -2598,7 +2596,6 @@
    "createDomainType": "Тип:",
    "createDomainName": "Име:",
    "createDomainValue": "Стойност:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "CNAME записи",
    "createDomainARecords": "A записи",
    "createDomainRecordNumber": "Запис {number}",
@@ -2996,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Добавете CIDR диапазон (напр. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Неуспешно зареждане на подмрежи",
    "remoteExitNodeNetworkingLabelsTitle": "Етикети за Предпочитания",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Сайтове с тези етикети ще бъдат принудени да се свържат чрез този отдалечен край.",
    "remoteExitNodeNetworkingLabelsButtonText": "Изберете етикети...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Търсене на етикети...",
    "remoteExitNodeNetworkingLabelsLoadError": "Неуспешно зареждане на етикети",
@@ -1573,8 +1573,6 @@
    "search": "Vyhledávání…",
    "searchPlaceholder": "Hledat...",
    "emptySearchOptions": "Nebyly nalezeny žádné možnosti",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Vytvořit",
    "orgs": "Organizace",
    "loginError": "Došlo k neočekávané chybě. Zkuste to prosím znovu.",
@@ -2598,7 +2596,6 @@
    "createDomainType": "Typ:",
    "createDomainName": "Jméno:",
    "createDomainValue": "Hodnota:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "Záznamy CNAME",
    "createDomainARecords": "Záznamy",
    "createDomainRecordNumber": "Nahrát {number}",
@@ -2996,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Přidejte rozsah CIDR (např. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Nepodařilo se načíst podsítě",
    "remoteExitNodeNetworkingLabelsTitle": "Názvy preferencí",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Weby s těmito názvy budou nuceny připojit se tímto vzdáleným výstupním uzlem.",
    "remoteExitNodeNetworkingLabelsButtonText": "Vyberte názvy...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Hledat názvy...",
    "remoteExitNodeNetworkingLabelsLoadError": "Nepodařilo se načíst názvy",
@@ -1573,8 +1573,6 @@
    "search": "Søg…",
    "searchPlaceholder": "Søg...",
    "emptySearchOptions": "Ingen valg fundet",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Opret",
    "orgs": "Organisationer",
    "loginError": "Der opstod en uventet fejl. Prøv venligst igen.",
@@ -2598,7 +2596,6 @@
    "createDomainType": "Type:",
    "createDomainName": "Navn:",
    "createDomainValue": "Værdi:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "CNAME-poster",
    "createDomainARecords": "A-poster",
    "createDomainRecordNumber": "Post {number}",
@@ -2996,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Tilføj et CIDR-område (f.eks. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Kunne ikke indlæse subnets",
    "remoteExitNodeNetworkingLabelsTitle": "Præference Etiketter",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Sites med disse etiketter vil blive tvunget til at oprette forbindelse gennem denne fjerne exit-node.",
    "remoteExitNodeNetworkingLabelsButtonText": "Vælg etiketter...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Søg efter etiketter...",
    "remoteExitNodeNetworkingLabelsLoadError": "Kunne ikke indlæse etiketter",
@@ -1573,8 +1573,6 @@
    "search": "Suche…",
    "searchPlaceholder": "Suche...",
    "emptySearchOptions": "Keine Optionen gefunden",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Erstellen",
    "orgs": "Organisationen",
    "loginError": "Ein unerwarteter Fehler ist aufgetreten. Bitte versuchen Sie es erneut.",
@@ -2598,7 +2596,6 @@
    "createDomainType": "Typ:",
    "createDomainName": "Name:",
    "createDomainValue": "Wert:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "CNAME-Einträge",
    "createDomainARecords": "A-Aufzeichnungen",
    "createDomainRecordNumber": "Eintrag {number}",
@@ -2996,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Fügen Sie einen CIDR-Bereich hinzu (z.B. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Fehler beim Laden der Subnetze",
    "remoteExitNodeNetworkingLabelsTitle": "Präferenzetiketten",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Standorte mit diesen Etiketten werden gezwungen, über diesen Remote Exit Node zu verbinden.",
    "remoteExitNodeNetworkingLabelsButtonText": "Etiketten auswählen...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Etiketten suchen...",
    "remoteExitNodeNetworkingLabelsLoadError": "Fehler beim Laden der Etiketten",
@@ -465,6 +465,8 @@
    "apiKeysDelete": "Delete API Key",
    "apiKeysManage": "Manage API Keys",
    "apiKeysDescription": "API keys are used to authenticate with the integration API",
+    "orgsManage": "Manage Organizations",
+    "orgsDescription": "View and manage all organizations on this instance",
    "provisioningKeysTitle": "Provisioning Key",
    "provisioningKeysManage": "Manage Provisioning Keys",
    "provisioningKeysDescription": "Provisioning keys are used to authenticate automated site provisioning for your organization.",
@@ -1573,8 +1575,6 @@
    "search": "Search…",
    "searchPlaceholder": "Search...",
    "emptySearchOptions": "No options found",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Create",
    "orgs": "Organizations",
    "loginError": "An unexpected error occurred. Please try again.",
@@ -2091,6 +2091,7 @@
    "resourceBudgetSettings": "Budget",
    "resourceBudgetSettingsDescription": "Configure how this AI gateway restricts usage based on spending or token limits",
    "sidebarApiKeys": "API Keys",
+    "sidebarOrgs": "Organizations",
    "sidebarProvisioning": "Provisioning",
    "sidebarSettings": "Settings",
    "sidebarAllUsers": "All Users",
@@ -2598,7 +2599,6 @@
    "createDomainType": "Type:",
    "createDomainName": "Name:",
    "createDomainValue": "Value:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "CNAME Records",
    "createDomainARecords": "A Records",
    "createDomainRecordNumber": "Record {number}",
@@ -1573,8 +1573,6 @@
    "search": "Buscar…",
    "searchPlaceholder": "Buscar...",
    "emptySearchOptions": "No se encontraron opciones",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Crear",
    "orgs": "Organizaciones",
    "loginError": "Ocurrió un error inesperado. Por favor, inténtelo de nuevo.",
@@ -2598,7 +2596,6 @@
    "createDomainType": "Tipo:",
    "createDomainName": "Nombre:",
    "createDomainValue": "Valor:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "Registros CNAME",
    "createDomainARecords": "Registros A",
    "createDomainRecordNumber": "Registro {number}",
@@ -2996,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Añadir un rango CIDR (e.g. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Error al cargar las subredes",
    "remoteExitNodeNetworkingLabelsTitle": "Etiquetas de Preferencias",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Los sitios con estas etiquetas se verán obligados a conectarse a través de este nodo de salida remoto.",
    "remoteExitNodeNetworkingLabelsButtonText": "Seleccionar etiquetas...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Buscar etiquetas...",
    "remoteExitNodeNetworkingLabelsLoadError": "Error al cargar las etiquetas",
@@ -1573,8 +1573,6 @@
    "search": "Rechercher…",
    "searchPlaceholder": "Recherche...",
    "emptySearchOptions": "Aucune option trouvée",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Créer",
    "orgs": "Organisations",
    "loginError": "Une erreur inattendue s'est produite. Veuillez réessayer.",
@@ -2598,7 +2596,6 @@
    "createDomainType": "Type :",
    "createDomainName": "Nom :",
    "createDomainValue": "Valeur :",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "Enregistrements CNAME",
    "createDomainARecords": "Enregistrements A",
    "createDomainRecordNumber": "Enregistrement {number}",
@@ -2996,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Ajouter une plage CIDR (par exemple 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Échec du chargement des sous-réseaux",
    "remoteExitNodeNetworkingLabelsTitle": "Étiquettes de préférences",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Les sites avec ces étiquettes devront se connecter via ce nœud de sortie distant.",
    "remoteExitNodeNetworkingLabelsButtonText": "Sélectionner des étiquettes...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Chercher des étiquettes...",
    "remoteExitNodeNetworkingLabelsLoadError": "Échec du chargement des étiquettes",
@@ -1573,8 +1573,6 @@
    "search": "Cerca…",
    "searchPlaceholder": "Cerca...",
    "emptySearchOptions": "Nessuna opzione trovata",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Crea",
    "orgs": "Organizzazioni",
    "loginError": "Si è verificato un errore imprevisto. Riprova.",
@@ -2598,7 +2596,6 @@
    "createDomainType": "Tipo:",
    "createDomainName": "Nome:",
    "createDomainValue": "Valore:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "Record CNAME",
    "createDomainARecords": "Record A",
    "createDomainRecordNumber": "Record {number}",
@@ -2996,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Aggiungi un intervallo CIDR (ad esempio 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Caricamento sottoreti fallito",
    "remoteExitNodeNetworkingLabelsTitle": "Etichette Preferenze",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "I siti con queste etichette saranno collegati attraverso questo nodo di uscita remoto.",
    "remoteExitNodeNetworkingLabelsButtonText": "Seleziona etichette...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Cerca etichette...",
    "remoteExitNodeNetworkingLabelsLoadError": "Caricamento etichette fallito",
@@ -1573,8 +1573,6 @@
    "search": "검색…",
    "searchPlaceholder": "검색...",
    "emptySearchOptions": "옵션이 없습니다",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "생성",
    "orgs": "조직",
    "loginError": "예기치 않은 오류가 발생했습니다. 다시 시도해주세요.",
@@ -2598,7 +2596,6 @@
    "createDomainType": "유형:",
    "createDomainName": "이름:",
    "createDomainValue": "값:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "CNAME 레코드",
    "createDomainARecords": "A 레코드",
    "createDomainRecordNumber": "레코드 {number}",
@@ -2996,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "CIDR 범위 추가 (예: 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "서브넷 로드 실패",
    "remoteExitNodeNetworkingLabelsTitle": "우선순위 레이블",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "이 레이블이 있는 사이트는 이 원격 출구 노드를 통해 연결됩니다.",
    "remoteExitNodeNetworkingLabelsButtonText": "레이블 선택...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "레이블 검색...",
    "remoteExitNodeNetworkingLabelsLoadError": "레이블 로드 실패",
@@ -1573,8 +1573,6 @@
    "search": "Søk…",
    "searchPlaceholder": "Søk...",
    "emptySearchOptions": "Ingen valg funnet",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Opprett",
    "orgs": "Organisasjoner",
    "loginError": "En uventet feil oppstod. Vennligst prøv igjen.",
@@ -2598,7 +2596,6 @@
    "createDomainType": "Type:",
    "createDomainName": "Navn:",
    "createDomainValue": "Verdi:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "CNAME-oppføringer",
    "createDomainARecords": "A-oppføringer",
    "createDomainRecordNumber": "Oppføring {number}",
@@ -2996,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Legg til et CIDR-område (f.eks. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Feil ved lasting av subnett",
    "remoteExitNodeNetworkingLabelsTitle": "Preferanseetiketter",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Områder med disse etikettene vil bli tvunget til å koble gjennom denne fjerne utgangsnoden.",
    "remoteExitNodeNetworkingLabelsButtonText": "Velg etiketter...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Søk etiketter...",
    "remoteExitNodeNetworkingLabelsLoadError": "Feil ved lasting av etiketter",
@@ -1573,8 +1573,6 @@
    "search": "Zoeken…",
    "searchPlaceholder": "Zoeken...",
    "emptySearchOptions": "Geen opties gevonden",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Aanmaken",
    "orgs": "Organisaties",
    "loginError": "Er is een onverwachte fout opgetreden. Probeer het opnieuw.",
@@ -2598,7 +2596,6 @@
    "createDomainType": "Type:",
    "createDomainName": "Naam:",
    "createDomainValue": "Waarde:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "CNAME-records",
    "createDomainARecords": "A Records",
    "createDomainRecordNumber": "Record {number}",
@@ -2996,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Voeg een CIDR-bereik toe (bijv. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Kon subnets niet laden",
    "remoteExitNodeNetworkingLabelsTitle": "Voorkeurslabels",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Sites met deze labels worden verplicht om verbinding te maken via dit externe exit-knooppunt.",
    "remoteExitNodeNetworkingLabelsButtonText": "Selecteer labels...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Labels zoeken...",
    "remoteExitNodeNetworkingLabelsLoadError": "Kon labels niet laden",
@@ -1573,8 +1573,6 @@
    "search": "Szukaj…",
    "searchPlaceholder": "Szukaj...",
    "emptySearchOptions": "Nie znaleziono opcji",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Utwórz",
    "orgs": "Organizacje",
    "loginError": "Wystąpił nieoczekiwany błąd. Spróbuj ponownie.",
@@ -2598,7 +2596,6 @@
    "createDomainType": "Typ:",
    "createDomainName": "Nazwa:",
    "createDomainValue": "Wartość:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "Rekordy CNAME",
    "createDomainARecords": "Rekordy A",
    "createDomainRecordNumber": "Rekord {number}",
@@ -2996,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Dodaj zakres CIDR (np. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Nie udało się załadować podsieci",
    "remoteExitNodeNetworkingLabelsTitle": "Etykiety preferencji",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Strony z tymi etykietami będą zmuszone do połączenia się przez ten zdalny węzeł wyjściowy.",
    "remoteExitNodeNetworkingLabelsButtonText": "Wybierz etykiety...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Szukaj etykiet...",
    "remoteExitNodeNetworkingLabelsLoadError": "Nie udało się załadować etykiet",
@@ -1573,8 +1573,6 @@
    "search": "Pesquisar…",
    "searchPlaceholder": "Buscar...",
    "emptySearchOptions": "Nenhuma opção encontrada",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Criar",
    "orgs": "Organizações",
    "loginError": "Ocorreu um erro inesperado. Por favor, tente novamente.",
@@ -2598,7 +2596,6 @@
    "createDomainType": "Tipo:",
    "createDomainName": "Nome:",
    "createDomainValue": "Valor:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "Registros CNAME",
    "createDomainARecords": "Registros A",
    "createDomainRecordNumber": "Registrar {number}",
@@ -2996,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Adicione um intervalo de CIDR (por exemplo, 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Falha ao carregar sub-redes",
    "remoteExitNodeNetworkingLabelsTitle": "Etiquetas de Preferência",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Os sites com essas etiquetas serão forçados a se conectar através deste nó de saída remoto.",
    "remoteExitNodeNetworkingLabelsButtonText": "Selecionar etiquetas...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Pesquisar etiquetas...",
    "remoteExitNodeNetworkingLabelsLoadError": "Falha ao carregar etiquetas",
@@ -1573,8 +1573,6 @@
    "search": "Поиск…",
    "searchPlaceholder": "Поиск...",
    "emptySearchOptions": "Опции не найдены",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Создать",
    "orgs": "Организации",
    "loginError": "Произошла непредвиденная ошибка. Пожалуйста, попробуйте еще раз.",
@@ -2598,7 +2596,6 @@
    "createDomainType": "Тип:",
    "createDomainName": "Имя:",
    "createDomainValue": "Значение:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "CNAME Записи",
    "createDomainARecords": "A Записи",
    "createDomainRecordNumber": "Запись {number}",
@@ -2996,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Добавить диапазон CIDR (например, 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Не удалось загрузить подсети",
    "remoteExitNodeNetworkingLabelsTitle": "Этикетки предпочтений",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Сайты с этими метками будут обязаны подключаться через этот удаленный узел выхода.",
    "remoteExitNodeNetworkingLabelsButtonText": "Выберите метки...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Поиск меток...",
    "remoteExitNodeNetworkingLabelsLoadError": "Не удалось загрузить метки",
@@ -1573,8 +1573,6 @@
    "search": "Ara…",
    "searchPlaceholder": "Ara...",
    "emptySearchOptions": "Seçenek bulunamadı",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Oluştur",
    "orgs": "Organizasyonlar",
    "loginError": "Beklenmeyen bir hata oluştu. Lütfen tekrar deneyin.",
@@ -2598,7 +2596,6 @@
    "createDomainType": "Tür:",
    "createDomainName": "Ad:",
    "createDomainValue": "Değer:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "CNAME Kayıtları",
    "createDomainARecords": "A Kayıtları",
    "createDomainRecordNumber": "Kayıt {number}",
@@ -2996,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Bir CIDR aralığı ekle (örneğin, 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Alt ağlar yüklenemedi",
    "remoteExitNodeNetworkingLabelsTitle": "Tercih Etiketleri",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Bu etiketlere sahip siteler, bu uzak çıkış düğümü üzerinden bağlantı kurmaya zorlanacaktır.",
    "remoteExitNodeNetworkingLabelsButtonText": "Etiketleri seç...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Etiketleri ara...",
    "remoteExitNodeNetworkingLabelsLoadError": "Etiketler yüklenemedi",
@@ -1573,8 +1573,6 @@
    "search": "搜索…",
    "searchPlaceholder": "搜索...",
    "emptySearchOptions": "未找到选项",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "创建",
    "orgs": "组织",
    "loginError": "发生意外错误。请重试。",
@@ -2598,7 +2596,6 @@
    "createDomainType": "类型:",
    "createDomainName": "名称:",
    "createDomainValue": "值:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "CNAME 记录",
    "createDomainARecords": "A记录",
    "createDomainRecordNumber": "记录 {number}",
@@ -2996,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "添加CIDR范围（例如10.0.0.0/8）",
    "remoteExitNodeNetworkingSubnetsLoadError": "无法加载子网",
    "remoteExitNodeNetworkingLabelsTitle": "首选标签",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "拥有这些标签的站点将强制通过此远程出口节点连接。",
    "remoteExitNodeNetworkingLabelsButtonText": "选择标签……",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "搜索标签……",
    "remoteExitNodeNetworkingLabelsLoadError": "无法加载标签",
@@ -94,12 +94,12 @@
        "input-otp": "1.4.2",
        "ioredis": "5.11.0",
        "jmespath": "0.16.0",
-        "js-yaml": "4.3.1",
+        "js-yaml": "4.3.0",
        "jsonwebtoken": "9.0.3",
        "lucide-react": "1.17.0",
        "maxmind": "5.0.6",
        "moment": "2.30.1",
-        "next": "16.3.1",
+        "next": "16.2.11",
        "next-intl": "4.13.0",
        "next-themes": "0.4.6",
        "nextjs-toploader": "3.9.17",
@@ -139,7 +139,7 @@
    "devDependencies": {
        "@dotenvx/dotenvx": "1.69.1",
        "@esbuild-plugins/tsconfig-paths": "0.1.2",
-        "@react-email/ui": "^6.9.2",
+        "@react-email/ui": "^6.5.0",
        "@tailwindcss/postcss": "4.3.0",
        "@tanstack/react-query-devtools": "5.100.14",
        "@types/better-sqlite3": "7.6.13",
@@ -170,7 +170,7 @@
        "esbuild-node-externals": "1.22.0",
        "eslint": "10.4.0",
        "eslint-config-next": "16.2.6",
-        "postcss": "8.5.23",
+        "postcss": "8.5.15",
        "prettier": "3.8.3",
        "react-email": "6.5.0",
        "tailwindcss": "4.3.0",
@@ -182,6 +182,6 @@
    "overrides": {
        "esbuild": "0.28.0",
        "dompurify": "3.4.0",
-        "postcss": "8.5.23"
+        "postcss": "8.5.15"
    }
 }
@@ -262,20 +262,16 @@ export const resourceAiModels = pgTable(
    (t) => [primaryKey({ columns: [t.resourceId, t.modelId] })]
 );

-export const labels = pgTable(
-    "labels",
-    {
-        labelId: serial("labelId").primaryKey(),
-        name: varchar("name").notNull(),
-        color: varchar("color").notNull(),
-        orgId: varchar("orgId")
-            .references(() => orgs.orgId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (t) => [index("idx_labels_orgid").on(t.orgId)]
-);
+export const labels = pgTable("labels", {
+    labelId: serial("labelId").primaryKey(),
+    name: varchar("name").notNull(),
+    color: varchar("color").notNull(),
+    orgId: varchar("orgId")
+        .references(() => orgs.orgId, {
+            onDelete: "cascade"
+        })
+        .notNull()
+});

 export const launcherViews = pgTable("launcherViews", {
    viewId: serial("viewId").primaryKey(),
@@ -697,19 +693,15 @@ export const twoFactorBackupCodes = pgTable("twoFactorBackupCodes", {
    codeHash: varchar("codeHash").notNull()
 });

-export const sessions = pgTable(
-    "session",
-    {
-        sessionId: varchar("id").primaryKey(),
-        userId: varchar("userId")
-            .notNull()
-            .references(() => users.userId, { onDelete: "cascade" }),
-        expiresAt: bigint("expiresAt", { mode: "number" }).notNull(),
-        issuedAt: bigint("issuedAt", { mode: "number" }),
-        deviceAuthUsed: boolean("deviceAuthUsed").notNull().default(false)
-    },
-    (t) => [index("idx_sessions_userid").on(t.userId)]
-);
+export const sessions = pgTable("session", {
+    sessionId: varchar("id").primaryKey(),
+    userId: varchar("userId")
+        .notNull()
+        .references(() => users.userId, { onDelete: "cascade" }),
+    expiresAt: bigint("expiresAt", { mode: "number" }).notNull(),
+    issuedAt: bigint("issuedAt", { mode: "number" }),
+    deviceAuthUsed: boolean("deviceAuthUsed").notNull().default(false)
+});

 export const newtSessions = pgTable("newtSession", {
    sessionId: varchar("id").primaryKey(),
@@ -719,26 +711,19 @@ export const newtSessions = pgTable("newtSession", {
    expiresAt: bigint("expiresAt", { mode: "number" }).notNull()
 });

-export const userOrgs = pgTable(
-    "userOrgs",
-    {
-        userId: varchar("userId")
-            .notNull()
-            .references(() => users.userId, { onDelete: "cascade" }),
-        orgId: varchar("orgId")
-            .references(() => orgs.orgId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        isOwner: boolean("isOwner").notNull().default(false),
-        autoProvisioned: boolean("autoProvisioned").default(false),
-        pamUsername: varchar("pamUsername") // cleaned username for ssh and such
-    },
-    (t) => [
-        index("idx_userOrgs_userid").on(t.userId),
-        index("idx_userOrgs_orgid").on(t.orgId)
-    ]
-);
+export const userOrgs = pgTable("userOrgs", {
+    userId: varchar("userId")
+        .notNull()
+        .references(() => users.userId, { onDelete: "cascade" }),
+    orgId: varchar("orgId")
+        .references(() => orgs.orgId, {
+            onDelete: "cascade"
+        })
+        .notNull(),
+    isOwner: boolean("isOwner").notNull().default(false),
+    autoProvisioned: boolean("autoProvisioned").default(false),
+    pamUsername: varchar("pamUsername") // cleaned username for ssh and such
+});

 export const emailVerificationCodes = pgTable("emailVerificationCodes", {
    codeId: serial("id").primaryKey(),
@@ -766,26 +751,22 @@ export const actions = pgTable("actions", {
    description: varchar("description")
 });

-export const roles = pgTable(
-    "roles",
-    {
-        roleId: serial("roleId").primaryKey(),
-        orgId: varchar("orgId")
-            .references(() => orgs.orgId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        isAdmin: boolean("isAdmin"),
-        name: varchar("name").notNull(),
-        description: varchar("description"),
-        requireDeviceApproval: boolean("requireDeviceApproval").default(false),
-        sshSudoMode: varchar("sshSudoMode", { length: 32 }).default("full"), // "none" | "full" | "commands"
-        sshSudoCommands: text("sshSudoCommands").default("[]"),
-        sshCreateHomeDir: boolean("sshCreateHomeDir").default(true),
-        sshUnixGroups: text("sshUnixGroups").default("[]")
-    },
-    (t) => [index("idx_roles_orgid").on(t.orgId)]
-);
+export const roles = pgTable("roles", {
+    roleId: serial("roleId").primaryKey(),
+    orgId: varchar("orgId")
+        .references(() => orgs.orgId, {
+            onDelete: "cascade"
+        })
+        .notNull(),
+    isAdmin: boolean("isAdmin"),
+    name: varchar("name").notNull(),
+    description: varchar("description"),
+    requireDeviceApproval: boolean("requireDeviceApproval").default(false),
+    sshSudoMode: varchar("sshSudoMode", { length: 32 }).default("full"), // "none" | "full" | "commands"
+    sshSudoCommands: text("sshSudoCommands").default("[]"),
+    sshCreateHomeDir: boolean("sshCreateHomeDir").default(true),
+    sshUnixGroups: text("sshUnixGroups").default("[]")
+});

 export const userOrgRoles = pgTable(
    "userOrgRoles",
@@ -1428,10 +1409,7 @@ export const olms = pgTable(
        }),
        archived: boolean("archived").notNull().default(false)
    },
-    (t) => [
-        index("idx_olms_clientid").on(t.clientId),
-        index("idx_olms_userid").on(t.userId)
-    ]
+    (t) => [index("idx_olms_clientid").on(t.clientId)]
 );

 export const currentFingerprint = pgTable("currentFingerprint", {
@@ -99,147 +99,131 @@ export const orgDomains = sqliteTable("orgDomains", {
        .references(() => domains.domainId, { onDelete: "cascade" })
 });

-export const sites = sqliteTable(
-    "sites",
-    {
-        siteId: integer("siteId").primaryKey({ autoIncrement: true }),
-        orgId: text("orgId")
-            .references(() => orgs.orgId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        niceId: text("niceId").notNull(),
-        exitNodeId: integer("exitNode").references(() => exitNodes.exitNodeId, {
-            onDelete: "set null"
-        }),
-        networkId: integer("networkId").references(() => networks.networkId, {
-            onDelete: "set null"
-        }),
-        name: text("name").notNull(),
-        pubKey: text("pubKey"),
-        exitNodeSubnet: text("exitNodeSubnet"),
-        megabytesIn: integer("bytesIn").default(0),
-        megabytesOut: integer("bytesOut").default(0),
-        lastBandwidthUpdate: text("lastBandwidthUpdate"),
-        type: text("type").notNull(), // "newt" or "wireguard"
-        online: integer("online", { mode: "boolean" }).notNull().default(false),
-        lastPing: integer("lastPing"),
-
-        // exit node stuff that is how to connect to the site when it has a wg server
-        address: text("address"), // this is the address of the wireguard interface in newt
-        endpoint: text("endpoint"), // this is how to reach gerbil externally - gets put into the wireguard config
-        localEndpoints: text("localEndpoints"), // JSON encoded list of string ips on the local machine to try to connect to
-        publicKey: text("publicKey"), // TODO: Fix typo in publicKey
-        lastHolePunch: integer("lastHolePunch"),
-        listenPort: integer("listenPort"),
-        dockerSocketEnabled: integer("dockerSocketEnabled", { mode: "boolean" })
-            .notNull()
-            .default(true),
-        autoUpdateEnabled: integer("autoUpdateEnabled", { mode: "boolean" })
-            .notNull()
-            .default(false),
-        autoUpdateOverrideOrg: integer("autoUpdateOverrideOrg", {
-            mode: "boolean"
+export const sites = sqliteTable("sites", {
+    siteId: integer("siteId").primaryKey({ autoIncrement: true }),
+    orgId: text("orgId")
+        .references(() => orgs.orgId, {
+            onDelete: "cascade"
        })
-            .notNull()
-            .default(false),
-        status: text("status")
-            .$type<"pending" | "approved">()
-            .default("approved")
-    },
-    (table) => [
-        index("idx_sites_orgId").on(table.orgId)
-    ]
-);
+        .notNull(),
+    niceId: text("niceId").notNull(),
+    exitNodeId: integer("exitNode").references(() => exitNodes.exitNodeId, {
+        onDelete: "set null"
+    }),
+    networkId: integer("networkId").references(() => networks.networkId, {
+        onDelete: "set null"
+    }),
+    name: text("name").notNull(),
+    pubKey: text("pubKey"),
+    exitNodeSubnet: text("exitNodeSubnet"),
+    megabytesIn: integer("bytesIn").default(0),
+    megabytesOut: integer("bytesOut").default(0),
+    lastBandwidthUpdate: text("lastBandwidthUpdate"),
+    type: text("type").notNull(), // "newt" or "wireguard"
+    online: integer("online", { mode: "boolean" }).notNull().default(false),
+    lastPing: integer("lastPing"),

-export const resources = sqliteTable(
-    "resources",
-    {
-        resourceId: integer("resourceId").primaryKey({ autoIncrement: true }),
-        resourcePolicyId: integer("resourcePolicyId").references(
-            () => resourcePolicies.resourcePolicyId,
-            { onDelete: "set null" }
-        ),
-        defaultResourcePolicyId: integer("defaultResourcePolicyId").references(
-            () => resourcePolicies.resourcePolicyId,
-            {
-                onDelete: "restrict"
-            }
-        ),
-        resourceGuid: text("resourceGuid", { length: 36 })
-            .unique()
-            .notNull()
-            .$defaultFn(() => randomUUID()),
-        orgId: text("orgId")
-            .references(() => orgs.orgId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        niceId: text("niceId").notNull(),
-        name: text("name").notNull(),
-        subdomain: text("subdomain"),
-        fullDomain: text("fullDomain"),
-        domainId: text("domainId").references(() => domains.domainId, {
-            onDelete: "set null"
-        }),
-        ssl: integer("ssl", { mode: "boolean" }).notNull().default(false),
-        blockAccess: integer("blockAccess", { mode: "boolean" })
-            .notNull()
-            .default(false),
-        proxyPort: integer("proxyPort"),
-        sso: integer("sso", { mode: "boolean" }),
-        emailWhitelistEnabled: integer("emailWhitelistEnabled", {
-            mode: "boolean"
-        }),
-        applyRules: integer("applyRules", { mode: "boolean" }),
-        enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
-        stickySession: integer("stickySession", { mode: "boolean" })
-            .notNull()
-            .default(false),
-        tlsServerName: text("tlsServerName"),
-        setHostHeader: text("setHostHeader"),
-        enableProxy: integer("enableProxy", { mode: "boolean" }).default(true),
-        skipToIdpId: integer("skipToIdpId").references(() => idp.idpId, {
-            onDelete: "set null"
-        }),
-        headers: text("headers"), // comma-separated list of headers to add to the request
-        proxyProtocol: integer("proxyProtocol", { mode: "boolean" })
-            .notNull()
-            .default(false),
-        proxyProtocolVersion: integer("proxyProtocolVersion").default(1),
-        maintenanceModeEnabled: integer("maintenanceModeEnabled", {
-            mode: "boolean"
+    // exit node stuff that is how to connect to the site when it has a wg server
+    address: text("address"), // this is the address of the wireguard interface in newt
+    endpoint: text("endpoint"), // this is how to reach gerbil externally - gets put into the wireguard config
+    localEndpoints: text("localEndpoints"), // JSON encoded list of string ips on the local machine to try to connect to
+    publicKey: text("publicKey"), // TODO: Fix typo in publicKey
+    lastHolePunch: integer("lastHolePunch"),
+    listenPort: integer("listenPort"),
+    dockerSocketEnabled: integer("dockerSocketEnabled", { mode: "boolean" })
+        .notNull()
+        .default(true),
+    autoUpdateEnabled: integer("autoUpdateEnabled", { mode: "boolean" })
+        .notNull()
+        .default(false),
+    autoUpdateOverrideOrg: integer("autoUpdateOverrideOrg", {
+        mode: "boolean"
+    })
+        .notNull()
+        .default(false),
+    status: text("status").$type<"pending" | "approved">().default("approved")
+});
+
+export const resources = sqliteTable("resources", {
+    resourceId: integer("resourceId").primaryKey({ autoIncrement: true }),
+    resourcePolicyId: integer("resourcePolicyId").references(
+        () => resourcePolicies.resourcePolicyId,
+        { onDelete: "set null" }
+    ),
+    defaultResourcePolicyId: integer("defaultResourcePolicyId").references(
+        () => resourcePolicies.resourcePolicyId,
+        {
+            onDelete: "restrict"
+        }
+    ),
+    resourceGuid: text("resourceGuid", { length: 36 })
+        .unique()
+        .notNull()
+        .$defaultFn(() => randomUUID()),
+    orgId: text("orgId")
+        .references(() => orgs.orgId, {
+            onDelete: "cascade"
        })
-            .notNull()
-            .default(false),
-        maintenanceModeType: text("maintenanceModeType", {
-            enum: ["forced", "automatic"]
-        }).default("forced"), // "forced" = always show, "automatic" = only when down
-        maintenanceTitle: text("maintenanceTitle"),
-        maintenanceMessage: text("maintenanceMessage"),
-        maintenanceEstimatedTime: text("maintenanceEstimatedTime"),
-        postAuthPath: text("postAuthPath"),
-        health: text("health").default("unknown"), // "healthy", "unhealthy", "unknown"
-        wildcard: integer("wildcard", { mode: "boolean" }).notNull().default(false),
-        mode: text("mode")
-            .default("http")
-            .$type<"rdp" | "ssh" | "http" | "vnc" | "inference" | "tcp" | "udp">()
-            .notNull(), // rdp, ssh, http, vnc, inference
-        pamMode: text("pamMode")
-            .$type<"passthrough" | "push">()
-            .default("passthrough"),
-        authDaemonMode: text("authDaemonMode")
-            .$type<"site" | "remote" | "native">()
-            .default("site"),
-        authDaemonPort: integer("authDaemonPort").default(22123),
-        status: text("status")
-            .$type<"pending" | "approved">()
-            .default("approved")
-    },
-    (table) => [
-        index("idx_resources_orgId").on(table.orgId)
-    ]
-);
+        .notNull(),
+    niceId: text("niceId").notNull(),
+    name: text("name").notNull(),
+    subdomain: text("subdomain"),
+    fullDomain: text("fullDomain"),
+    domainId: text("domainId").references(() => domains.domainId, {
+        onDelete: "set null"
+    }),
+    ssl: integer("ssl", { mode: "boolean" }).notNull().default(false),
+    blockAccess: integer("blockAccess", { mode: "boolean" })
+        .notNull()
+        .default(false),
+    proxyPort: integer("proxyPort"),
+    sso: integer("sso", { mode: "boolean" }),
+    emailWhitelistEnabled: integer("emailWhitelistEnabled", {
+        mode: "boolean"
+    }),
+    applyRules: integer("applyRules", { mode: "boolean" }),
+    enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
+    stickySession: integer("stickySession", { mode: "boolean" })
+        .notNull()
+        .default(false),
+    tlsServerName: text("tlsServerName"),
+    setHostHeader: text("setHostHeader"),
+    enableProxy: integer("enableProxy", { mode: "boolean" }).default(true),
+    skipToIdpId: integer("skipToIdpId").references(() => idp.idpId, {
+        onDelete: "set null"
+    }),
+    headers: text("headers"), // comma-separated list of headers to add to the request
+    proxyProtocol: integer("proxyProtocol", { mode: "boolean" })
+        .notNull()
+        .default(false),
+    proxyProtocolVersion: integer("proxyProtocolVersion").default(1),
+    maintenanceModeEnabled: integer("maintenanceModeEnabled", {
+        mode: "boolean"
+    })
+        .notNull()
+        .default(false),
+    maintenanceModeType: text("maintenanceModeType", {
+        enum: ["forced", "automatic"]
+    }).default("forced"), // "forced" = always show, "automatic" = only when down
+    maintenanceTitle: text("maintenanceTitle"),
+    maintenanceMessage: text("maintenanceMessage"),
+    maintenanceEstimatedTime: text("maintenanceEstimatedTime"),
+    postAuthPath: text("postAuthPath"),
+    health: text("health").default("unknown"), // "healthy", "unhealthy", "unknown"
+    wildcard: integer("wildcard", { mode: "boolean" }).notNull().default(false),
+    mode: text("mode")
+        .default("http")
+        .$type<"rdp" | "ssh" | "http" | "vnc" | "inference" | "tcp" | "udp">()
+        .notNull(), // rdp, ssh, http, vnc, inference
+    pamMode: text("pamMode")
+        .$type<"passthrough" | "push">()
+        .default("passthrough"),
+    authDaemonMode: text("authDaemonMode")
+        .$type<"site" | "remote" | "native">()
+        .default("site"),
+    authDaemonPort: integer("authDaemonPort").default(22123),
+    status: text("status").$type<"pending" | "approved">().default("approved")
+});

 export const resourceAiProviders = sqliteTable(
    "resourceAiProviders",
@@ -276,22 +260,16 @@ export const resourceAiModels = sqliteTable(
    (t) => [primaryKey({ columns: [t.resourceId, t.modelId] })]
 );

-export const labels = sqliteTable(
-    "labels",
-    {
-        labelId: integer("labelId").primaryKey({ autoIncrement: true }),
-        name: text("name").notNull(),
-        color: text("color").notNull(),
-        orgId: text("orgId")
-            .references(() => orgs.orgId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (table) => [
-        index("idx_labels_orgId").on(table.orgId)
-    ]
-);
+export const labels = sqliteTable("labels", {
+    labelId: integer("labelId").primaryKey({ autoIncrement: true }),
+    name: text("name").notNull(),
+    color: text("color").notNull(),
+    orgId: text("orgId")
+        .references(() => orgs.orgId, {
+            onDelete: "cascade"
+        })
+        .notNull()
+});

 export const launcherViews = sqliteTable("launcherViews", {
    viewId: integer("viewId").primaryKey({ autoIncrement: true }),
@@ -388,44 +366,35 @@ export const clientLabels = sqliteTable(
    (t) => [unique("client_label_uniq").on(t.clientId, t.labelId)]
 );

-export const targets = sqliteTable(
-    "targets",
-    {
-        targetId: integer("targetId").primaryKey({ autoIncrement: true }),
-        resourceId: integer("resourceId").references(
-            () => resources.resourceId,
-            { onDelete: "cascade" }
-        ),
-        providerId: integer("providerId").references(
-            () => aiProviders.providerId,
-            { onDelete: "cascade" }
-        ),
-        siteId: integer("siteId")
-            .references(() => sites.siteId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        ip: text("ip").notNull(),
-        method: text("method"),
-        port: integer("port").notNull(),
-        internalPort: integer("internalPort"),
-        enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
-        path: text("path"),
-        pathMatchType: text("pathMatchType"), // exact, prefix, regex
-        rewritePath: text("rewritePath"), // if set, rewrites the path to this value before sending to the target
-        rewritePathType: text("rewritePathType"), // exact, prefix, regex, stripPrefix
-        priority: integer("priority").notNull().default(100),
-        mode: text("mode")
-            .$type<"http" | "tcp" | "udp" | "ssh" | "rdp" | "vnc">()
-            .notNull()
-            .default("http"),
-        authToken: text("authToken")
-    },
-    (table) => [
-        index("idx_targets_resourceId").on(table.resourceId),
-        index("idx_targets_siteId").on(table.siteId)
-    ]
-);
+export const targets = sqliteTable("targets", {
+    targetId: integer("targetId").primaryKey({ autoIncrement: true }),
+    resourceId: integer("resourceId").references(() => resources.resourceId, {
+        onDelete: "cascade"
+    }),
+    providerId: integer("providerId").references(() => aiProviders.providerId, {
+        onDelete: "cascade"
+    }),
+    siteId: integer("siteId")
+        .references(() => sites.siteId, {
+            onDelete: "cascade"
+        })
+        .notNull(),
+    ip: text("ip").notNull(),
+    method: text("method"),
+    port: integer("port").notNull(),
+    internalPort: integer("internalPort"),
+    enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
+    path: text("path"),
+    pathMatchType: text("pathMatchType"), // exact, prefix, regex
+    rewritePath: text("rewritePath"), // if set, rewrites the path to this value before sending to the target
+    rewritePathType: text("rewritePathType"), // exact, prefix, regex, stripPrefix
+    priority: integer("priority").notNull().default(100),
+    mode: text("mode")
+        .$type<"http" | "tcp" | "udp" | "ssh" | "rdp" | "vnc">()
+        .notNull()
+        .default("http"),
+    authToken: text("authToken")
+});

 export const targetHealthCheck = sqliteTable("targetHealthCheck", {
    targetHealthCheckId: integer("targetHealthCheckId").primaryKey({
@@ -694,63 +663,50 @@ export const setupTokens = sqliteTable("setupTokens", {
    dateUsed: text("dateUsed")
 });

-export const newts = sqliteTable(
-    "newt",
-    {
-        newtId: text("id").primaryKey(),
-        secretHash: text("secretHash").notNull(),
-        dateCreated: text("dateCreated").notNull(),
-        version: text("version"),
-        siteId: integer("siteId").references(() => sites.siteId, {
+export const newts = sqliteTable("newt", {
+    newtId: text("id").primaryKey(),
+    secretHash: text("secretHash").notNull(),
+    dateCreated: text("dateCreated").notNull(),
+    version: text("version"),
+    siteId: integer("siteId").references(() => sites.siteId, {
+        onDelete: "cascade"
+    })
+});
+
+export const clients = sqliteTable("clients", {
+    clientId: integer("clientId").primaryKey({ autoIncrement: true }),
+    orgId: text("orgId")
+        .references(() => orgs.orgId, {
            onDelete: "cascade"
        })
-    },
-    (table) => [
-        index("idx_newts_siteId").on(table.siteId)
-    ]
-);
-
-export const clients = sqliteTable(
-    "clients",
-    {
-        clientId: integer("clientId").primaryKey({ autoIncrement: true }),
-        orgId: text("orgId")
-            .references(() => orgs.orgId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        exitNodeId: integer("exitNode").references(() => exitNodes.exitNodeId, {
-            onDelete: "set null"
-        }),
-        userId: text("userId").references(() => users.userId, {
-            // optionally tied to a user and in this case delete when the user deletes
-            onDelete: "cascade"
-        }),
-        niceId: text("niceId").notNull(),
-        name: text("name").notNull(),
-        pubKey: text("pubKey"),
-        olmId: text("olmId"), // to lock it to a specific olm optionally
-        subnet: text("subnet").notNull(),
-        exitNodeSubnet: text("exitNodeSubnet"), // this is the subnet when connecting to an exit node
-        megabytesIn: integer("bytesIn"),
-        megabytesOut: integer("bytesOut"),
-        lastBandwidthUpdate: text("lastBandwidthUpdate"),
-        lastPing: integer("lastPing"),
-        type: text("type").notNull(), // "olm"
-        online: integer("online", { mode: "boolean" }).notNull().default(false),
-        // endpoint: text("endpoint"),
-        lastHolePunch: integer("lastHolePunch"),
-        archived: integer("archived", { mode: "boolean" }).notNull().default(false),
-        blocked: integer("blocked", { mode: "boolean" }).notNull().default(false),
-        approvalState: text("approvalState").$type<
-            "pending" | "approved" | "denied"
-        >()
-    },
-    (table) => [
-        index("idx_clients_orgId").on(table.orgId),
-        index("idx_clients_userId").on(table.userId)
-    ]
-);
+        .notNull(),
+    exitNodeId: integer("exitNode").references(() => exitNodes.exitNodeId, {
+        onDelete: "set null"
+    }),
+    userId: text("userId").references(() => users.userId, {
+        // optionally tied to a user and in this case delete when the user deletes
+        onDelete: "cascade"
+    }),
+    niceId: text("niceId").notNull(),
+    name: text("name").notNull(),
+    pubKey: text("pubKey"),
+    olmId: text("olmId"), // to lock it to a specific olm optionally
+    subnet: text("subnet").notNull(),
+    exitNodeSubnet: text("exitNodeSubnet"), // this is the subnet when connecting to an exit node
+    megabytesIn: integer("bytesIn"),
+    megabytesOut: integer("bytesOut"),
+    lastBandwidthUpdate: text("lastBandwidthUpdate"),
+    lastPing: integer("lastPing"),
+    type: text("type").notNull(), // "olm"
+    online: integer("online", { mode: "boolean" }).notNull().default(false),
+    // endpoint: text("endpoint"),
+    lastHolePunch: integer("lastHolePunch"),
+    archived: integer("archived", { mode: "boolean" }).notNull().default(false),
+    blocked: integer("blocked", { mode: "boolean" }).notNull().default(false),
+    approvalState: text("approvalState").$type<
+        "pending" | "approved" | "denied"
+    >()
+});

 export const clientSitesAssociationsCache = sqliteTable(
    "clientSitesAssociationsCache",
@@ -778,29 +734,23 @@ export const clientSiteResourcesAssociationsCache = sqliteTable(
    }
 );

-export const olms = sqliteTable(
-    "olms",
-    {
-        olmId: text("id").primaryKey(),
-        secretHash: text("secretHash").notNull(),
-        dateCreated: text("dateCreated").notNull(),
-        version: text("version"),
-        agent: text("agent"),
-        name: text("name"),
-        clientId: integer("clientId").references(() => clients.clientId, {
-            // we will switch this depending on the current org it wants to connect to
-            onDelete: "set null"
-        }),
-        userId: text("userId").references(() => users.userId, {
-            // optionally tied to a user and in this case delete when the user deletes
-            onDelete: "cascade"
-        }),
-        archived: integer("archived", { mode: "boolean" }).notNull().default(false)
-    },
-    (table) => [
-        index("idx_olms_userId").on(table.userId)
-    ]
-);
+export const olms = sqliteTable("olms", {
+    olmId: text("id").primaryKey(),
+    secretHash: text("secretHash").notNull(),
+    dateCreated: text("dateCreated").notNull(),
+    version: text("version"),
+    agent: text("agent"),
+    name: text("name"),
+    clientId: integer("clientId").references(() => clients.clientId, {
+        // we will switch this depending on the current org it wants to connect to
+        onDelete: "set null"
+    }),
+    userId: text("userId").references(() => users.userId, {
+        // optionally tied to a user and in this case delete when the user deletes
+        onDelete: "cascade"
+    }),
+    archived: integer("archived", { mode: "boolean" }).notNull().default(false)
+});

 export const currentFingerprint = sqliteTable("currentFingerprint", {
    fingerprintId: integer("id").primaryKey({ autoIncrement: true }),
@@ -962,23 +912,17 @@ export const twoFactorBackupCodes = sqliteTable("twoFactorBackupCodes", {
    codeHash: text("codeHash").notNull()
 });

-export const sessions = sqliteTable(
-    "session",
-    {
-        sessionId: text("id").primaryKey(),
-        userId: text("userId")
-            .notNull()
-            .references(() => users.userId, { onDelete: "cascade" }),
-        expiresAt: integer("expiresAt").notNull(),
-        issuedAt: integer("issuedAt"),
-        deviceAuthUsed: integer("deviceAuthUsed", { mode: "boolean" })
-            .notNull()
-            .default(false)
-    },
-    (table) => [
-        index("idx_sessions_userId").on(table.userId)
-    ]
-);
+export const sessions = sqliteTable("session", {
+    sessionId: text("id").primaryKey(),
+    userId: text("userId")
+        .notNull()
+        .references(() => users.userId, { onDelete: "cascade" }),
+    expiresAt: integer("expiresAt").notNull(),
+    issuedAt: integer("issuedAt"),
+    deviceAuthUsed: integer("deviceAuthUsed", { mode: "boolean" })
+        .notNull()
+        .default(false)
+});

 export const newtSessions = sqliteTable("newtSession", {
    sessionId: text("id").primaryKey(),
@@ -996,28 +940,21 @@ export const olmSessions = sqliteTable("clientSession", {
    expiresAt: integer("expiresAt").notNull()
 });

-export const userOrgs = sqliteTable(
-    "userOrgs",
-    {
-        userId: text("userId")
-            .notNull()
-            .references(() => users.userId, { onDelete: "cascade" }),
-        orgId: text("orgId")
-            .references(() => orgs.orgId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        isOwner: integer("isOwner", { mode: "boolean" }).notNull().default(false),
-        autoProvisioned: integer("autoProvisioned", {
-            mode: "boolean"
-        }).default(false),
-        pamUsername: text("pamUsername") // cleaned username for ssh and such
-    },
-    (table) => [
-        index("idx_userOrgs_userId").on(table.userId),
-        index("idx_userOrgs_orgId").on(table.orgId)
-    ]
-);
+export const userOrgs = sqliteTable("userOrgs", {
+    userId: text("userId")
+        .notNull()
+        .references(() => users.userId, { onDelete: "cascade" }),
+    orgId: text("orgId")
+        .references(() => orgs.orgId, {
+            onDelete: "cascade"
+        })
+        .notNull(),
+    isOwner: integer("isOwner", { mode: "boolean" }).notNull().default(false),
+    autoProvisioned: integer("autoProvisioned", {
+        mode: "boolean"
+    }).default(false),
+    pamUsername: text("pamUsername") // cleaned username for ssh and such
+});

 export const emailVerificationCodes = sqliteTable("emailVerificationCodes", {
    codeId: integer("id").primaryKey({ autoIncrement: true }),
@@ -1045,32 +982,26 @@ export const actions = sqliteTable("actions", {
    description: text("description")
 });

-export const roles = sqliteTable(
-    "roles",
-    {
-        roleId: integer("roleId").primaryKey({ autoIncrement: true }),
-        orgId: text("orgId")
-            .references(() => orgs.orgId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        isAdmin: integer("isAdmin", { mode: "boolean" }),
-        name: text("name").notNull(),
-        description: text("description"),
-        requireDeviceApproval: integer("requireDeviceApproval", {
-            mode: "boolean"
-        }).default(false),
-        sshSudoMode: text("sshSudoMode").default("full"), // "none" | "full" | "commands"
-        sshSudoCommands: text("sshSudoCommands").default("[]"),
-        sshCreateHomeDir: integer("sshCreateHomeDir", { mode: "boolean" }).default(
-            true
-        ),
-        sshUnixGroups: text("sshUnixGroups").default("[]")
-    },
-    (table) => [
-        index("idx_roles_orgId").on(table.orgId)
-    ]
-);
+export const roles = sqliteTable("roles", {
+    roleId: integer("roleId").primaryKey({ autoIncrement: true }),
+    orgId: text("orgId")
+        .references(() => orgs.orgId, {
+            onDelete: "cascade"
+        })
+        .notNull(),
+    isAdmin: integer("isAdmin", { mode: "boolean" }),
+    name: text("name").notNull(),
+    description: text("description"),
+    requireDeviceApproval: integer("requireDeviceApproval", {
+        mode: "boolean"
+    }).default(false),
+    sshSudoMode: text("sshSudoMode").default("full"), // "none" | "full" | "commands"
+    sshSudoCommands: text("sshSudoCommands").default("[]"),
+    sshCreateHomeDir: integer("sshCreateHomeDir", { mode: "boolean" }).default(
+        true
+    ),
+    sshUnixGroups: text("sshUnixGroups").default("[]")
+});

 export const userOrgRoles = sqliteTable(
    "userOrgRoles",
@@ -101,7 +101,7 @@ export const AuthSchema = z.object({
 export const RuleSchema = z
    .object({
        action: z.enum(["allow", "deny", "pass"]),
-        match: z.enum(["cidr", "path", "ip", "country", "country_is_not", "asn", "region"]),
+        match: z.enum(["cidr", "path", "ip", "country", "asn", "region"]),
        value: z.coerce.string(),
        priority: z.int().optional(),
        enabled: z.boolean().optional().default(true)
@@ -136,7 +136,7 @@ export const RuleSchema = z
    )
    .refine(
        (rule) => {
-            if (rule.match === "country" || rule.match === "country_is_not") {
+            if (rule.match === "country") {
                if (!hasMaxmindCountryDb) {
                    return false;
                }
@@ -31,6 +31,7 @@ export async function validateAndConstructDomain(
    subdomain?: string | null
 ): Promise<DomainValidationResult> {
    try {
+        // Query domain with organization access check
        const [domainRes] = await db
            .select()
            .from(domains)
@@ -41,10 +42,6 @@ export async function validateAndConstructDomain(
                    eq(orgDomains.orgId, orgId),
                    eq(orgDomains.domainId, domainId)
                )
-            )
-            .leftJoin(
-                domainNamespaces,
-                eq(domainNamespaces.domainId, domainId)
            );

        // Check if domain exists
@@ -55,7 +52,7 @@ export async function validateAndConstructDomain(
            };
        }

-        if (!domainRes.orgDomains && !domainRes.domainNamespaces) {
+        if (!domainRes.orgDomains) {
            return {
                success: false,
                error: `Organization does not have access to domain with ID ${domainId}`
@@ -86,11 +83,19 @@ export async function validateAndConstructDomain(
        }

        // Wildcard subdomains are not allowed on namespace (provided/free) domains
-        if (isWildcard && domainRes.domainNamespaces) {
-            return {
-                success: false,
-                error: "Wildcard subdomains are not supported for provided or free domains. Use a specific subdomain instead."
-            };
+        if (isWildcard) {
+            const [namespaceDomain] = await db
+                .select()
+                .from(domainNamespaces)
+                .where(eq(domainNamespaces.domainId, domainId))
+                .limit(1);
+
+            if (namespaceDomain) {
+                return {
+                    success: false,
+                    error: "Wildcard subdomains are not supported for provided or free domains. Use a specific subdomain instead."
+                };
+            }
        }

        if (
@@ -3,8 +3,6 @@ import config from "./config";
 import { getHostMeta } from "./hostMeta";
 import logger from "@server/logger";
 import {
-    aiProviders,
-    aiUsageRecords,
    alertRules,
    apiKeys,
    blueprints,
@@ -13,16 +11,7 @@ import {
    siteResources
 } from "@server/db";
 import { sites, users, orgs, resources, clients, idp } from "@server/db";
-import {
-    eq,
-    count,
-    countDistinct,
-    notInArray,
-    and,
-    isNotNull,
-    isNull,
-    gte
-} from "drizzle-orm";
+import { eq, count, notInArray, and, isNotNull, isNull } from "drizzle-orm";
 import { APP_VERSION } from "./consts";
 import crypto from "crypto";
 import { UserType } from "@server/types/UserTypes";
@@ -183,25 +172,6 @@ class TelemetryClient {
                .select({ count: count() })
                .from(blueprints);

-            const [aiProvidersCount] = await db
-                .select({ count: count() })
-                .from(aiProviders);
-            const [orgsWithAiProviders] = await db
-                .select({ count: countDistinct(aiProviders.orgId) })
-                .from(aiProviders);
-
-            const usageWindowStart =
-                Math.floor(Date.now() / 1000) -
-                this.collectionIntervalDays * 24 * 60 * 60;
-            const [aiUsageRecordsRecent] = await db
-                .select({ count: count() })
-                .from(aiUsageRecords)
-                .where(gte(aiUsageRecords.createdAt, usageWindowStart));
-            const [orgsWithRecentAiUsage] = await db
-                .select({ count: countDistinct(aiUsageRecords.orgId) })
-                .from(aiUsageRecords)
-                .where(gte(aiUsageRecords.createdAt, usageWindowStart));
-
            const supporterKey = config.getSupporterData();

            const allPrivateResources = await db.select().from(siteResources);
@@ -212,7 +182,6 @@ class TelemetryClient {
            let numPrivResourceCidr = 0;
            let numPrivResourceHttp = 0;
            let numPrivResourceSsh = 0;
-            let numPrivResourceInference = 0;
            for (const res of allPrivateResources) {
                if (res.mode === "host") {
                    numPrivResourceHosts += 1;
@@ -222,8 +191,6 @@ class TelemetryClient {
                    numPrivResourceHttp += 1;
                } else if (res.mode === "ssh") {
                    numPrivResourceSsh += 1;
-                } else if (res.mode === "inference") {
-                    numPrivResourceInference += 1;
                }

                if (res.alias) {
@@ -244,11 +211,6 @@ class TelemetryClient {
                numPrivateResourceCidr: numPrivResourceCidr,
                numPrivateResourceHttp: numPrivResourceHttp,
                numPrivateResourceSsh: numPrivResourceSsh,
-                numPrivateResourceInference: numPrivResourceInference,
-                numAiProviders: aiProvidersCount.count,
-                numOrgsWithAiProviders: orgsWithAiProviders.count,
-                numAiUsageRecordsRecent: aiUsageRecordsRecent.count,
-                numOrgsWithRecentAiUsage: orgsWithRecentAiUsage.count,
                numAlertRules: numAlertRules.count,
                numUserDevices: userDevicesCount.count,
                numMachineClients: machineClients.count,
@@ -361,17 +323,6 @@ class TelemetryClient {
                    num_resources_non_http: stats.resources.filter(
                        (r) => r.mode !== "http"
                    ).length,
-                    num_resources_ai_gateway: stats.resources.filter(
-                        (r) => r.mode === "inference"
-                    ).length,
-                    num_private_resources_ai_gateway:
-                        stats.numPrivateResourceInference,
-                    num_ai_providers: stats.numAiProviders,
-                    num_orgs_with_ai_providers: stats.numOrgsWithAiProviders,
-                    num_ai_usage_records_recent:
-                        stats.numAiUsageRecordsRecent,
-                    num_orgs_with_recent_ai_usage:
-                        stats.numOrgsWithRecentAiUsage,
                    num_newt_sites: stats.sites.filter((s) => s.type === "newt")
                        .length,
                    num_local_sites: stats.sites.filter(
@@ -68,11 +68,6 @@ export async function verifyApiKeyAccessTokenAccess(
            );
        }

-        if (apiKey.isRoot) {
-            // Root keys can access any access token in any org
-            return next();
-        }
-
        if (!resource.orgId) {
            return next(
                createHttpError(
@@ -149,8 +149,12 @@ LQIDAQAB
        }

        // Count used sites and users for license comparison
-        const [siteCountRes] = await db.select({ value: count() }).from(sites);
-        const [userCountRes] = await db.select({ value: count() }).from(users);
+        const [siteCountRes] = await db
+            .select({ value: count() })
+            .from(sites);
+        const [userCountRes] = await db
+            .select({ value: count() })
+            .from(users);

        const status: LicenseStatus = {
            hostId: this.hostMeta.hostMetaId,
@@ -272,13 +276,10 @@ LQIDAQAB
                        logger.error(
                            `Allowing failure. Will retry one more time at next run interval.`
                        );
-                        // Fall back to last known good status if we have
-                        // one cached; otherwise return the freshly built
-                        // status (with defaults) rather than undefined.
-                        const lastKnownStatus = this.statusCache.get(
+                        // return last known good status
+                        return this.statusCache.get(
                            this.statusKey
-                        ) as LicenseStatus | undefined;
-                        return lastKnownStatus ?? status;
+                        ) as LicenseStatus;
                    } else {
                        // Subsequent failures: fail abruptly
                        throw e;
@@ -367,7 +368,10 @@ LQIDAQAB
                }

                // Only consider quantity if defined and >= 0 (quantity = users, quantity_2 = sites)
-                if (cached.quantity_2 !== undefined && cached.quantity_2 >= 0) {
+                if (
+                    cached.quantity_2 !== undefined &&
+                    cached.quantity_2 >= 0
+                ) {
                    status.maxSites =
                        (status.maxSites ?? 0) + cached.quantity_2;
                }
@@ -557,7 +561,7 @@ LQIDAQAB
                    // Calculate exponential backoff delay
                    const retryDelay = Math.floor(
                        initialRetryDelay *
-                            Math.pow(exponentialFactor, attempt - 1)
+                        Math.pow(exponentialFactor, attempt - 1)
                    );

                    logger.debug(
@@ -88,27 +88,7 @@ export const queryAccessAuditLogsQuery = z.object({
        .optional()
        .default("0")
        .transform(Number)
-        .pipe(z.int().nonnegative()),
-    ip: z
-        .preprocess((val) => {
-            if (val === undefined || val === null || val === "") {
-                return undefined;
-            }
-            if (Array.isArray(val)) {
-                return val;
-            }
-            // the array is returned as this
-            if (typeof val === "string") {
-                return val.split(",");
-            }
-            return undefined;
-        }, z.array(z.string()))
-        .optional()
-        .catch([])
-        .openapi({
-            type: "array",
-            description: "Filter by IP adresses"
-        })
+        .pipe(z.int().nonnegative())
 });

 export const queryAccessAuditLogsParams = z.object({
@@ -154,9 +134,6 @@ function getWhere(data: Q) {
        data.type ? eq(accessAuditLog.type, data.type) : undefined,
        data.action !== undefined
            ? eq(accessAuditLog.action, data.action)
-            : undefined,
-        data.ip && data.ip.length > 0
-            ? inArray(accessAuditLog.ip, data.ip)
            : undefined
    );
 }
@@ -16,10 +16,12 @@ import {
    handleRemoteExitNodePingMessage
 } from "#private/routers/remoteExitNode";
 import { MessageHandler } from "@server/routers/ws";
-import { handleConnectionLogMessage } from "#private/routers/newt";
+import {
+    handleConnectionLogMessage,
+} from "#private/routers/newt";

 export const messageHandlers: Record<string, MessageHandler> = {
    "remoteExitNode/register": handleRemoteExitNodeRegisterMessage,
    "remoteExitNode/ping": handleRemoteExitNodePingMessage,
-    "newt/access-log": handleConnectionLogMessage
+    "newt/access-log": handleConnectionLogMessage,
 };
@@ -81,27 +81,7 @@ export const queryAccessAuditLogsQuery = z.strictObject({
        .optional()
        .default("0")
        .transform(Number)
-        .pipe(z.int().nonnegative()),
-    ip: z
-        .preprocess((val) => {
-            if (val === undefined || val === null || val === "") {
-                return undefined;
-            }
-            if (Array.isArray(val)) {
-                return val;
-            }
-            // the array is returned as this
-            if (typeof val === "string") {
-                return val.split(",");
-            }
-            return undefined;
-        }, z.array(z.string()))
-        .optional()
-        .catch([])
-        .openapi({
-            type: "array",
-            description: "Filter by IP adresses"
-        })
+        .pipe(z.int().nonnegative())
 });

 export const queryRequestAuditLogsParams = z.object({
@@ -146,9 +126,6 @@ function getWhere(data: Q) {
        data.path ? eq(requestAuditLog.path, data.path) : undefined,
        data.action !== undefined
            ? eq(requestAuditLog.action, data.action)
-            : undefined,
-        data.ip && data.ip.length > 0
-            ? inArray(requestAuditLog.ip, data.ip)
            : undefined
    );
 }
@@ -6,7 +6,7 @@ import HttpCode from "@server/types/HttpCode";
 import { response } from "@server/lib/response";
 import { db } from "@server/db";
 import { passwordResetTokens, users } from "@server/db";
-import { eq, and } from "drizzle-orm";
+import { eq } from "drizzle-orm";
 import { alphabet, generateRandomString, sha256 } from "oslo/crypto";
 import { createDate } from "oslo";
 import logger from "@server/logger";
@@ -49,12 +49,7 @@ export async function requestPasswordReset(
        const existingUser = await db
            .select()
            .from(users)
-            .where(
-                and(
-                    eq(users.email, email),
-                    eq(users.type, UserType.Internal)
-                )
-            );
+            .where(eq(users.email, email));

        if (!existingUser || !existingUser.length) {
            await randomDelay(2000);
@@ -533,23 +533,18 @@ export async function startAuthentication(

        // If email is provided, get security keys for that specific user
        if (email) {
-            const matchingUsers = await db
+            const [user] = await db
                .select()
                .from(users)
-                .where(
-                    and(
-                        eq(users.email, email.toLowerCase()),
-                        eq(users.type, UserType.Internal)
-                    )
-                );
+                .where(eq(users.email, email))
+                .limit(1);

-            if (matchingUsers.length !== 1) {
+            if (!user || user.type !== UserType.Internal) {
                return next(
                    createHttpError(HttpCode.BAD_REQUEST, "Invalid credentials")
                );
            }

-            const user = matchingUsers[0];
            userId = user.userId;

            const userSecurityKeys = await db
@@ -42,62 +42,54 @@ export async function setServerAdmin(

        const { email, password, setupToken } = parsedBody.data;

+        // Validate setup token
+        const [validToken] = await db
+            .select()
+            .from(setupTokens)
+            .where(
+                and(
+                    eq(setupTokens.token, setupToken),
+                    eq(setupTokens.used, false)
+                )
+            );
+
+        if (!validToken) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Invalid or expired setup token"
+                )
+            );
+        }
+
+        const [existing] = await db
+            .select()
+            .from(users)
+            .where(eq(users.serverAdmin, true));
+
+        if (existing) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Server admin already exists"
+                )
+            );
+        }
+
        const passwordHash = await hashPassword(password);
        const userId = generateId(15);

        await db.transaction(async (trx) => {
-            const consumed = await trx
+            // Mark the token as used
+            await trx
                .update(setupTokens)
                .set({
                    used: true,
                    dateUsed: moment().toISOString()
                })
-                .where(
-                    and(
-                        eq(setupTokens.token, setupToken),
-                        eq(setupTokens.used, false)
-                    )
-                )
-                .returning({ tokenId: setupTokens.tokenId });
-
-            if (!consumed.length) {
-                throw createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Invalid setup token"
-                );
-            }
-
-            const [existingAdmin] = await trx
-                .select({ userId: users.userId })
-                .from(users)
-                .where(eq(users.serverAdmin, true))
-                .limit(1);
-
-            if (existingAdmin) {
-                throw createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Server admin already exists"
-                );
-            }
-
-            const [existingUser] = await trx
-                .select({ userId: users.userId })
-                .from(users)
-                .where(
-                    and(
-                        eq(users.email, email),
-                        eq(users.type, UserType.Internal)
-                    )
-                )
-                .limit(1);
-
-            if (existingUser) {
-                throw createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "A user with that email address already exists"
-                );
-            }
+                .where(eq(setupTokens.tokenId, validToken.tokenId));

+            // Create the server admin user
            await trx.insert(users).values({
                userId: userId,
                email: email,
@@ -119,9 +111,6 @@ export async function setServerAdmin(
            status: HttpCode.OK
        });
    } catch (e) {
-        if (createHttpError.isHttpError(e)) {
-            return next(e);
-        }
        logger.error(e);
        return next(
            createHttpError(
@@ -48,7 +48,7 @@ export async function validateSetupToken(
            return response<ValidateSetupTokenResponse>(res, {
                data: {
                    valid: false,
-                    message: "Invalid setup token"
+                    message: "Invalid or expired setup token"
                },
                success: true,
                error: false,
@@ -87,6 +87,7 @@ authenticated.get("/org/checkId", org.checkId);
 authenticated.put("/org", getUserOrgs, org.createOrg);

 authenticated.get("/orgs", verifyUserIsServerAdmin, org.listOrgs);
+authenticated.get("/admin/orgs", verifyUserIsServerAdmin, org.adminListOrgs);
 authenticated.get("/user/:userId/orgs", verifyIsLoggedInUser, org.listUserOrgs);

 authenticated.get(
@@ -0,0 +1,241 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, users } from "@server/db";
+import { orgs, resources, sites, userOrgs } from "@server/db";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import { and, asc, desc, eq, like, or, sql, type SQL } from "drizzle-orm";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
+import type { PaginatedResponse } from "@server/types/Pagination";
+
+const adminListOrgsSchema = z.strictObject({
+    pageSize: z.coerce
+        .number<string>()
+        .int()
+        .positive()
+        .optional()
+        .catch(20)
+        .default(20)
+        .openapi({
+            type: "integer",
+            default: 20,
+            description: "Number of items per page"
+        }),
+    page: z.coerce
+        .number<string>()
+        .int()
+        .positive()
+        .optional()
+        .catch(1)
+        .default(1)
+        .openapi({
+            type: "integer",
+            default: 1,
+            description: "Page number to retrieve"
+        }),
+    query: z.string().optional(),
+    sort_by: z
+        .enum(["name", "createdAt"])
+        .optional()
+        .catch(undefined)
+        .openapi({
+            type: "string",
+            enum: ["name", "createdAt"],
+            description: "Field to sort by"
+        }),
+    order: z
+        .enum(["asc", "desc"])
+        .optional()
+        .default("asc")
+        .catch("asc")
+        .openapi({
+            type: "string",
+            enum: ["asc", "desc"],
+            default: "asc",
+            description: "Sort order"
+        })
+});
+
+export type AdminOrgRow = {
+    orgId: string;
+    name: string;
+    subnet: string | null;
+    utilitySubnet: string | null;
+    createdAt: string | null;
+    userCount: number;
+    siteCount: number;
+    resourceCount: number;
+    owner: {
+        userId: string;
+        username: string;
+    } | null;
+};
+
+export type AdminListOrgsResponse = PaginatedResponse<{
+    orgs: AdminOrgRow[];
+}>;
+
+const AdminListOrgsResponseDataSchema = z.object({
+    orgs: z.array(
+        z.object({
+            orgId: z.string(),
+            name: z.string(),
+            subnet: z.string().nullable(),
+            createdAt: z.string().nullable(),
+            userCount: z.number(),
+            siteCount: z.number(),
+            resourceCount: z.number()
+        })
+    ),
+    pagination: z.object({
+        total: z.number(),
+        page: z.number(),
+        pageSize: z.number()
+    })
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/admin/orgs",
+    description:
+        "List all organizations in the system with usage counts (server admin).",
+    tags: [OpenAPITags.Org],
+    request: {
+        query: adminListOrgsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(
+                        AdminListOrgsResponseDataSchema
+                    )
+                }
+            }
+        }
+    }
+});
+
+export async function adminListOrgs(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedQuery = adminListOrgsSchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedQuery.error)
+                )
+            );
+        }
+
+        const { pageSize, page, query, sort_by, order } = parsedQuery.data;
+
+        let conditions: (SQL<unknown> | undefined)[] = [];
+        if (query) {
+            const q = "%" + query.toLowerCase() + "%";
+            conditions.push(
+                or(
+                    like(sql`LOWER(${orgs.name})`, q),
+                    like(sql`LOWER(${orgs.orgId})`, q),
+                    like(sql`LOWER(${orgs.subnet})`, q)
+                )
+            );
+        }
+
+        const sortColumns = {
+            name: orgs.name,
+            createdAt: orgs.createdAt
+        } as const;
+
+        const orderBy = sort_by
+            ? order === "asc"
+                ? asc(sortColumns[sort_by])
+                : desc(sortColumns[sort_by])
+            : asc(orgs.name);
+
+        // Drizzle renders bare column references in the select list without their
+        // table prefix, which would make a correlated subquery compare a column to
+        // itself, so the outer `orgs` side is qualified explicitly.
+        const orgIdRef = sql`${sql.identifier("orgs")}.${sql.identifier("orgId")}`;
+
+        const [countRows, rows] = await Promise.all([
+            db
+                .select({ count: sql<number>`count(*)` })
+                .from(orgs)
+                .where(and(...conditions)),
+            db
+                .selectDistinct({
+                    orgId: orgs.orgId,
+                    name: orgs.name,
+                    subnet: orgs.subnet,
+                    utilitySubnet: orgs.utilitySubnet,
+                    createdAt: orgs.createdAt,
+                    userCount: sql<number>`(
+                        SELECT COUNT(*)
+                        FROM ${userOrgs}
+                        WHERE ${userOrgs.orgId} = ${orgIdRef}
+                    )`.as("userCount"),
+                    siteCount: sql<number>`(
+                        SELECT COUNT(*)
+                        FROM ${sites}
+                        WHERE ${sites.orgId} = ${orgIdRef}
+                    )`.as("siteCount"),
+                    resourceCount: sql<number>`(
+                        SELECT COUNT(*)
+                        FROM ${resources}
+                        WHERE ${resources.orgId} = ${orgIdRef}
+                    )`.as("resourceCount"),
+                    owner: {
+                        userId: users.userId,
+                        username: users.username
+                    }
+                })
+                .from(orgs)
+                .where(and(...conditions, eq(userOrgs.isOwner, true)))
+                .leftJoin(userOrgs, eq(userOrgs.orgId, orgs.orgId))
+                .leftJoin(users, eq(userOrgs.userId, users.userId))
+                .limit(pageSize)
+                .offset(pageSize * (page - 1))
+                .orderBy(orderBy)
+        ]);
+
+        const totalCount = Number(countRows[0]?.count ?? 0);
+
+        return response<AdminListOrgsResponse>(res, {
+            data: {
+                orgs: rows.map((row) => ({
+                    ...row,
+                    userCount: Number(row.userCount ?? 0),
+                    siteCount: Number(row.siteCount ?? 0),
+                    resourceCount: Number(row.resourceCount ?? 0)
+                })),
+                pagination: {
+                    total: totalCount,
+                    page,
+                    pageSize
+                }
+            },
+            success: true,
+            error: false,
+            message: "Organizations retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "An error occurred..."
+            )
+        );
+    }
+}
@@ -9,3 +9,4 @@ export * from "./listOrgs";
 export * from "./pickOrgDefaults";
 export * from "./checkOrgUserAccess";
 export * from "./resetOrgBandwidth";
+export * from "./adminListOrgs";
@@ -454,14 +454,14 @@ export default async function migration() {
            throw new Error(fromZodError(parsedConfig.error).toString());
        }

-        traefikConfig.experimental.plugins.badger.version = "v1.7.0";
+        traefikConfig.experimental.plugins.badger.version = "v1.6.1";

        const updatedTraefikYaml = yaml.dump(traefikConfig);

        fs.writeFileSync(traefikPath, updatedTraefikYaml, "utf8");

        console.log(
-            "Updated the version of Badger in your Traefik configuration to v1.7.0"
+            "Updated the version of Badger in your Traefik configuration to v1.6.1"
        );
    } catch (e) {
        console.log(
@@ -459,14 +459,14 @@ export default async function migration() {
            throw new Error(fromZodError(parsedConfig.error).toString());
        }

-        traefikConfig.experimental.plugins.badger.version = "v1.7.0";
+        traefikConfig.experimental.plugins.badger.version = "v1.6.1";

        const updatedTraefikYaml = yaml.dump(traefikConfig);

        fs.writeFileSync(traefikPath, updatedTraefikYaml, "utf8");

        console.log(
-            "Updated the version of Badger in your Traefik configuration to v1.7.0"
+            "Updated the version of Badger in your Traefik configuration to v1.6.1"
        );
    } catch (e) {
        console.log(
@@ -12,7 +12,6 @@ import { DateTimeValue } from "@app/components/DateTimePicker";
 import { ArrowUpRight, Key, User } from "lucide-react";
 import Link from "next/link";
 import { ColumnFilterButton } from "@app/components/ColumnFilterButton";
-import { ColumnMultiFilterButton } from "@app/components/ColumnMultiFilterButton";
 import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
 import { build } from "@server/build";
 import { getSevenDaysAgo } from "@app/lib/getSevenDaysAgo";
@@ -27,7 +26,6 @@ import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import { logQueries } from "@app/lib/queries";
 import { useQuery } from "@tanstack/react-query";
 import type { QueryAccessAuditLogResponse } from "@server/routers/auditLogs/types";
-import { countryCodeToFlagEmoji } from "@app/lib/countryCodeToFlagEmoji";

 export default function GeneralPage() {
    const router = useRouter();
@@ -47,14 +45,12 @@ export default function GeneralPage() {
        resourceId?: string;
        location?: string;
        actor?: string;
-        ip?: string[];
    }>({
        action: searchParams.get("action") || undefined,
        type: searchParams.get("type") || undefined,
        resourceId: searchParams.get("resourceId") || undefined,
        location: searchParams.get("location") || undefined,
-        actor: searchParams.get("actor") || undefined,
-        ip: searchParams.getAll("ip") || undefined
+        actor: searchParams.get("actor") || undefined
    });

    const [currentPage, setCurrentPage] = useState<number>(0);
@@ -180,7 +176,7 @@ export default function GeneralPage() {

    const handleFilterChange = (
        filterType: keyof typeof filters,
-        value: string | string[] | undefined
+        value: string | undefined
    ) => {
        const newFilters = { ...filters, [filterType]: value };
        setFilters(newFilters);
@@ -198,13 +194,10 @@ export default function GeneralPage() {
    ) => {
        const params = new URLSearchParams(searchParams);
        Object.entries(newFilters).forEach(([key, value]) => {
-            params.delete(key);
-            if (typeof value === "string") {
+            if (value) {
                params.set(key, value);
-            } else if (typeof value !== "undefined" && "length" in value) {
-                for (const element of value) {
-                    params.append(key, element);
-                }
+            } else {
+                params.delete(key);
            }
        });
        router.replace(`?${params.toString()}`, { scroll: false });
@@ -212,7 +205,6 @@ export default function GeneralPage() {

    const exportData = async () => {
        try {
-            const { ip, ...restFilters } = filters;
            const params: any = {
                timeStart: dateRange.startDate?.date
                    ? new Date(dateRange.startDate.date).toISOString()
@@ -220,20 +212,13 @@ export default function GeneralPage() {
                timeEnd: dateRange.endDate?.date
                    ? new Date(dateRange.endDate.date).toISOString()
                    : undefined,
-                ...restFilters
+                ...filters
            };

-            // axios serializes arrays as `ip[]=…`, which express's query
-            // parser does not read back as `ip`, so pass them in the URL
-            const sp = new URLSearchParams((ip ?? []).map((ip) => ["ip", ip]));
-
-            const response = await api.get(
-                `/org/${orgId}/logs/access/export?${sp.toString()}`,
-                {
-                    responseType: "blob",
-                    params
-                }
-            );
+            const response = await api.get(`/org/${orgId}/logs/access/export`, {
+                responseType: "blob",
+                params
+            });

            const url = window.URL.createObjectURL(new Blob([response.data]));
            const link = document.createElement("a");
@@ -312,24 +297,7 @@ export default function GeneralPage() {
        },
        {
            accessorKey: "ip",
-            header: () => (
-                <span className="px-2">
-                    <ColumnMultiFilterButton
-                        options={(filters.ip ?? []).map((ip) => ({
-                            label: ip,
-                            value: ip
-                        }))}
-                        label={t("ip")}
-                        allowArbitraryValues
-                        searchPlaceholder={t("ipFilterSearchPlaceholder")}
-                        emptyMessage={t("ipFilterEmptyMessage")}
-                        selectedValues={filters.ip ?? []}
-                        onSelectedValuesChange={(value) =>
-                            handleFilterChange("ip", value)
-                        }
-                    />
-                </span>
-            ),
+            header: () => <span className="px-2">{t("ip")}</span>,
            cell: ({ row }) => {
                return row.original.ip ? (
                    row.original.ip
@@ -347,7 +315,7 @@ export default function GeneralPage() {
                            options={filterAttributes.locations.map(
                                (location) => ({
                                    value: location,
-                                    label: `${location} ${countryCodeToFlagEmoji(location)}`
+                                    label: location
                                })
                            )}
                            label={t("location")}
@@ -366,8 +334,7 @@ export default function GeneralPage() {
                    <span className="flex items-center gap-1">
                        {row.original.location ? (
                            <span className="text-muted-foreground text-xs">
-                                {row.original.location}{" "}
-                                {countryCodeToFlagEmoji(row.original.location)}
+                                {row.original.location}
                            </span>
                        ) : (
                            <span className="text-muted-foreground text-xs">
@@ -276,9 +276,7 @@ export default function AiSessionLogsPage() {
            cell: ({ row }) => {
                return (
                    <div className="whitespace-nowrap">
-                        {new Date(
-                            row.original.createdAt * 1000
-                        ).toLocaleString()}
+                        {new Date(row.original.createdAt).toLocaleString()}
                    </div>
                );
            }
@@ -717,8 +715,8 @@ function generateSampleAiSessionLogs(): QueryAiSessionLogResponse["log"] {
        null
    ];

-    const now = Math.floor(Date.now() / 1000);
-    const sevenDaysAgoMs = now - 7 * 24 * 60 * 60;
+    const now = Date.now();
+    const sevenDaysAgoMs = now - 7 * 24 * 60 * 60 * 1000;

    return Array.from({ length: 10 }, (_, i) => {
        const provider =
@@ -23,8 +23,6 @@ import { useMemo, useState, useTransition } from "react";
 import { useStoredPageSize } from "@app/hooks/useStoredPageSize";
 import type { QueryRequestAuditLogResponse } from "@server/routers/auditLogs/types";
 import { ColumnFilterButton } from "@app/components/ColumnFilterButton";
-import { countryCodeToFlagEmoji } from "@app/lib/countryCodeToFlagEmoji";
-import { ColumnMultiFilterButton } from "@app/components/ColumnMultiFilterButton";

 export default function GeneralPage() {
    const router = useRouter();
@@ -49,7 +47,6 @@ export default function GeneralPage() {
        method?: string;
        reason?: string;
        path?: string;
-        ip?: string[];
    }>({
        action: searchParams.get("action") || undefined,
        host: searchParams.get("host") || undefined,
@@ -58,8 +55,7 @@ export default function GeneralPage() {
        actor: searchParams.get("actor") || undefined,
        method: searchParams.get("method") || undefined,
        reason: searchParams.get("reason") || undefined,
-        path: searchParams.get("path") || undefined,
-        ip: searchParams.getAll("ip") || undefined
+        path: searchParams.get("path") || undefined
    });

    const getDefaultDateRange = () => {
@@ -183,7 +179,7 @@ export default function GeneralPage() {

    const handleFilterChange = (
        filterType: keyof typeof filters,
-        value: string | string[] | undefined
+        value: string | undefined
    ) => {
        const newFilters = { ...filters, [filterType]: value };
        setFilters(newFilters);
@@ -201,13 +197,10 @@ export default function GeneralPage() {
    ) => {
        const params = new URLSearchParams(searchParams);
        Object.entries(newFilters).forEach(([key, value]) => {
-            params.delete(key);
-            if (typeof value === "string") {
+            if (value) {
                params.set(key, value);
-            } else if (typeof value !== "undefined" && "length" in value) {
-                for (const element of value) {
-                    params.append(key, element);
-                }
+            } else {
+                params.delete(key);
            }
        });
        router.replace(`?${params.toString()}`, { scroll: false });
@@ -216,7 +209,6 @@ export default function GeneralPage() {
    const exportData = async () => {
        try {
            // Prepare query params for export
-            const { ip, ...restFilters } = filters;
            const params: any = {
                timeStart: dateRange.startDate?.date
                    ? new Date(dateRange.startDate.date).toISOString()
@@ -224,15 +216,11 @@ export default function GeneralPage() {
                timeEnd: dateRange.endDate?.date
                    ? new Date(dateRange.endDate.date).toISOString()
                    : undefined,
-                ...restFilters
+                ...filters
            };

-            // axios serializes arrays as `ip[]=…`, which express's query
-            // parser does not read back as `ip`, so pass them in the URL
-            const sp = new URLSearchParams((ip ?? []).map((ip) => ["ip", ip]));
-
            const response = await api.get(
-                `/org/${orgId}/logs/request/export?${sp.toString()}`,
+                `/org/${orgId}/logs/request/export`,
                {
                    responseType: "blob",
                    params
@@ -363,24 +351,7 @@ export default function GeneralPage() {
        },
        {
            accessorKey: "ip",
-            header: ({ column }) => (
-                <span className="px-2">
-                    <ColumnMultiFilterButton
-                        options={(filters.ip ?? []).map((ip) => ({
-                            label: ip,
-                            value: ip
-                        }))}
-                        label={t("ip")}
-                        allowArbitraryValues
-                        searchPlaceholder={t("ipFilterSearchPlaceholder")}
-                        emptyMessage={t("ipFilterEmptyMessage")}
-                        selectedValues={filters.ip ?? []}
-                        onSelectedValuesChange={(value) =>
-                            handleFilterChange("ip", value)
-                        }
-                    />
-                </span>
-            ),
+            header: ({ column }) => <span className="px-2">{t("ip")}</span>,
            cell: ({ row }) => {
                return row.original.ip ? (
                    row.original.ip
@@ -398,7 +369,7 @@ export default function GeneralPage() {
                            options={filterAttributes.locations.map(
                                (location) => ({
                                    value: location,
-                                    label: `${location} ${countryCodeToFlagEmoji(location)}`
+                                    label: location
                                })
                            )}
                            selectedValue={filters.location}
@@ -418,8 +389,7 @@ export default function GeneralPage() {
                    <span className="flex items-center gap-1">
                        {row.original.location ? (
                            <span className="text-muted-foreground text-xs">
-                                {row.original.location}{" "}
-                                {countryCodeToFlagEmoji(row.original.location)}
+                                {row.original.location}
                            </span>
                        ) : (
                            <span className="text-muted-foreground text-xs">
@@ -50,6 +50,8 @@ import {
 import { useEnvContext } from "@app/hooks/useEnvContext";
 import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import { toast } from "@app/hooks/useToast";
+import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
+import { tierMatrix, TierFeature } from "@server/lib/billing/tierMatrix";
 import { createApiClient, formatAxiosError } from "@app/lib/api";
 import {
    createBrowserGatewayTargetFormSchema,
@@ -57,6 +59,7 @@ import {
    selectedSiteSchema,
    type SshSettingsFormValues
 } from "@app/lib/browserGatewayTargetFormSchema";
+import { DockerManager, DockerState } from "@app/lib/docker";
 import { orgQueries } from "@app/lib/queries";
 import { finalizeSubdomainSanitize } from "@app/lib/subdomain-utils";
 import { zodResolver } from "@hookform/resolvers/zod";
@@ -325,20 +328,19 @@ export default function Page() {
    const rawResourcesAllowed =
        env.flags.allowRawResources &&
        (build !== "saas" || remoteExitNodes.length > 0);
+    const enterpriseModesAllowed =
+        !env.flags.disableEnterpriseFeatures;

    const availableTypes = useMemo((): NewResourceType[] => {
-        const base: NewResourceType[] = [
-            "http",
-            "inference",
-            "ssh",
-            "rdp",
-            "vnc"
-        ];
+        const base: NewResourceType[] = ["http", "inference"];
+        if (enterpriseModesAllowed) {
+            base.push("ssh", "rdp", "vnc");
+        }
        if (rawResourcesAllowed) {
            base.push("tcp", "udp");
        }
        return base;
-    }, [rawResourcesAllowed]);
+    }, [enterpriseModesAllowed, rawResourcesAllowed]);

    useEffect(() => {
        if (!availableTypes.includes(resourceType)) {
@@ -0,0 +1,59 @@
+import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
+import OrgsTable from "@app/components/OrgsTable";
+import { internal } from "@app/lib/api";
+import { authCookieHeader } from "@app/lib/api/cookies";
+import type { AdminListOrgsResponse } from "@server/routers/org";
+import type { AxiosResponse } from "axios";
+import type { Metadata } from "next";
+import { getTranslations } from "next-intl/server";
+
+export const metadata: Metadata = {
+    title: "Organizations"
+};
+
+export const dynamic = "force-dynamic";
+
+type OrganizationsPageProps = {
+    searchParams: Promise<Record<string, string>>;
+};
+
+export default async function OrganizationsPage(props: OrganizationsPageProps) {
+    const searchParams = new URLSearchParams(await props.searchParams);
+
+    let orgs: AdminListOrgsResponse["orgs"] = [];
+    let pagination: AdminListOrgsResponse["pagination"] = {
+        total: 0,
+        page: 1,
+        pageSize: 20
+    };
+
+    try {
+        const res = await internal.get<AxiosResponse<AdminListOrgsResponse>>(
+            `/admin/orgs?${searchParams.toString()}`,
+            await authCookieHeader()
+        );
+        const responseData = res.data.data;
+        orgs = responseData.orgs;
+        pagination = responseData.pagination;
+    } catch (e) {}
+
+    const t = await getTranslations();
+
+    return (
+        <>
+            <SettingsSectionTitle
+                title={t("orgsManage")}
+                description={t("orgsDescription")}
+            />
+
+            <OrgsTable
+                orgs={orgs}
+                rowCount={pagination.total}
+                pagination={{
+                    pageIndex: pagination.page - 1,
+                    pageSize: pagination.pageSize
+                }}
+            />
+        </>
+    );
+}
@@ -6,6 +6,7 @@ import {
    Bot,
    Boxes,
    Building2,
+    Building2Icon,
    Cable,
    ChartLine,
    Coins,
@@ -377,6 +378,11 @@ export const adminNavSections = (env?: Env): SidebarNavSection[] => [
                href: "/admin/api-keys",
                icon: <KeyRound className="size-4 flex-none" />
            },
+            {
+                title: "sidebarOrgs",
+                href: "/admin/organizations",
+                icon: <Building2Icon className="size-4 flex-none" />
+            },
            ...(build === "oss" ||
            env?.app.identityProviderMode === "global" ||
            env?.app.identityProviderMode === undefined
@@ -388,7 +394,7 @@ export const adminNavSections = (env?: Env): SidebarNavSection[] => [
                      }
                  ]
                : []),
-            ...(build == "enterprise"
+            ...(build === "enterprise"
                ? [
                      {
                          title: "sidebarLicense",
@@ -21,7 +21,7 @@ import { useTranslations } from "next-intl";

 interface FilterOption {
    value: string;
-    label: React.ReactNode;
+    label: string;
 }

 interface ColumnFilterButtonProps {
@@ -32,7 +32,6 @@ interface ColumnFilterButtonProps {
    emptyMessage?: string;
    className?: string;
    label: string;
-    allowArbitraryValues?: boolean;
 }

 export function ColumnFilterButton({
@@ -42,8 +41,7 @@ export function ColumnFilterButton({
    searchPlaceholder = "Search...",
    emptyMessage = "No options found",
    className,
-    label,
-    allowArbitraryValues
+    label
 }: ColumnFilterButtonProps) {
    const [open, setOpen] = useState(false);

@@ -103,7 +101,7 @@ export function ColumnFilterButton({
                            {options.map((option) => (
                                <CommandItem
                                    key={option.value}
-                                    value={option.value}
+                                    value={option.label}
                                    onSelect={() => {
                                        onValueChange(
                                            selectedValue === option.value
@@ -35,7 +35,6 @@ type ColumnMultiFilterButtonProps = {
    emptyMessage?: string;
    className?: string;
    label: string;
-    allowArbitraryValues?: boolean;
 };

 export function ColumnMultiFilterButton({
@@ -45,26 +44,11 @@ export function ColumnMultiFilterButton({
    searchPlaceholder = "Search...",
    emptyMessage = "No options found",
    className,
-    label,
-    allowArbitraryValues
+    label
 }: ColumnMultiFilterButtonProps) {
    const [open, setOpen] = useState(false);
-    const [searchQuery, setSearchQuery] = useState("");
    const t = useTranslations();

-    const visibleOptions = useMemo<FilterOption[]>(() => {
-        const newOptions = [...options];
-
-        if (allowArbitraryValues && searchQuery.trim().length > 0) {
-            newOptions.push({
-                label: searchQuery,
-                value: searchQuery
-            });
-        }
-
-        return newOptions;
-    }, [options, allowArbitraryValues, searchQuery]);
-
    const selectedSet = useMemo(
        () => new Set(selectedValues),
        [selectedValues]
@@ -80,7 +64,7 @@ export function ColumnMultiFilterButton({
                selectedValues[0]
            );
        }
-        return t("multiSelectFilterCount", {
+        return t("accessUsersRoleFilterCount", {
            count: selectedValues.length
        });
    }, [selectedValues, options, t]);
@@ -124,11 +108,7 @@ export function ColumnMultiFilterButton({
                align="start"
            >
                <Command>
-                    <CommandInput
-                        placeholder={searchPlaceholder}
-                        value={searchQuery}
-                        onValueChange={setSearchQuery}
-                    />
+                    <CommandInput placeholder={searchPlaceholder} />
                    <CommandList>
                        <CommandEmpty>{emptyMessage}</CommandEmpty>
                        <CommandGroup>
@@ -143,7 +123,7 @@ export function ColumnMultiFilterButton({
                                    {t("accessFilterClear")}
                                </CommandItem>
                            )}
-                            {visibleOptions.map((option) => (
+                            {options.map((option) => (
                                <CommandItem
                                    key={option.value}
                                    value={option.label}
@@ -0,0 +1,305 @@
+"use client";
+
+import { Button } from "@app/components/ui/button";
+import {
+    ControlledDataTable,
+    type ExtendedColumnDef
+} from "@app/components/ui/controlled-data-table";
+import { useNavigationContext } from "@app/hooks/useNavigationContext";
+import { toast } from "@app/hooks/useToast";
+import { getNextSortOrder, getSortDirection } from "@app/lib/sortColumn";
+import type { AdminOrgRow, DeleteOrgResponse } from "@server/routers/org";
+
+import { type PaginationState } from "@tanstack/react-table";
+import {
+    ArrowDown01Icon,
+    ArrowUp10Icon,
+    ArrowUpRight,
+    ChevronsUpDownIcon
+} from "lucide-react";
+import moment from "moment";
+import { useTranslations } from "next-intl";
+import Link from "next/link";
+import { useRouter } from "next/navigation";
+import { useMemo, useState, useTransition } from "react";
+import { useDebouncedCallback } from "use-debounce";
+import ConfirmDeleteDialog from "./ConfirmDeleteDialog";
+import { createApiClient, formatAxiosError } from "@app/lib/api";
+import type { AxiosResponse } from "axios";
+import api from "gpt-tokenizer";
+import { useEnvContext } from "@app/hooks/useEnvContext";
+
+type OrgTableProps = {
+    orgs: AdminOrgRow[];
+    pagination: PaginationState;
+    rowCount: number;
+};
+
+export default function OrgsTable({
+    orgs,
+    pagination,
+    rowCount
+}: OrgTableProps) {
+    const router = useRouter();
+    const t = useTranslations();
+    const {
+        navigate: filter,
+        isNavigating: isFiltering,
+        searchParams
+    } = useNavigationContext();
+
+    const [isRefreshing, startTransition] = useTransition();
+
+    const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
+    const [selectedOrg, setSelectedOrg] = useState<AdminOrgRow | null>();
+    const api = createApiClient(useEnvContext());
+
+    function refreshData() {
+        startTransition(async () => {
+            try {
+                router.refresh();
+            } catch (error) {
+                toast({
+                    title: t("error"),
+                    description: t("refreshError"),
+                    variant: "destructive"
+                });
+            }
+        });
+    }
+
+    function toggleSort(column: string) {
+        const newSearch = getNextSortOrder(column, searchParams);
+
+        filter({
+            searchParams: newSearch
+        });
+    }
+
+    function sortableHeader(column: string, label: string) {
+        const sortOrder = getSortDirection(column, searchParams);
+        const Icon =
+            sortOrder === "asc"
+                ? ArrowDown01Icon
+                : sortOrder === "desc"
+                  ? ArrowUp10Icon
+                  : ChevronsUpDownIcon;
+
+        return (
+            <Button
+                variant="ghost"
+                className="p-3"
+                onClick={() => toggleSort(column)}
+            >
+                {label}
+                <Icon className="ml-2 h-4 w-4" />
+            </Button>
+        );
+    }
+
+    const columns = useMemo<ExtendedColumnDef<AdminOrgRow>[]>(() => {
+        return [
+            {
+                accessorKey: "name",
+                friendlyName: t("name"),
+                enableHiding: false,
+                header: () => sortableHeader("name", t("name"))
+            },
+            {
+                accessorKey: "createdAt",
+                friendlyName: t("createdAt"),
+                header: () => sortableHeader("createdAt", t("createdAt")),
+                cell: ({ row }) => {
+                    const createdAt = row.original.createdAt;
+                    return (
+                        <span>
+                            {createdAt ? moment(createdAt).format("lll") : "-"}
+                        </span>
+                    );
+                }
+            },
+            {
+                accessorKey: "owner",
+                friendlyName: t("accessRoleOwner"),
+                header: () => (
+                    <span className="p-3">{t("accessRoleOwner")}</span>
+                ),
+                cell: ({ row }) => {
+                    const owner = row.original.owner;
+                    return owner ? (
+                        <Button
+                            className="tabular-nums"
+                            asChild
+                            variant="outline"
+                            size="sm"
+                        >
+                            <Link href={`/admin/users/${owner.userId}`}>
+                                {owner.username}
+                                <ArrowUpRight className="ml-2 h-3 w-3" />
+                            </Link>
+                        </Button>
+                    ) : (
+                        <code>-</code>
+                    );
+                }
+            },
+            {
+                accessorKey: "orgId",
+                friendlyName: t("orgId"),
+                header: () => <span className="p-3">{t("orgId")}</span>
+            },
+            {
+                accessorKey: "subnet",
+                friendlyName: t("subnet"),
+                header: () => <span className="p-3">{t("subnet")}</span>,
+                cell: ({ row }) => <span>{row.original.subnet || "-"}</span>
+            },
+            {
+                accessorKey: "utilitySubnet",
+                friendlyName: t("utilitySubnet"),
+                header: () => <span className="p-3">{t("utilitySubnet")}</span>,
+                cell: ({ row }) => (
+                    <span>{row.original.utilitySubnet || "-"}</span>
+                )
+            },
+            {
+                accessorKey: "userCount",
+                friendlyName: t("users"),
+                header: () => <span className="p-3">{t("users")}</span>,
+                cell: ({ row }) => (
+                    <span className="tabular-nums">
+                        {row.original.userCount}
+                    </span>
+                )
+            },
+            {
+                accessorKey: "siteCount",
+                friendlyName: t("sites"),
+                header: () => <span className="p-3">{t("sites")}</span>,
+                cell: ({ row }) => (
+                    <span className="tabular-nums">
+                        {row.original.siteCount}
+                    </span>
+                )
+            },
+            {
+                accessorKey: "resourceCount",
+                friendlyName: t("resources"),
+                header: () => <span className="p-3">{t("resources")}</span>,
+                cell: ({ row }) => (
+                    <span className="tabular-nums">
+                        {row.original.resourceCount}
+                    </span>
+                )
+            },
+
+            {
+                id: "actions",
+                enableHiding: false,
+                header: () => <span className="p-3"></span>,
+                cell: ({ row }) => {
+                    const orgRow = row.original;
+                    return (
+                        <div className="flex items-center gap-2 justify-end">
+                            <Button
+                                onClick={() => {
+                                    setSelectedOrg(orgRow);
+                                    setIsDeleteModalOpen(true);
+                                }}
+                                variant="outline"
+                                className="text-red-400 focus:text-destructive "
+                            >
+                                {t("delete")}
+                            </Button>
+                        </div>
+                    );
+                }
+            }
+        ];
+    }, [t, searchParams]);
+
+    const handlePaginationChange = (newPage: PaginationState) => {
+        searchParams.set("page", (newPage.pageIndex + 1).toString());
+        searchParams.set("pageSize", newPage.pageSize.toString());
+        filter({
+            searchParams
+        });
+    };
+
+    const handleSearchChange = useDebouncedCallback((query: string) => {
+        searchParams.set("query", query);
+        searchParams.delete("page");
+        filter({
+            searchParams
+        });
+    }, 300);
+
+    async function deleteOrg(orgId: string) {
+        try {
+            // TODO
+            // const res = await api.delete<AxiosResponse<DeleteOrgResponse>>(
+            //     `/org/${orgId}`
+            // );
+            toast({
+                title: t("orgDeleted"),
+                description: t("orgDeletedMessage")
+            });
+        } catch (err) {
+            console.error(err);
+            toast({
+                variant: "destructive",
+                title: t("orgErrorDelete"),
+                description: formatAxiosError(err, t("orgErrorDeleteMessage"))
+            });
+        } finally {
+            router.refresh();
+        }
+    }
+
+    return (
+        <>
+            {selectedOrg && (
+                <ConfirmDeleteDialog
+                    open={isDeleteModalOpen}
+                    setOpen={(val) => {
+                        setIsDeleteModalOpen(val);
+                        setSelectedOrg(null);
+                    }}
+                    dialog={
+                        <div className="space-y-2">
+                            <p>{t("orgQuestionRemove")}</p>
+                            <p>{t("orgMessageRemove")}</p>
+                        </div>
+                    }
+                    buttonText={t("orgDeleteConfirm")}
+                    onConfirm={async () => {
+                        startTransition(() => deleteOrg(selectedOrg.orgId));
+                    }}
+                    string={selectedOrg.name}
+                    title={t("orgDelete")}
+                />
+            )}
+            <ControlledDataTable
+                columns={columns}
+                rows={orgs}
+                tableId="admin-orgs-table"
+                searchPlaceholder={t("orgSearch")}
+                pagination={pagination}
+                onPaginationChange={handlePaginationChange}
+                searchQuery={searchParams.get("query")?.toString()}
+                onSearch={handleSearchChange}
+                onRefresh={refreshData}
+                isRefreshing={isRefreshing || isFiltering}
+                rowCount={rowCount}
+                columnVisibility={{
+                    subnet: false,
+                    utilitySubnet: false,
+                    orgId: false
+                }}
+                enableColumnVisibility
+                stickyLeftColumn="name"
+                stickyRightColumn="actions"
+            />
+        </>
+    );
+}
@@ -21,14 +21,12 @@ import { Switch } from "@app/components/ui/switch";
 import { useEnvContext } from "@app/hooks/useEnvContext";
 import { useNavigationContext } from "@app/hooks/useNavigationContext";
 import { useOptimisticLabels } from "@app/hooks/useOptimisticLabels";
-import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import { toast } from "@app/hooks/useToast";
 import { createApiClient, formatAxiosError } from "@app/lib/api";
 import { orgQueries } from "@app/lib/queries";
 import { getNextSortOrder, getSortDirection } from "@app/lib/sortColumn";
-import { build } from "@server/build";
-import { UpdateResourceResponse } from "@server/routers/resource";
 import type { GetBatchedCertificateResponse } from "@server/routers/certificates/types";
+import { UpdateResourceResponse } from "@server/routers/resource";
 import { useQuery } from "@tanstack/react-query";
 import type { PaginationState } from "@tanstack/react-table";
 import { AxiosResponse } from "axios";
@@ -52,7 +52,6 @@ import {
 } from "./ui/controlled-data-table";

 import { useOptimisticLabels } from "@app/hooks/useOptimisticLabels";
-import { durationToMs } from "@app/lib/durationToMs";
 import { orgQueries, productUpdatesQueries } from "@app/lib/queries";
 import { useQuery } from "@tanstack/react-query";
 import semver from "semver";
@@ -1,74 +0,0 @@
-import { assertEquals } from "@test/assert";
-import { detectLocale } from "./detectLocale";
-
-function runTests() {
-    assertEquals(
-        detectLocale("zh-TW,zh;q=0.9,en-US;q=0.8,en;q=0.7,ja;q=0.6"),
-        "zh-TW",
-        "An exact regional match should take precedence over a language fallback"
-    );
-    assertEquals(
-        detectLocale("ZH-tw"),
-        "zh-TW",
-        "Locale matching should be case-insensitive"
-    );
-    assertEquals(
-        detectLocale("  zh-TW ; q=1 , zh-CN;q=0.8 "),
-        "zh-TW",
-        "Whitespace and quality parameters should not prevent an exact match"
-    );
-    assertEquals(
-        detectLocale("zh-CN,zh-TW;q=0.9"),
-        "zh-CN",
-        "Simplified Chinese should still match exactly"
-    );
-    assertEquals(
-        detectLocale("zh"),
-        "zh-CN",
-        "A generic Chinese preference should retain the existing fallback"
-    );
-    assertEquals(
-        detectLocale("en-GB,en;q=0.9"),
-        "en-US",
-        "An unsupported region should fall back to a supported locale for the language"
-    );
-    assertEquals(
-        detectLocale("ja-JP,zh-TW;q=0.9"),
-        "zh-TW",
-        "The next preference should be used when a language is unsupported"
-    );
-    assertEquals(
-        detectLocale("zh-CN;q=0.5,zh-TW;q=0.9"),
-        "zh-TW",
-        "Preferences should be evaluated by quality"
-    );
-    assertEquals(
-        detectLocale("zh-TW;q=0,fr-FR;q=0.8"),
-        "fr-FR",
-        "Locales with zero quality should be excluded"
-    );
-    assertEquals(
-        detectLocale("*,de-DE;q=0.8"),
-        "de-DE",
-        "A wildcard should not obscure a supported preference"
-    );
-    assertEquals(
-        detectLocale("ja-JP"),
-        undefined,
-        "An unsupported language should not match"
-    );
-    assertEquals(
-        detectLocale(""),
-        undefined,
-        "An empty Accept-Language header should not match"
-    );
-
-    console.log("All locale detection tests passed!");
-}
-
-try {
-    runTests();
-} catch (error) {
-    console.error("Locale detection test failed:", error);
-    process.exit(1);
-}
@@ -1,48 +0,0 @@
-import { Locale, locales } from "./config";
-
-export function detectLocale(acceptLanguage: string): Locale | undefined {
-    const browserLocales = acceptLanguage
-        .split(",")
-        .map((entry, index) => {
-            const [locale, ...parameters] = entry.trim().split(";");
-            const qualityParameter = parameters.find((parameter) =>
-                parameter.trim().toLowerCase().startsWith("q=")
-            );
-            const quality = qualityParameter
-                ? Number(qualityParameter.trim().slice(2))
-                : 1;
-
-            return {
-                locale: locale.trim().toLowerCase(),
-                quality,
-                index
-            };
-        })
-        .filter(
-            ({ locale, quality }) =>
-                locale && locale !== "*" && quality > 0 && quality <= 1
-        )
-        .sort(
-            (left, right) =>
-                right.quality - left.quality || left.index - right.index
-        );
-
-    for (const { locale: browserLocale } of browserLocales) {
-        const exactMatch = locales.find(
-            (locale) => locale.toLowerCase() === browserLocale
-        );
-        if (exactMatch) {
-            return exactMatch;
-        }
-
-        const browserLanguage = browserLocale.split("-")[0];
-        const languageMatch = locales.find(
-            (locale) => locale.split("-")[0].toLowerCase() === browserLanguage
-        );
-        if (languageMatch) {
-            return languageMatch;
-        }
-    }
-
-    return undefined;
-}
@@ -1,8 +1,3 @@
-import {
-    getAiBudgetScopeListPath,
-    type AiBudgetScope
-} from "@app/lib/aiBudgetScope";
-import type { AiProviderType } from "@app/lib/aiProviderDefaults";
 import type { LauncherQueryFilters } from "@app/lib/launcherSearchParams";
 import { buildLauncherSearchParams } from "@app/lib/launcherSearchParams";
 import { build } from "@server/build";
@@ -10,21 +5,15 @@ import {
    StatusHistoryResponse,
    type BatchedStatusHistoryResponse
 } from "@server/lib/statusHistory";
-import type { ListAiBudgetsByScopeResponse } from "@server/routers/aiBudget/types";
-import type {
-    ListAiModelsResponse,
-    ListAiProvidersResponse,
-    ListCatalogModelsResponse
-} from "@server/routers/aiProvider/types";
 import type { ListAlertRulesResponse } from "@server/routers/alertRule/types";
 import type {
+    QueryRequestAnalyticsResponse,
    QueryAiUsageFilterOptionsResponse,
    QueryAiUsageOverviewResponse,
    QueryAiUsageProvidersResponse,
    QueryAiUsageResourcesResponse,
    QueryAiUsageUsersRolesResponse,
-    QueryAiUsageVirtualApiKeysResponse,
-    QueryRequestAnalyticsResponse
+    QueryAiUsageVirtualApiKeysResponse
 } from "@server/routers/auditLogs";
 import type {
    QueryAccessAuditLogResponse,
@@ -45,7 +34,6 @@ import type {
 import type { GetDomainResponse } from "@server/routers/domain/getDomain";
 import { ListHealthChecksResponse } from "@server/routers/healthChecks/types";
 import type { ListOrgLabelsResponse } from "@server/routers/labels/types";
-import type { ListLauncherAiModelsResponse } from "@server/routers/launcher/listLauncherAiModels";
 import type {
    LauncherResource,
    ListLauncherGroupsResponse,
@@ -55,8 +43,9 @@ import type {
    ListLauncherSitesResponse,
    ListLauncherViewsResponse
 } from "@server/routers/launcher/types";
+import type { ListLauncherAiModelsResponse } from "@server/routers/launcher/listLauncherAiModels";
+import type { ListMyVirtualApiKeysResponse } from "@server/routers/virtualApiKey/types";
 import type { GetResourcePolicyResponse } from "@server/routers/policy";
-import type { ListRemoteExitNodesResponse } from "@server/routers/remoteExitNode/types";
 import type {
    GetResourcePoliciesResponse,
    GetResourceWhitelistResponse,
@@ -70,6 +59,7 @@ import type {
 import type { GetResourceResponse } from "@server/routers/resource/getResource";
 import type { GetResourceAuthInfoResponse } from "@server/routers/resource/getResourceAuthInfo";
 import type { ListResourcePoliciesResponse } from "@server/routers/resource/types";
+import type { ListRemoteExitNodesResponse } from "@server/routers/remoteExitNode/types";
 import type { ListRolesResponse } from "@server/routers/role";
 import type { ListSitesResponse } from "@server/routers/site";
 import type {
@@ -81,8 +71,18 @@ import type {
 } from "@server/routers/siteResource";
 import type { GetSiteResourceResponse } from "@server/routers/siteResource/getSiteResource";
 import type { ListTargetsResponse } from "@server/routers/target";
+import type {
+    ListAiModelsResponse,
+    ListAiProvidersResponse,
+    ListCatalogModelsResponse
+} from "@server/routers/aiProvider/types";
+import type { AiProviderType } from "@app/lib/aiProviderDefaults";
+import type { ListAiBudgetsByScopeResponse } from "@server/routers/aiBudget/types";
+import {
+    getAiBudgetScopeListPath,
+    type AiBudgetScope
+} from "@app/lib/aiBudgetScope";
 import type { ListUsersResponse } from "@server/routers/user";
-import type { ListMyVirtualApiKeysResponse } from "@server/routers/virtualApiKey/types";
 import type ResponseT from "@server/types/Response";
 import {
    infiniteQueryOptions,
@@ -1000,8 +1000,7 @@ export const httpLogsFiltersSchema = z.object({
    actor: z.string().optional().catch(undefined),
    method: z.string().optional().catch(undefined),
    reason: z.string().optional().catch(undefined),
-    path: z.string().optional().catch(undefined),
-    ip: z.array(z.string()).optional().catch(undefined)
+    path: z.string().optional().catch(undefined)
 });

 export type HttpLogFilters = z.output<typeof httpLogsFiltersSchema>;
@@ -1027,8 +1026,7 @@ export const accessLogsFiltersSchema = z.object({
    action: z.string().optional().catch(undefined),
    location: z.string().optional().catch(undefined),
    actor: z.string().optional().catch(undefined),
-    type: z.string().optional().catch(undefined),
-    ip: z.array(z.string()).optional().catch(undefined)
+    type: z.string().optional().catch(undefined)
 });

 export type AccessLogFilters = z.output<typeof accessLogsFiltersSchema>;
@@ -1141,13 +1139,10 @@ export const logQueries = {
        queryOptions({
            queryKey: ["REQUEST_LOGS", orgId, "ALL", filters] as const,
            queryFn: async ({ signal, meta }) => {
-                const { page, pageSize, ip, ...rest } = filters;
-                const sp = new URLSearchParams(
-                    (ip ?? []).map((ip) => ["ip", ip])
-                );
+                const { page, pageSize, ...rest } = filters;
                const res = await meta!.api.get<
                    AxiosResponse<QueryRequestAuditLogResponse>
-                >(`/org/${orgId}/logs/request?${sp.toString()}`, {
+                >(`/org/${orgId}/logs/request`, {
                    params: {
                        ...rest,
                        limit: pageSize,
@@ -1169,13 +1164,10 @@ export const logQueries = {
        queryOptions({
            queryKey: ["ACCESS_LOGS", orgId, "ALL", filters] as const,
            queryFn: async ({ signal, meta }) => {
-                const { page, pageSize, ip, ...rest } = filters;
-                const sp = new URLSearchParams(
-                    (ip ?? []).map((ip) => ["ip", ip])
-                );
+                const { page, pageSize, ...rest } = filters;
                const res = await meta!.api.get<
                    AxiosResponse<QueryAccessAuditLogResponse>
-                >(`/org/${orgId}/logs/access?${sp.toString()}`, {
+                >(`/org/${orgId}/logs/access`, {
                    params: {
                        ...rest,
                        limit: pageSize,
@@ -2,7 +2,6 @@

 import { cookies, headers } from "next/headers";
 import { Locale, defaultLocale, locales } from "@/i18n/config";
-import { detectLocale } from "@/i18n/detectLocale";
 import { internal } from "@app/lib/api";
 import { authCookieHeader } from "@app/lib/api/cookies";

@@ -48,7 +47,12 @@ export async function getUserLocale(): Promise<Locale> {
    const acceptLang = headerList.get("accept-language");

    if (acceptLang) {
-        const matched = detectLocale(acceptLang);
+        const browserLang = acceptLang.split(",")[0];
+        const matched = locales.find((locale) =>
+            browserLang
+                .toLowerCase()
+                .startsWith(locale.split("-")[0].toLowerCase())
+        );
        if (matched) {
            return matched;
        }
Author	SHA1	Message	Date
Fred KISSIE	c411a1a5b9	🚧 wip	2026-08-28 22:49:51 +02:00
Fred KISSIE	a4d9365563	♻️ Only show the username instead of the `name+username`	2026-08-28 22:09:01 +02:00
Fred KISSIE	e9f7678b90	✨ List of orgs, with all columns	2026-08-28 22:00:06 +02:00
Fred KISSIE	a904c915d8	✨ List orgs in server	2026-08-28 21:42:20 +02:00
Fred KISSIE	cb84c2954b	🚧 WIP	2026-08-27 00:03:56 +02:00