chore(hook): Add feature control

chore(fe): polish file previews more (#9259 )
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
2026-03-16 05:02:39 +00:00 · 2026-03-12 19:28:48 -07:00 · 2026-03-12 22:37:00 +00:00 · 2026-03-12 22:17:56 +00:00 · 2026-03-12 14:33:57 -07:00 · 2026-03-12 21:06:13 +00:00
79 changed files with 3285 additions and 419 deletions
--- a/.github/workflows/deployment.yml
+++ b/.github/workflows/deployment.yml
@@ -29,20 +29,32 @@ jobs:
      build-backend-craft: ${{ steps.check.outputs.build-backend-craft }}
      build-model-server: ${{ steps.check.outputs.build-model-server }}
      is-cloud-tag: ${{ steps.check.outputs.is-cloud-tag }}
-      is-stable: ${{ steps.check.outputs.is-stable }}
      is-beta: ${{ steps.check.outputs.is-beta }}
-      is-stable-standalone: ${{ steps.check.outputs.is-stable-standalone }}
      is-beta-standalone: ${{ steps.check.outputs.is-beta-standalone }}
-      is-craft-latest: ${{ steps.check.outputs.is-craft-latest }}
+      is-latest: ${{ steps.check.outputs.is-latest }}
      is-test-run: ${{ steps.check.outputs.is-test-run }}
      sanitized-tag: ${{ steps.check.outputs.sanitized-tag }}
      short-sha: ${{ steps.check.outputs.short-sha }}
    steps:
+      - name: Checkout (for git tags)
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # ratchet:astral-sh/setup-uv@v7
+        with:
+          version: "0.9.9"
+          enable-cache: false
+
      - name: Check which components to build and version info
        id: check
        env:
          EVENT_NAME: ${{ github.event_name }}
        run: |
+          set -eo pipefail
          TAG="${GITHUB_REF_NAME}"
          # Sanitize tag name by replacing slashes with hyphens (for Docker tag compatibility)
          SANITIZED_TAG=$(echo "$TAG" | tr '/' '-')
@@ -54,9 +66,8 @@ jobs:
          IS_VERSION_TAG=false
          IS_STABLE=false
          IS_BETA=false
-          IS_STABLE_STANDALONE=false
          IS_BETA_STANDALONE=false
-          IS_CRAFT_LATEST=false
+          IS_LATEST=false
          IS_PROD_TAG=false
          IS_TEST_RUN=false
          BUILD_DESKTOP=false
@@ -67,9 +78,6 @@ jobs:
          BUILD_MODEL_SERVER=true

          # Determine tag type based on pattern matching (do regex checks once)
-          if [[ "$TAG" == craft-* ]]; then
-            IS_CRAFT_LATEST=true
-          fi
          if [[ "$TAG" == *cloud* ]]; then
            IS_CLOUD=true
          fi
@@ -97,20 +105,28 @@ jobs:
            fi
          fi

-          # Craft-latest builds backend with Craft enabled
-          if [[ "$IS_CRAFT_LATEST" == "true" ]]; then
-            BUILD_BACKEND_CRAFT=true
-            BUILD_BACKEND=false
-          fi
-
          # Standalone version checks (for backend/model-server - version excluding cloud tags)
-          if [[ "$IS_STABLE" == "true" ]] && [[ "$IS_CLOUD" != "true" ]]; then
-            IS_STABLE_STANDALONE=true
-          fi
          if [[ "$IS_BETA" == "true" ]] && [[ "$IS_CLOUD" != "true" ]]; then
            IS_BETA_STANDALONE=true
          fi

+          # Determine if this tag should get the "latest" Docker tag.
+          # Only the highest semver stable tag (vX.Y.Z exactly) gets "latest".
+          if [[ "$IS_STABLE" == "true" ]]; then
+            HIGHEST_STABLE=$(uv run --no-sync --with onyx-devtools ods latest-stable-tag) || {
+              echo "::error::Failed to determine highest stable tag via 'ods latest-stable-tag'"
+              exit 1
+            }
+            if [[ "$TAG" == "$HIGHEST_STABLE" ]]; then
+              IS_LATEST=true
+            fi
+          fi
+
+          # Build craft-latest backend alongside the regular latest.
+          if [[ "$IS_LATEST" == "true" ]]; then
+            BUILD_BACKEND_CRAFT=true
+          fi
+
          # Determine if this is a production tag
          # Production tags are: version tags (v1.2.3*) or nightly tags
          if [[ "$IS_VERSION_TAG" == "true" ]] || [[ "$IS_NIGHTLY" == "true" ]]; then
@@ -129,11 +145,9 @@ jobs:
            echo "build-backend-craft=$BUILD_BACKEND_CRAFT"
            echo "build-model-server=$BUILD_MODEL_SERVER"
            echo "is-cloud-tag=$IS_CLOUD"
-            echo "is-stable=$IS_STABLE"
            echo "is-beta=$IS_BETA"
-            echo "is-stable-standalone=$IS_STABLE_STANDALONE"
            echo "is-beta-standalone=$IS_BETA_STANDALONE"
-            echo "is-craft-latest=$IS_CRAFT_LATEST"
+            echo "is-latest=$IS_LATEST"
            echo "is-test-run=$IS_TEST_RUN"
            echo "sanitized-tag=$SANITIZED_TAG"
            echo "short-sha=$SHORT_SHA"
@@ -600,7 +614,7 @@ jobs:
            latest=false
          tags: |
            type=raw,value=${{ needs.determine-builds.outputs.is-test-run == 'true' && format('web-{0}', needs.determine-builds.outputs.sanitized-tag) || github.ref_name }}
-            type=raw,value=${{ needs.determine-builds.outputs.is-test-run != 'true' && needs.determine-builds.outputs.is-stable == 'true' && 'latest' || '' }}
+            type=raw,value=${{ needs.determine-builds.outputs.is-test-run != 'true' && needs.determine-builds.outputs.is-latest == 'true' && 'latest' || '' }}
            type=raw,value=${{ needs.determine-builds.outputs.is-test-run != 'true' && env.EDGE_TAG == 'true' && 'edge' || '' }}
            type=raw,value=${{ needs.determine-builds.outputs.is-test-run != 'true' && needs.determine-builds.outputs.is-beta == 'true' && 'beta' || '' }}

@@ -1037,7 +1051,7 @@ jobs:
            latest=false
          tags: |
            type=raw,value=${{ needs.determine-builds.outputs.is-test-run == 'true' && format('backend-{0}', needs.determine-builds.outputs.sanitized-tag) || github.ref_name }}
-            type=raw,value=${{ needs.determine-builds.outputs.is-test-run != 'true' && needs.determine-builds.outputs.is-stable-standalone == 'true' && 'latest' || '' }}
+            type=raw,value=${{ needs.determine-builds.outputs.is-test-run != 'true' && needs.determine-builds.outputs.is-latest == 'true' && 'latest' || '' }}
            type=raw,value=${{ needs.determine-builds.outputs.is-test-run != 'true' && env.EDGE_TAG == 'true' && 'edge' || '' }}
            type=raw,value=${{ needs.determine-builds.outputs.is-test-run != 'true' && needs.determine-builds.outputs.is-beta-standalone == 'true' && 'beta' || '' }}

@@ -1473,7 +1487,7 @@ jobs:
            latest=false
          tags: |
            type=raw,value=${{ needs.determine-builds.outputs.is-test-run == 'true' && format('model-server-{0}', needs.determine-builds.outputs.sanitized-tag) || github.ref_name }}
-            type=raw,value=${{ needs.determine-builds.outputs.is-test-run != 'true' && needs.determine-builds.outputs.is-stable-standalone == 'true' && 'latest' || '' }}
+            type=raw,value=${{ needs.determine-builds.outputs.is-test-run != 'true' && needs.determine-builds.outputs.is-latest == 'true' && 'latest' || '' }}
            type=raw,value=${{ needs.determine-builds.outputs.is-test-run != 'true' && env.EDGE_TAG == 'true' && 'edge' || '' }}
            type=raw,value=${{ needs.determine-builds.outputs.is-test-run != 'true' && needs.determine-builds.outputs.is-beta-standalone == 'true' && 'beta' || '' }}

--- a/.github/workflows/pr-helm-chart-testing.yml
+++ b/.github/workflows/pr-helm-chart-testing.yml
@@ -133,7 +133,7 @@ jobs:
          echo "=== Validating chart dependencies ==="
          cd deployment/helm/charts/onyx
          helm dependency update
-          helm lint .
+          helm lint . --set auth.userauth.values.user_auth_secret=placeholder

      - name: Run chart-testing (install) with enhanced monitoring
        timeout-minutes: 25
@@ -194,6 +194,7 @@ jobs:
              --set=vespa.enabled=false \
              --set=opensearch.enabled=true \
              --set=auth.opensearch.enabled=true \
+              --set=auth.userauth.values.user_auth_secret=test-secret \
              --set=slackbot.enabled=false \
              --set=postgresql.enabled=true \
              --set=postgresql.cluster.storage.storageClass=standard \
@@ -230,6 +231,10 @@ jobs:
        if: steps.list-changed.outputs.changed == 'true'
        run: |
          echo "=== Post-install verification ==="
+          if ! kubectl cluster-info >/dev/null 2>&1; then
+            echo "ERROR: Kubernetes cluster is not reachable after install"
+            exit 1
+          fi
          kubectl get pods --all-namespaces
          kubectl get services --all-namespaces
          # Only show issues if they exist
@@ -239,6 +244,10 @@ jobs:
        if: failure() && steps.list-changed.outputs.changed == 'true'
        run: |
          echo "=== Cleanup on failure ==="
+          if ! kubectl cluster-info >/dev/null 2>&1; then
+            echo "Skipping failure cleanup: Kubernetes cluster is not reachable"
+            exit 0
+          fi
          echo "=== Final cluster state ==="
          kubectl get pods --all-namespaces
          kubectl get events --all-namespaces --sort-by=.lastTimestamp | tail -10
--- a/backend/alembic/versions/27fb147a843f_add_timestamps_to_user_table.py
+++ b/backend/alembic/versions/27fb147a843f_add_timestamps_to_user_table.py
@@ -0,0 +1,43 @@
+"""add timestamps to user table
+
+Revision ID: 27fb147a843f
+Revises: b5c4d7e8f9a1
+Create Date: 2026-03-08 17:18:40.828644
+
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = "27fb147a843f"
+down_revision = "b5c4d7e8f9a1"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "user",
+        sa.Column(
+            "created_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.func.now(),
+            nullable=False,
+        ),
+    )
+    op.add_column(
+        "user",
+        sa.Column(
+            "updated_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.func.now(),
+            nullable=False,
+        ),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("user", "updated_at")
+    op.drop_column("user", "created_at")
--- a/backend/onyx/configs/app_configs.py
+++ b/backend/onyx/configs/app_configs.py
@@ -1042,6 +1042,8 @@ POD_NAMESPACE = os.environ.get("POD_NAMESPACE")

 DEV_MODE = os.environ.get("DEV_MODE", "").lower() == "true"

+HOOK_ENABLED = os.environ.get("HOOK_ENABLED", "").lower() == "true"
+
 INTEGRATION_TESTS_MODE = os.environ.get("INTEGRATION_TESTS_MODE", "").lower() == "true"

 #####
--- a/backend/onyx/connectors/sharepoint/connector.py
+++ b/backend/onyx/connectors/sharepoint/connector.py
@@ -272,6 +272,15 @@ class SizeCapExceeded(Exception):
    """Exception raised when the size cap is exceeded."""


+def _log_and_raise_for_status(response: requests.Response) -> None:
+    """Log the response text and raise for status."""
+    try:
+        response.raise_for_status()
+    except Exception:
+        logger.error(f"Graph API request failed: {response.text}")
+        raise
+
+
 def load_certificate_from_pfx(pfx_data: bytes, password: str) -> CertificateData | None:
    """Load certificate from .pfx file for MSAL authentication"""
    try:
@@ -348,7 +357,7 @@ def _probe_remote_size(url: str, timeout: int) -> int | None:
    """Determine remote size using HEAD or a range GET probe. Returns None if unknown."""
    try:
        head_resp = requests.head(url, timeout=timeout, allow_redirects=True)
-        head_resp.raise_for_status()
+        _log_and_raise_for_status(head_resp)
        cl = head_resp.headers.get("Content-Length")
        if cl and cl.isdigit():
            return int(cl)
@@ -363,7 +372,7 @@ def _probe_remote_size(url: str, timeout: int) -> int | None:
            timeout=timeout,
            stream=True,
        ) as range_resp:
-            range_resp.raise_for_status()
+            _log_and_raise_for_status(range_resp)
            cr = range_resp.headers.get("Content-Range")  # e.g., "bytes 0-0/12345"
            if cr and "/" in cr:
                total = cr.split("/")[-1]
@@ -388,7 +397,7 @@ def _download_with_cap(url: str, timeout: int, cap: int) -> bytes:
    - Returns the full bytes if the content fits within `cap`.
    """
    with requests.get(url, stream=True, timeout=timeout) as resp:
-        resp.raise_for_status()
+        _log_and_raise_for_status(resp)

        # If the server provides Content-Length, prefer an early decision.
        cl_header = resp.headers.get("Content-Length")
@@ -432,7 +441,7 @@ def _download_via_graph_api(
    with requests.get(
        url, headers=headers, stream=True, timeout=REQUEST_TIMEOUT_SECONDS
    ) as resp:
-        resp.raise_for_status()
+        _log_and_raise_for_status(resp)
        buf = io.BytesIO()
        for chunk in resp.iter_content(64 * 1024):
            if not chunk:
@@ -1313,7 +1322,7 @@ class SharepointConnector(
                        access_token = self._get_graph_access_token()
                        headers = {"Authorization": f"Bearer {access_token}"}
                        continue
-                response.raise_for_status()
+                _log_and_raise_for_status(response)
                return response.json()
            except (requests.ConnectionError, requests.Timeout):
                if attempt < GRAPH_API_MAX_RETRIES:
--- a/backend/onyx/db/models.py
+++ b/backend/onyx/db/models.py
@@ -339,6 +339,16 @@ class User(SQLAlchemyBaseUserTableUUID, Base):
        TIMESTAMPAware(timezone=True), nullable=True
    )

+    created_at: Mapped[datetime.datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), nullable=False
+    )
+    updated_at: Mapped[datetime.datetime] = mapped_column(
+        DateTime(timezone=True),
+        server_default=func.now(),
+        onupdate=func.now(),
+        nullable=False,
+    )
+
    default_model: Mapped[str] = mapped_column(Text, nullable=True)
    # organized in typical structured fashion
    # formatted as `displayName__provider__modelName`
--- a/backend/onyx/db/users.py
+++ b/backend/onyx/db/users.py
@@ -4,6 +4,7 @@ from uuid import UUID

 from fastapi import HTTPException
 from fastapi_users.password import PasswordHelper
+from sqlalchemy import case
 from sqlalchemy import func
 from sqlalchemy import select
 from sqlalchemy.exc import IntegrityError
@@ -11,6 +12,7 @@ from sqlalchemy.orm import Session
 from sqlalchemy.sql import expression
 from sqlalchemy.sql.elements import ColumnElement
 from sqlalchemy.sql.elements import KeyedColumnElement
+from sqlalchemy.sql.expression import or_

 from onyx.auth.invited_users import remove_user_from_invited_users
 from onyx.auth.schemas import UserRole
@@ -24,6 +26,7 @@ from onyx.db.models import Persona__User
 from onyx.db.models import SamlAccount
 from onyx.db.models import User
 from onyx.db.models import User__UserGroup
+from onyx.db.models import UserGroup
 from onyx.utils.variable_functionality import fetch_ee_implementation_or_noop


@@ -162,7 +165,13 @@ def _get_accepted_user_where_clause(
        where_clause.append(User.role != UserRole.EXT_PERM_USER)

    if email_filter_string is not None:
-        where_clause.append(email_col.ilike(f"%{email_filter_string}%"))
+        personal_name_col: KeyedColumnElement[Any] = User.__table__.c.personal_name
+        where_clause.append(
+            or_(
+                email_col.ilike(f"%{email_filter_string}%"),
+                personal_name_col.ilike(f"%{email_filter_string}%"),
+            )
+        )

    if roles_filter:
        where_clause.append(User.role.in_(roles_filter))
@@ -173,6 +182,21 @@ def _get_accepted_user_where_clause(
    return where_clause


+def get_all_accepted_users(
+    db_session: Session,
+    include_external: bool = False,
+) -> Sequence[User]:
+    """Returns all accepted users without pagination.
+    Uses the same filtering as the paginated endpoint but without
+    search, role, or active filters."""
+    stmt = select(User)
+    where_clause = _get_accepted_user_where_clause(
+        include_external=include_external,
+    )
+    stmt = stmt.where(*where_clause).order_by(User.email)
+    return db_session.scalars(stmt).unique().all()
+
+
 def get_page_of_filtered_users(
    db_session: Session,
    page_size: int,
@@ -218,6 +242,41 @@ def get_total_filtered_users_count(
    return db_session.scalar(total_count_stmt) or 0


+def get_user_counts_by_role_and_status(
+    db_session: Session,
+) -> dict[str, dict[str, int]]:
+    """Returns user counts grouped by role and by active/inactive status.
+
+    Excludes API key users, anonymous users, and no-auth placeholder users.
+    Uses a single query with conditional aggregation.
+    """
+    base_where = _get_accepted_user_where_clause()
+    role_col = User.__table__.c.role
+    is_active_col = User.__table__.c.is_active
+
+    stmt = (
+        select(
+            role_col,
+            func.count().label("total"),
+            func.sum(case((is_active_col.is_(True), 1), else_=0)).label("active"),
+            func.sum(case((is_active_col.is_(False), 1), else_=0)).label("inactive"),
+        )
+        .where(*base_where)
+        .group_by(role_col)
+    )
+
+    role_counts: dict[str, int] = {}
+    status_counts: dict[str, int] = {"active": 0, "inactive": 0}
+
+    for role_val, total, active, inactive in db_session.execute(stmt).all():
+        key = role_val.value if hasattr(role_val, "value") else str(role_val)
+        role_counts[key] = total
+        status_counts["active"] += active or 0
+        status_counts["inactive"] += inactive or 0
+
+    return {"role_counts": role_counts, "status_counts": status_counts}
+
+
 def get_user_by_email(email: str, db_session: Session) -> User | None:
    user = (
        db_session.query(User)
@@ -294,24 +353,23 @@ def batch_add_ext_perm_user_if_not_exists(
    lower_emails = [email.lower() for email in emails]
    found_users, missing_lower_emails = _get_users_by_emails(db_session, lower_emails)

-    new_users: list[User] = []
+    # Use savepoints (begin_nested) so that a failed insert only rolls back
+    # that single user, not the entire transaction. A plain rollback() would
+    # discard all previously flushed users in the same transaction.
+    # We also avoid add_all() because SQLAlchemy 2.0's insertmanyvalues
+    # batch path hits a UUID sentinel mismatch with server_default columns.
    for email in missing_lower_emails:
-        new_users.append(_generate_ext_permissioned_user(email=email))
+        user = _generate_ext_permissioned_user(email=email)
+        savepoint = db_session.begin_nested()
+        try:
+            db_session.add(user)
+            savepoint.commit()
+        except IntegrityError:
+            savepoint.rollback()
+            if not continue_on_error:
+                raise

-    try:
-        db_session.add_all(new_users)
-        db_session.commit()
-    except IntegrityError:
-        db_session.rollback()
-        if not continue_on_error:
-            raise
-        for user in new_users:
-            try:
-                db_session.add(user)
-                db_session.commit()
-            except IntegrityError:
-                db_session.rollback()
-                continue
+    db_session.commit()
    # Fetch all users again to ensure we have the most up-to-date list
    all_users, _ = _get_users_by_emails(db_session, lower_emails)
    return all_users
@@ -358,3 +416,28 @@ def delete_user_from_db(
    # NOTE: edge case may exist with race conditions
    # with this `invited user` scheme generally.
    remove_user_from_invited_users(user_to_delete.email)
+
+
+def batch_get_user_groups(
+    db_session: Session,
+    user_ids: list[UUID],
+) -> dict[UUID, list[tuple[int, str]]]:
+    """Fetch group memberships for a batch of users in a single query.
+    Returns a mapping of user_id -> list of (group_id, group_name) tuples."""
+    if not user_ids:
+        return {}
+
+    rows = db_session.execute(
+        select(
+            User__UserGroup.user_id,
+            UserGroup.id,
+            UserGroup.name,
+        )
+        .join(UserGroup, UserGroup.id == User__UserGroup.user_group_id)
+        .where(User__UserGroup.user_id.in_(user_ids))
+    ).all()
+
+    result: dict[UUID, list[tuple[int, str]]] = {uid: [] for uid in user_ids}
+    for user_id, group_id, group_name in rows:
+        result[user_id].append((group_id, group_name))
+    return result
--- a/backend/onyx/hooks/init.py
+++ b/backend/onyx/hooks/init.py
--- a/backend/onyx/hooks/api_dependencies.py
+++ b/backend/onyx/hooks/api_dependencies.py
@@ -0,0 +1,26 @@
+from onyx.configs.app_configs import HOOK_ENABLED
+from onyx.error_handling.error_codes import OnyxErrorCode
+from onyx.error_handling.exceptions import OnyxError
+from shared_configs.configs import MULTI_TENANT
+
+
+def require_hook_enabled() -> None:
+    """FastAPI dependency that gates all hook management endpoints.
+
+    Hooks are only available in single-tenant / self-hosted deployments with
+    HOOK_ENABLED=true explicitly set. Two layers of protection:
+      1. MULTI_TENANT check — rejects even if HOOK_ENABLED is accidentally set true
+      2. HOOK_ENABLED flag — explicit opt-in by the operator
+
+    Use as: Depends(require_hook_enabled)
+    """
+    if MULTI_TENANT:
+        raise OnyxError(
+            OnyxErrorCode.NOT_FOUND,
+            "Custom code hooks are not available in multi-tenant deployments",
+        )
+    if not HOOK_ENABLED:
+        raise OnyxError(
+            OnyxErrorCode.NOT_FOUND,
+            "Custom code hooks are not enabled. Set HOOK_ENABLED=true to enable.",
+        )
--- a/backend/onyx/llm/model_metadata_enrichments.json
+++ b/backend/onyx/llm/model_metadata_enrichments.json
@@ -3782,16 +3782,6 @@
    "display_name": "Claude Sonnet 3.5",
    "model_vendor": "anthropic"
  },
-  "vertex_ai/claude-3-5-sonnet-v2": {
-    "display_name": "Claude Sonnet 3.5",
-    "model_vendor": "anthropic",
-    "model_version": "v2"
-  },
-  "vertex_ai/claude-3-5-sonnet-v2@20241022": {
-    "display_name": "Claude Sonnet 3.5 v2",
-    "model_vendor": "anthropic",
-    "model_version": "20241022"
-  },
  "vertex_ai/claude-3-5-sonnet@20240620": {
    "display_name": "Claude Sonnet 3.5",
    "model_vendor": "anthropic",
--- a/backend/onyx/onyxbot/slack/constants.py
+++ b/backend/onyx/onyxbot/slack/constants.py
@@ -1,5 +1,9 @@
+import re
 from enum import Enum

+# Matches Slack channel references like <#C097NBWMY8Y> or <#C097NBWMY8Y|channel-name>
+SLACK_CHANNEL_REF_PATTERN = re.compile(r"<#([A-Z0-9]+)(?:\|([^>]+))?>")
+
 LIKE_BLOCK_ACTION_ID = "feedback-like"
 DISLIKE_BLOCK_ACTION_ID = "feedback-dislike"
 SHOW_EVERYONE_ACTION_ID = "show-everyone"
--- a/backend/onyx/onyxbot/slack/handlers/handle_regular_answer.py
+++ b/backend/onyx/onyxbot/slack/handlers/handle_regular_answer.py
@@ -18,15 +18,18 @@ from onyx.configs.onyxbot_configs import ONYX_BOT_DISPLAY_ERROR_MSGS
 from onyx.configs.onyxbot_configs import ONYX_BOT_NUM_RETRIES
 from onyx.configs.onyxbot_configs import ONYX_BOT_REACT_EMOJI
 from onyx.context.search.models import BaseFilters
+from onyx.context.search.models import Tag
 from onyx.db.engine.sql_engine import get_session_with_current_tenant
 from onyx.db.models import SlackChannelConfig
 from onyx.db.models import User
 from onyx.db.persona import get_persona_by_id
 from onyx.db.users import get_user_by_email
 from onyx.onyxbot.slack.blocks import build_slack_response_blocks
+from onyx.onyxbot.slack.constants import SLACK_CHANNEL_REF_PATTERN
 from onyx.onyxbot.slack.handlers.utils import send_team_member_message
 from onyx.onyxbot.slack.models import SlackMessageInfo
 from onyx.onyxbot.slack.models import ThreadMessage
+from onyx.onyxbot.slack.utils import get_channel_from_id
 from onyx.onyxbot.slack.utils import get_channel_name_from_id
 from onyx.onyxbot.slack.utils import respond_in_thread_or_channel
 from onyx.onyxbot.slack.utils import SlackRateLimiter
@@ -41,6 +44,51 @@ srl = SlackRateLimiter()
 RT = TypeVar("RT")  # return type


+def resolve_channel_references(
+    message: str,
+    client: WebClient,
+    logger: OnyxLoggingAdapter,
+) -> tuple[str, list[Tag]]:
+    """Parse Slack channel references from a message, resolve IDs to names,
+    replace the raw markup with readable #channel-name, and return channel tags
+    for search filtering."""
+    tags: list[Tag] = []
+    channel_matches = SLACK_CHANNEL_REF_PATTERN.findall(message)
+    seen_channel_ids: set[str] = set()
+
+    for channel_id, channel_name_from_markup in channel_matches:
+        if channel_id in seen_channel_ids:
+            continue
+        seen_channel_ids.add(channel_id)
+
+        channel_name = channel_name_from_markup or None
+
+        if not channel_name:
+            try:
+                channel_info = get_channel_from_id(client=client, channel_id=channel_id)
+                channel_name = channel_info.get("name") or None
+            except Exception:
+                logger.warning(f"Failed to resolve channel name for ID: {channel_id}")
+
+            if not channel_name:
+                continue
+
+        # Replace raw Slack markup with readable channel name
+        if channel_name_from_markup:
+            message = message.replace(
+                f"<#{channel_id}|{channel_name_from_markup}>",
+                f"#{channel_name}",
+            )
+        else:
+            message = message.replace(
+                f"<#{channel_id}>",
+                f"#{channel_name}",
+            )
+        tags.append(Tag(tag_key="Channel", tag_value=channel_name))
+
+    return message, tags
+
+
 def rate_limits(
    client: WebClient, channel: str, thread_ts: Optional[str]
 ) -> Callable[[Callable[..., RT]], Callable[..., RT]]:
@@ -157,6 +205,20 @@ def handle_regular_answer(
    user_message = messages[-1]
    history_messages = messages[:-1]

+    # Resolve any <#CHANNEL_ID> references in the user message to readable
+    # channel names and extract channel tags for search filtering
+    resolved_message, channel_tags = resolve_channel_references(
+        message=user_message.message,
+        client=client,
+        logger=logger,
+    )
+
+    user_message = ThreadMessage(
+        message=resolved_message,
+        sender=user_message.sender,
+        role=user_message.role,
+    )
+
    channel_name, _ = get_channel_name_from_id(
        client=client,
        channel_id=channel,
@@ -207,6 +269,7 @@ def handle_regular_answer(
            source_type=None,
            document_set=document_set_names,
            time_cutoff=None,
+            tags=channel_tags if channel_tags else None,
        )

        new_message_request = SendMessageRequest(
@@ -231,6 +294,16 @@ def handle_regular_answer(
            slack_context_str=slack_context_str,
        )

+        # If a channel filter was applied but no results were found, override
+        # the LLM response to avoid hallucinated answers about unindexed channels
+        if channel_tags and not answer.citation_info and not answer.top_documents:
+            channel_names = ", ".join(f"#{tag.tag_value}" for tag in channel_tags)
+            answer.answer = (
+                f"No indexed data found for {channel_names}. "
+                "This channel may not be indexed, or there may be no messages "
+                "matching your query within it."
+            )
+
    except Exception as e:
        logger.exception(
            f"Unable to process message - did not successfully answer "
@@ -285,6 +358,7 @@ def handle_regular_answer(
        only_respond_if_citations
        and not answer.citation_info
        and not message_info.bypass_filters
+        and not channel_tags
    ):
        logger.error(
            f"Unable to find citations to answer: '{answer.answer}' - not answering!"
--- a/backend/onyx/server/features/projects/projects_file_utils.py
+++ b/backend/onyx/server/features/projects/projects_file_utils.py
@@ -157,10 +157,13 @@ def categorize_uploaded_files(
    """
    Categorize uploaded files based on text extractability and tokenized length.

-    - Extracts text using extract_file_text for supported plain/document extensions.
+    - Images are estimated for token cost via a patch-based heuristic.
+    - All other files are run through extract_file_text, which handles known
+      document formats (.pdf, .docx, …) and falls back to a text-detection
+      heuristic for unknown extensions (.py, .js, .rs, …).
    - Uses default tokenizer to compute token length.
-    - If token length > 100,000, reject file (unless threshold skip is enabled).
-    - If extension unsupported or text cannot be extracted, reject file.
+    - If token length > threshold, reject file (unless threshold skip is enabled).
+    - If text cannot be extracted, reject file.
    - Otherwise marked as acceptable.
    """

@@ -217,8 +220,7 @@ def categorize_uploaded_files(
                    )
                    results.rejected.append(
                        RejectedFile(
-                            filename=filename,
-                            reason=f"Unsupported file type: {extension}",
+                            filename=filename, reason="Unsupported file contents"
                        )
                    )
                    continue
@@ -235,8 +237,10 @@ def categorize_uploaded_files(
                    results.acceptable_file_to_token_count[filename] = token_count
                continue

-            # Otherwise, handle as text/document: extract text and count tokens
-            elif extension in OnyxFileExtensions.ALL_ALLOWED_EXTENSIONS:
+            # Handle as text/document: attempt text extraction and count tokens.
+            # This accepts any file that extract_file_text can handle, including
+            # code files (.py, .js, .rs, etc.) via its is_text_file() fallback.
+            else:
                if is_file_password_protected(
                    file=upload.file,
                    file_name=filename,
@@ -259,7 +263,10 @@ def categorize_uploaded_files(
                if not text_content:
                    logger.warning(f"No text content extracted from '{filename}'")
                    results.rejected.append(
-                        RejectedFile(filename=filename, reason="Could not read file")
+                        RejectedFile(
+                            filename=filename,
+                            reason=f"Unsupported file type: {extension}",
+                        )
                    )
                    continue

@@ -282,17 +289,6 @@ def categorize_uploaded_files(
                    logger.warning(
                        f"Failed to reset file pointer for '{filename}': {str(e)}"
                    )
-                continue
-
-            # If not recognized as supported types above, mark unsupported
-            logger.warning(
-                f"Unsupported file extension '{extension}' for file '{filename}'"
-            )
-            results.rejected.append(
-                RejectedFile(
-                    filename=filename, reason=f"Unsupported file type: {extension}"
-                )
-            )
        except Exception as e:
            logger.warning(
                f"Failed to process uploaded file '{get_safe_filename(upload)}' (error_type={type(e).__name__}, error={str(e)})"
--- a/backend/onyx/server/manage/users.py
+++ b/backend/onyx/server/manage/users.py
@@ -5,6 +5,7 @@ from datetime import datetime
 from datetime import timedelta
 from datetime import timezone
 from typing import cast
+from uuid import UUID

 import jwt
 from email_validator import EmailNotValidError
@@ -18,6 +19,7 @@ from fastapi import Query
 from fastapi import Request
 from fastapi.responses import StreamingResponse
 from pydantic import BaseModel
+from sqlalchemy import select
 from sqlalchemy.orm import Session

 from onyx.auth.anonymous_user import fetch_anonymous_user_info
@@ -67,11 +69,14 @@ from onyx.db.user_preferences import update_user_role
 from onyx.db.user_preferences import update_user_shortcut_enabled
 from onyx.db.user_preferences import update_user_temperature_override_enabled
 from onyx.db.user_preferences import update_user_theme_preference
+from onyx.db.users import batch_get_user_groups
 from onyx.db.users import delete_user_from_db
+from onyx.db.users import get_all_accepted_users
 from onyx.db.users import get_all_users
 from onyx.db.users import get_page_of_filtered_users
 from onyx.db.users import get_total_filtered_users_count
 from onyx.db.users import get_user_by_email
+from onyx.db.users import get_user_counts_by_role_and_status
 from onyx.db.users import validate_user_role_update
 from onyx.key_value_store.factory import get_kv_store
 from onyx.redis.redis_pool import get_raw_redis_client
@@ -98,6 +103,7 @@ from onyx.server.manage.models import UserSpecificAssistantPreferences
 from onyx.server.models import FullUserSnapshot
 from onyx.server.models import InvitedUserSnapshot
 from onyx.server.models import MinimalUserSnapshot
+from onyx.server.models import UserGroupInfo
 from onyx.server.usage_limits import is_tenant_on_trial_fn
 from onyx.server.utils import BasicAuthenticationError
 from onyx.utils.logger import setup_logger
@@ -203,14 +209,91 @@ def list_accepted_users(
            total_items=0,
        )

+    user_ids = [user.id for user in filtered_accepted_users]
+    groups_by_user = batch_get_user_groups(db_session, user_ids)
+
+    # Batch-fetch SCIM mappings to mark synced users
+    scim_synced_ids: set[UUID] = set()
+    try:
+        from onyx.db.models import ScimUserMapping
+
+        scim_mappings = db_session.scalars(
+            select(ScimUserMapping.user_id).where(ScimUserMapping.user_id.in_(user_ids))
+        ).all()
+        scim_synced_ids = set(scim_mappings)
+    except Exception:
+        logger.warning(
+            "Failed to fetch SCIM mappings; marking all users as non-synced",
+            exc_info=True,
+        )
+
    return PaginatedReturn(
        items=[
-            FullUserSnapshot.from_user_model(user) for user in filtered_accepted_users
+            FullUserSnapshot.from_user_model(
+                user,
+                groups=[
+                    UserGroupInfo(id=gid, name=gname)
+                    for gid, gname in groups_by_user.get(user.id, [])
+                ],
+                is_scim_synced=user.id in scim_synced_ids,
+            )
+            for user in filtered_accepted_users
        ],
        total_items=total_accepted_users_count,
    )


+@router.get("/manage/users/accepted/all", tags=PUBLIC_API_TAGS)
+def list_all_accepted_users(
+    _: User = Depends(current_admin_user),
+    db_session: Session = Depends(get_session),
+) -> list[FullUserSnapshot]:
+    """Returns all accepted users without pagination.
+    Used by the admin Users page for client-side filtering/sorting."""
+    users = get_all_accepted_users(db_session=db_session)
+
+    if not users:
+        return []
+
+    user_ids = [user.id for user in users]
+    groups_by_user = batch_get_user_groups(db_session, user_ids)
+
+    # Batch-fetch SCIM mappings to mark synced users
+    scim_synced_ids: set[UUID] = set()
+    try:
+        from onyx.db.models import ScimUserMapping
+
+        scim_mappings = db_session.scalars(
+            select(ScimUserMapping.user_id).where(ScimUserMapping.user_id.in_(user_ids))
+        ).all()
+        scim_synced_ids = set(scim_mappings)
+    except Exception:
+        logger.warning(
+            "Failed to fetch SCIM mappings; marking all users as non-synced",
+            exc_info=True,
+        )
+
+    return [
+        FullUserSnapshot.from_user_model(
+            user,
+            groups=[
+                UserGroupInfo(id=gid, name=gname)
+                for gid, gname in groups_by_user.get(user.id, [])
+            ],
+            is_scim_synced=user.id in scim_synced_ids,
+        )
+        for user in users
+    ]
+
+
+@router.get("/manage/users/counts")
+def get_user_counts(
+    _: User = Depends(current_admin_user),
+    db_session: Session = Depends(get_session),
+) -> dict[str, dict[str, int]]:
+    return get_user_counts_by_role_and_status(db_session)
+
+
@router.get("/manage/users/invited", tags=PUBLIC_API_TAGS)
 def list_invited_users(
    _: User = Depends(current_admin_user),
@@ -269,24 +352,10 @@ def list_all_users(
    if accepted_page is None or invited_page is None or slack_users_page is None:
        return AllUsersResponse(
            accepted=[
-                FullUserSnapshot(
-                    id=user.id,
-                    email=user.email,
-                    role=user.role,
-                    is_active=user.is_active,
-                    password_configured=user.password_configured,
-                )
-                for user in accepted_users
+                FullUserSnapshot.from_user_model(user) for user in accepted_users
            ],
            slack_users=[
-                FullUserSnapshot(
-                    id=user.id,
-                    email=user.email,
-                    role=user.role,
-                    is_active=user.is_active,
-                    password_configured=user.password_configured,
-                )
-                for user in slack_users
+                FullUserSnapshot.from_user_model(user) for user in slack_users
            ],
            invited=[InvitedUserSnapshot(email=email) for email in invited_emails],
            accepted_pages=1,
@@ -296,26 +365,10 @@ def list_all_users(

    # Otherwise, return paginated results
    return AllUsersResponse(
-        accepted=[
-            FullUserSnapshot(
-                id=user.id,
-                email=user.email,
-                role=user.role,
-                is_active=user.is_active,
-                password_configured=user.password_configured,
-            )
-            for user in accepted_users
-        ][accepted_page * USERS_PAGE_SIZE : (accepted_page + 1) * USERS_PAGE_SIZE],
-        slack_users=[
-            FullUserSnapshot(
-                id=user.id,
-                email=user.email,
-                role=user.role,
-                is_active=user.is_active,
-                password_configured=user.password_configured,
-            )
-            for user in slack_users
-        ][
+        accepted=[FullUserSnapshot.from_user_model(user) for user in accepted_users][
+            accepted_page * USERS_PAGE_SIZE : (accepted_page + 1) * USERS_PAGE_SIZE
+        ],
+        slack_users=[FullUserSnapshot.from_user_model(user) for user in slack_users][
            slack_users_page
            * USERS_PAGE_SIZE : (slack_users_page + 1)
            * USERS_PAGE_SIZE
--- a/backend/onyx/server/models.py
+++ b/backend/onyx/server/models.py
@@ -1,3 +1,4 @@
+import datetime
 from typing import Generic
 from typing import Optional
 from typing import TypeVar
@@ -31,21 +32,41 @@ class MinimalUserSnapshot(BaseModel):
    email: str


+class UserGroupInfo(BaseModel):
+    id: int
+    name: str
+
+
 class FullUserSnapshot(BaseModel):
    id: UUID
    email: str
    role: UserRole
    is_active: bool
    password_configured: bool
+    personal_name: str | None
+    created_at: datetime.datetime
+    updated_at: datetime.datetime
+    groups: list[UserGroupInfo]
+    is_scim_synced: bool

    @classmethod
-    def from_user_model(cls, user: User) -> "FullUserSnapshot":
+    def from_user_model(
+        cls,
+        user: User,
+        groups: list[UserGroupInfo] | None = None,
+        is_scim_synced: bool = False,
+    ) -> "FullUserSnapshot":
        return cls(
            id=user.id,
            email=user.email,
            role=user.role,
            is_active=user.is_active,
            password_configured=user.password_configured,
+            personal_name=user.personal_name,
+            created_at=user.created_at,
+            updated_at=user.updated_at,
+            groups=groups or [],
+            is_scim_synced=is_scim_synced,
        )


--- a/backend/requirements/default.txt
+++ b/backend/requirements/default.txt
@@ -614,7 +614,7 @@ opentelemetry-sdk==1.39.1
    #   opentelemetry-exporter-otlp-proto-http
 opentelemetry-semantic-conventions==0.60b1
    # via opentelemetry-sdk
-orjson==3.11.4 ; platform_python_implementation != 'PyPy'
+orjson==3.11.6 ; platform_python_implementation != 'PyPy'
    # via langsmith
 packaging==24.2
    # via
@@ -1020,7 +1020,7 @@ toolz==1.1.0
    #   dask
    #   distributed
    #   partd
-tornado==6.5.2
+tornado==6.5.5
    # via distributed
 tqdm==4.67.1
    # via
--- a/backend/requirements/dev.txt
+++ b/backend/requirements/dev.txt
@@ -263,7 +263,7 @@ oauthlib==3.2.2
    # via
    #   kubernetes
    #   requests-oauthlib
-onyx-devtools==0.6.3
+onyx-devtools==0.7.0
    # via onyx
 openai==2.14.0
    # via
@@ -466,7 +466,7 @@ tokenizers==0.21.4
    # via
    #   cohere
    #   litellm
-tornado==6.5.2
+tornado==6.5.5
    # via
    #   ipykernel
    #   jupyter-client
--- a/backend/tests/unit/onyx/hooks/init.py
+++ b/backend/tests/unit/onyx/hooks/init.py
--- a/backend/tests/unit/onyx/hooks/test_api_dependencies.py
+++ b/backend/tests/unit/onyx/hooks/test_api_dependencies.py
@@ -0,0 +1,40 @@
+"""Unit tests for the hooks feature gate."""
+
+from unittest.mock import patch
+
+import pytest
+
+from onyx.error_handling.error_codes import OnyxErrorCode
+from onyx.error_handling.exceptions import OnyxError
+from onyx.hooks.api_dependencies import require_hook_enabled
+
+
+class TestRequireHookEnabled:
+    def test_raises_when_multi_tenant(self) -> None:
+        with (
+            patch("onyx.hooks.api_dependencies.MULTI_TENANT", True),
+            patch("onyx.hooks.api_dependencies.HOOK_ENABLED", True),
+        ):
+            with pytest.raises(OnyxError) as exc_info:
+                require_hook_enabled()
+        assert exc_info.value.error_code is OnyxErrorCode.NOT_FOUND
+        assert exc_info.value.status_code == 404
+        assert "multi-tenant" in exc_info.value.detail
+
+    def test_raises_when_flag_disabled(self) -> None:
+        with (
+            patch("onyx.hooks.api_dependencies.MULTI_TENANT", False),
+            patch("onyx.hooks.api_dependencies.HOOK_ENABLED", False),
+        ):
+            with pytest.raises(OnyxError) as exc_info:
+                require_hook_enabled()
+        assert exc_info.value.error_code is OnyxErrorCode.NOT_FOUND
+        assert exc_info.value.status_code == 404
+        assert "HOOK_ENABLED" in exc_info.value.detail
+
+    def test_passes_when_enabled_single_tenant(self) -> None:
+        with (
+            patch("onyx.hooks.api_dependencies.MULTI_TENANT", False),
+            patch("onyx.hooks.api_dependencies.HOOK_ENABLED", True),
+        ):
+            require_hook_enabled()  # must not raise
--- a/backend/tests/unit/onyx/onyxbot/test_handle_regular_answer.py
+++ b/backend/tests/unit/onyx/onyxbot/test_handle_regular_answer.py
@@ -0,0 +1,204 @@
+"""Tests for Slack channel reference resolution and tag filtering
+in handle_regular_answer.py."""
+
+from unittest.mock import MagicMock
+
+from slack_sdk.errors import SlackApiError
+
+from onyx.context.search.models import Tag
+from onyx.onyxbot.slack.constants import SLACK_CHANNEL_REF_PATTERN
+from onyx.onyxbot.slack.handlers.handle_regular_answer import resolve_channel_references
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+
+def _mock_client_with_channels(
+    channel_map: dict[str, str],
+) -> MagicMock:
+    """Return a mock WebClient where conversations_info resolves IDs to names."""
+    client = MagicMock()
+
+    def _conversations_info(channel: str) -> MagicMock:
+        if channel in channel_map:
+            resp = MagicMock()
+            resp.validate = MagicMock()
+            resp.__getitem__ = lambda _self, key: {
+                "channel": {
+                    "name": channel_map[channel],
+                    "is_im": False,
+                    "is_mpim": False,
+                }
+            }[key]
+            return resp
+        raise SlackApiError("channel_not_found", response=MagicMock())
+
+    client.conversations_info = _conversations_info
+    return client
+
+
+def _mock_logger() -> MagicMock:
+    return MagicMock()
+
+
+# ---------------------------------------------------------------------------
+# SLACK_CHANNEL_REF_PATTERN regex tests
+# ---------------------------------------------------------------------------
+
+
+class TestSlackChannelRefPattern:
+    def test_matches_bare_channel_id(self) -> None:
+        matches = SLACK_CHANNEL_REF_PATTERN.findall("<#C097NBWMY8Y>")
+        assert matches == [("C097NBWMY8Y", "")]
+
+    def test_matches_channel_id_with_name(self) -> None:
+        matches = SLACK_CHANNEL_REF_PATTERN.findall("<#C097NBWMY8Y|eng-infra>")
+        assert matches == [("C097NBWMY8Y", "eng-infra")]
+
+    def test_matches_multiple_channels(self) -> None:
+        msg = "compare <#C111AAA> and <#C222BBB|general>"
+        matches = SLACK_CHANNEL_REF_PATTERN.findall(msg)
+        assert len(matches) == 2
+        assert ("C111AAA", "") in matches
+        assert ("C222BBB", "general") in matches
+
+    def test_no_match_on_plain_text(self) -> None:
+        matches = SLACK_CHANNEL_REF_PATTERN.findall("no channels here")
+        assert matches == []
+
+    def test_no_match_on_user_mention(self) -> None:
+        matches = SLACK_CHANNEL_REF_PATTERN.findall("<@U12345>")
+        assert matches == []
+
+
+# ---------------------------------------------------------------------------
+# resolve_channel_references tests
+# ---------------------------------------------------------------------------
+
+
+class TestResolveChannelReferences:
+    def test_resolves_bare_channel_id_via_api(self) -> None:
+        client = _mock_client_with_channels({"C097NBWMY8Y": "eng-infra"})
+        logger = _mock_logger()
+
+        message, tags = resolve_channel_references(
+            message="summary of <#C097NBWMY8Y> this week",
+            client=client,
+            logger=logger,
+        )
+
+        assert message == "summary of #eng-infra this week"
+        assert len(tags) == 1
+        assert tags[0] == Tag(tag_key="Channel", tag_value="eng-infra")
+
+    def test_uses_name_from_pipe_format_without_api_call(self) -> None:
+        client = MagicMock()
+        logger = _mock_logger()
+
+        message, tags = resolve_channel_references(
+            message="check <#C097NBWMY8Y|eng-infra> for updates",
+            client=client,
+            logger=logger,
+        )
+
+        assert message == "check #eng-infra for updates"
+        assert tags == [Tag(tag_key="Channel", tag_value="eng-infra")]
+        # Should NOT have called the API since name was in the markup
+        client.conversations_info.assert_not_called()
+
+    def test_multiple_channels(self) -> None:
+        client = _mock_client_with_channels(
+            {
+                "C111AAA": "eng-infra",
+                "C222BBB": "eng-general",
+            }
+        )
+        logger = _mock_logger()
+
+        message, tags = resolve_channel_references(
+            message="compare <#C111AAA> and <#C222BBB>",
+            client=client,
+            logger=logger,
+        )
+
+        assert "#eng-infra" in message
+        assert "#eng-general" in message
+        assert "<#" not in message
+        assert len(tags) == 2
+        tag_values = {t.tag_value for t in tags}
+        assert tag_values == {"eng-infra", "eng-general"}
+
+    def test_no_channel_references_returns_unchanged(self) -> None:
+        client = MagicMock()
+        logger = _mock_logger()
+
+        message, tags = resolve_channel_references(
+            message="just a normal message with no channels",
+            client=client,
+            logger=logger,
+        )
+
+        assert message == "just a normal message with no channels"
+        assert tags == []
+
+    def test_api_failure_skips_channel_gracefully(self) -> None:
+        # Client that fails for all channel lookups
+        client = _mock_client_with_channels({})
+        logger = _mock_logger()
+
+        message, tags = resolve_channel_references(
+            message="check <#CBADID123>",
+            client=client,
+            logger=logger,
+        )
+
+        # Message should remain unchanged for the failed channel
+        assert "<#CBADID123>" in message
+        assert tags == []
+        logger.warning.assert_called_once()
+
+    def test_partial_failure_resolves_what_it_can(self) -> None:
+        # Only one of two channels resolves
+        client = _mock_client_with_channels({"C111AAA": "eng-infra"})
+        logger = _mock_logger()
+
+        message, tags = resolve_channel_references(
+            message="compare <#C111AAA> and <#CBADID123>",
+            client=client,
+            logger=logger,
+        )
+
+        assert "#eng-infra" in message
+        assert "<#CBADID123>" in message  # failed one stays raw
+        assert len(tags) == 1
+        assert tags[0].tag_value == "eng-infra"
+
+    def test_duplicate_channel_produces_single_tag(self) -> None:
+        client = _mock_client_with_channels({"C111AAA": "eng-infra"})
+        logger = _mock_logger()
+
+        message, tags = resolve_channel_references(
+            message="summarize <#C111AAA> and compare with <#C111AAA>",
+            client=client,
+            logger=logger,
+        )
+
+        assert message == "summarize #eng-infra and compare with #eng-infra"
+        assert len(tags) == 1
+        assert tags[0].tag_value == "eng-infra"
+
+    def test_mixed_pipe_and_bare_formats(self) -> None:
+        client = _mock_client_with_channels({"C222BBB": "random"})
+        logger = _mock_logger()
+
+        message, tags = resolve_channel_references(
+            message="see <#C111AAA|eng-infra> and <#C222BBB>",
+            client=client,
+            logger=logger,
+        )
+
+        assert "#eng-infra" in message
+        assert "#random" in message
+        assert len(tags) == 2
--- a/backend/tests/unit/onyx/server/test_full_user_snapshot.py
+++ b/backend/tests/unit/onyx/server/test_full_user_snapshot.py
@@ -0,0 +1,54 @@
+import datetime
+from unittest.mock import MagicMock
+from uuid import uuid4
+
+from onyx.auth.schemas import UserRole
+from onyx.server.models import FullUserSnapshot
+from onyx.server.models import UserGroupInfo
+
+
+def _mock_user(
+    personal_name: str | None = "Test User",
+    created_at: datetime.datetime | None = None,
+    updated_at: datetime.datetime | None = None,
+) -> MagicMock:
+    user = MagicMock()
+    user.id = uuid4()
+    user.email = "test@example.com"
+    user.role = UserRole.BASIC
+    user.is_active = True
+    user.password_configured = True
+    user.personal_name = personal_name
+    user.created_at = created_at or datetime.datetime(
+        2025, 1, 1, tzinfo=datetime.timezone.utc
+    )
+    user.updated_at = updated_at or datetime.datetime(
+        2025, 6, 15, tzinfo=datetime.timezone.utc
+    )
+    return user
+
+
+def test_from_user_model_includes_new_fields() -> None:
+    user = _mock_user(personal_name="Alice")
+    groups = [UserGroupInfo(id=1, name="Engineering")]
+
+    snapshot = FullUserSnapshot.from_user_model(user, groups=groups)
+
+    assert snapshot.personal_name == "Alice"
+    assert snapshot.created_at == user.created_at
+    assert snapshot.updated_at == user.updated_at
+    assert snapshot.groups == groups
+
+
+def test_from_user_model_defaults_groups_to_empty() -> None:
+    user = _mock_user()
+    snapshot = FullUserSnapshot.from_user_model(user)
+
+    assert snapshot.groups == []
+
+
+def test_from_user_model_personal_name_none() -> None:
+    user = _mock_user(personal_name=None)
+    snapshot = FullUserSnapshot.from_user_model(user)
+
+    assert snapshot.personal_name is None
--- a/backend/tests/unit/onyx/server/test_projects_file_utils.py
+++ b/backend/tests/unit/onyx/server/test_projects_file_utils.py
@@ -186,3 +186,42 @@ def test_categorize_uploaded_files_checks_size_before_text_extraction(
    assert len(result.acceptable) == 0
    assert len(result.rejected) == 1
    assert result.rejected[0].reason == "Exceeds 1 MB file size limit"
+
+
+def test_categorize_uploaded_files_accepts_python_file(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    _patch_common_dependencies(monkeypatch)
+    monkeypatch.setattr(utils, "USER_FILE_MAX_UPLOAD_SIZE_BYTES", 10_000)
+    monkeypatch.setattr(utils, "USER_FILE_MAX_UPLOAD_SIZE_MB", 1)
+
+    py_source = b'def hello():\n    print("world")\n'
+    monkeypatch.setattr(
+        utils, "extract_file_text", lambda **_kwargs: py_source.decode()
+    )
+
+    upload = _make_upload("script.py", size=len(py_source), content=py_source)
+    result = utils.categorize_uploaded_files([upload], MagicMock())
+
+    assert len(result.acceptable) == 1
+    assert result.acceptable[0].filename == "script.py"
+    assert len(result.rejected) == 0
+
+
+def test_categorize_uploaded_files_rejects_binary_file(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    _patch_common_dependencies(monkeypatch)
+    monkeypatch.setattr(utils, "USER_FILE_MAX_UPLOAD_SIZE_BYTES", 10_000)
+    monkeypatch.setattr(utils, "USER_FILE_MAX_UPLOAD_SIZE_MB", 1)
+
+    monkeypatch.setattr(utils, "extract_file_text", lambda **_kwargs: "")
+
+    binary_content = bytes(range(256)) * 4
+    upload = _make_upload("data.bin", size=len(binary_content), content=binary_content)
+    result = utils.categorize_uploaded_files([upload], MagicMock())
+
+    assert len(result.acceptable) == 0
+    assert len(result.rejected) == 1
+    assert result.rejected[0].filename == "data.bin"
+    assert "Unsupported file type" in result.rejected[0].reason
--- a/deployment/helm/charts/onyx/Chart.yaml
+++ b/deployment/helm/charts/onyx/Chart.yaml
@@ -5,7 +5,7 @@ home: https://www.onyx.app/
 sources:
  - "https://github.com/onyx-dot-app/onyx"
 type: application
-version: 0.4.33
+version: 0.4.34
 appVersion: latest
 annotations:
  category: Productivity
--- a/deployment/helm/charts/onyx/ci/ct-values.yaml
+++ b/deployment/helm/charts/onyx/ci/ct-values.yaml
@@ -0,0 +1,6 @@
+# Values for chart-testing (ct lint/install)
+# This file is automatically used by ct when running lint and install commands
+auth:
+  userauth:
+    values:
+      user_auth_secret: "placeholder-for-ci-testing"
--- a/deployment/helm/charts/onyx/templates/auth-secrets.yaml
+++ b/deployment/helm/charts/onyx/templates/auth-secrets.yaml
@@ -1,17 +1,29 @@
 {{- if hasKey .Values.auth "secretKeys" }}
 {{- fail "ERROR: Secrets handling has been refactored under 'auth' and must be updated before upgrading to this chart version." }}
 {{- end }}
-{{- range $secretContent := .Values.auth }}
-{{- if and (empty $secretContent.existingSecret) (ne ($secretContent.enabled | default true) false) }}
+{{- range $secretKey, $secretContent := .Values.auth }}
+{{- if and (empty $secretContent.existingSecret) (or (not (hasKey $secretContent "enabled")) $secretContent.enabled) }}
+{{- $secretName := include "onyx.secretName" $secretContent }}
+{{- $existingSecret := lookup "v1" "Secret" $.Release.Namespace $secretName }}
+{{- /* Pre-validate: fail before emitting YAML if any required value is missing */ -}}
+{{- range $name, $value := $secretContent.values }}
+{{- if and (empty $value) (not (and $existingSecret (hasKey $existingSecret.data $name))) }}
+{{- fail (printf "Secret value for '%s' is required but not set and no existing secret found. Please set auth.%s.values.%s in values.yaml" $name $secretKey $name) }}
+{{- end }}
+{{- end }}
 ---
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ include "onyx.secretName" $secretContent }}
+  name: {{ $secretName }}
 type: Opaque
 stringData:
-  {{- range $name, $value := $secretContent.values }}
+{{- range $name, $value := $secretContent.values }}
+{{- if not (empty $value) }}
  {{ $name }}: {{ $value | quote }}
-  {{- end }}
+{{- else if and $existingSecret (hasKey $existingSecret.data $name) }}
+  {{ $name }}: {{ index $existingSecret.data $name | b64dec | quote }}
+{{- end }}
+{{- end }}
 {{- end }}
 {{- end }}
--- a/deployment/helm/charts/onyx/values.yaml
+++ b/deployment/helm/charts/onyx/values.yaml
@@ -1183,10 +1183,26 @@ auth:
    values:
      opensearch_admin_username: "admin"
      opensearch_admin_password: "OnyxDev1!"
+  userauth:
+    # -- Used for signing password reset tokens, email verification tokens, and JWT tokens.
+    enabled: true
+    # -- Overwrite the default secret name, ignored if existingSecret is defined
+    secretName: 'onyx-userauth'
+    # -- Use a secret specified elsewhere
+    existingSecret: ""
+    # -- This defines the env var to secret map
+    secretKeys:
+      USER_AUTH_SECRET: user_auth_secret
+    # -- Secret value. Required - generate with: openssl rand -hex 32
+    # If not set, helm install/upgrade will fail.
+    values:
+      user_auth_secret: ""

 configMap:
-  # Change this for production uses unless Onyx is only accessible behind VPN
-  AUTH_TYPE: "disabled"
+  # Auth type: "basic" (default), "google_oauth", "oidc", or "saml"
+  # UPGRADE NOTE: Default changed from "disabled" to "basic" in 0.4.34.
+  # You must also set auth.userauth.values.user_auth_secret.
+  AUTH_TYPE: "basic"
  # 1 Day Default
  SESSION_EXPIRE_TIME_SECONDS: "86400"
  # Can be something like onyx.app, as an extra double-check
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -143,7 +143,7 @@ dev = [
    "matplotlib==3.10.8",
    "mypy-extensions==1.0.0",
    "mypy==1.13.0",
-    "onyx-devtools==0.6.3",
+    "onyx-devtools==0.7.0",
    "openapi-generator-cli==7.17.0",
    "pandas-stubs~=2.3.3",
    "pre-commit==3.2.2",
--- a/tools/ods/README.md
+++ b/tools/ods/README.md
@@ -25,6 +25,9 @@ Some commands require external tools to be installed and configured:
 - **Docker** - Required for `compose`, `logs`, and `pull` commands
  - Install from [docker.com](https://docs.docker.com/get-docker/)

+- **uv** - Required for `backend` commands
+  - Install from [docs.astral.sh/uv](https://docs.astral.sh/uv/)
+
 - **GitHub CLI** (`gh`) - Required for `run-ci` and `cherry-pick` commands
  - Install from [cli.github.com](https://cli.github.com/)
  - Authenticate with `gh auth login`
@@ -170,6 +173,53 @@ ods pull
 ods pull --tag edge
 ```

+### `backend` - Run Backend Services
+
+Run backend services (API server, model server) with environment loaded from
+`.vscode/.env`. On first run, copies `.vscode/env_template.txt` to `.vscode/.env`
+if the `.env` file does not already exist.
+
+Enterprise Edition features are enabled by default with license enforcement
+disabled, matching the `compose` command behavior.
+
+```shell
+ods backend <subcommand>
+```
+
+**Subcommands:**
+
+- `api` - Start the FastAPI backend server (`uvicorn onyx.main:app --reload`)
+- `model_server` - Start the model server (`uvicorn model_server.main:app --reload`)
+
+**Flags:**
+
+| Flag | Default | Description |
+|------|---------|-------------|
+| `--no-ee` | `false` | Disable Enterprise Edition features (enabled by default) |
+| `--port` | `8080` (api) / `9000` (model_server) | Port to listen on |
+
+Shell environment takes precedence over `.env` file values, so inline overrides
+work as expected (e.g. `S3_ENDPOINT_URL=foo ods backend api`).
+
+**Examples:**
+
+```shell
+# Start the API server
+ods backend api
+
+# Start the API server on a custom port
+ods backend api --port 9090
+
+# Start without Enterprise Edition
+ods backend api --no-ee
+
+# Start the model server
+ods backend model_server
+
+# Start the model server on a custom port
+ods backend model_server --port 9001
+```
+
 ### `web` - Run Frontend Scripts

 Run npm scripts from `web/package.json` without manually changing directories.
--- a/tools/ods/cmd/backend.go
+++ b/tools/ods/cmd/backend.go
@@ -0,0 +1,242 @@
+package cmd
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+
+	"github.com/onyx-dot-app/onyx/tools/ods/internal/paths"
+)
+
+// NewBackendCommand creates the parent "backend" command with subcommands for
+// running backend services.
+// BackendOptions holds options shared across backend subcommands.
+type BackendOptions struct {
+	NoEE bool
+}
+
+func NewBackendCommand() *cobra.Command {
+	opts := &BackendOptions{}
+
+	cmd := &cobra.Command{
+		Use:   "backend",
+		Short: "Run backend services (api, model_server)",
+		Long: `Run backend services with environment from .vscode/.env.
+
+On first run, copies .vscode/env_template.txt to .vscode/.env if the
+.env file does not already exist.
+
+Enterprise Edition features are enabled by default for development,
+with license enforcement disabled.
+
+Available subcommands:
+  api            Start the FastAPI backend server
+  model_server   Start the model server`,
+	}
+
+	cmd.PersistentFlags().BoolVar(&opts.NoEE, "no-ee", false, "Disable Enterprise Edition features (enabled by default)")
+
+	cmd.AddCommand(newBackendAPICommand(opts))
+	cmd.AddCommand(newBackendModelServerCommand(opts))
+
+	return cmd
+}
+
+func newBackendAPICommand(opts *BackendOptions) *cobra.Command {
+	var port string
+
+	cmd := &cobra.Command{
+		Use:   "api",
+		Short: "Start the backend API server (uvicorn with hot-reload)",
+		Long: `Start the backend API server using uvicorn with hot-reload.
+
+Examples:
+  ods backend api
+  ods backend api --port 9090
+  ods backend api --no-ee`,
+		Run: func(cmd *cobra.Command, args []string) {
+			runBackendService("api", "onyx.main:app", port, opts)
+		},
+	}
+
+	cmd.Flags().StringVar(&port, "port", "8080", "Port to listen on")
+
+	return cmd
+}
+
+func newBackendModelServerCommand(opts *BackendOptions) *cobra.Command {
+	var port string
+
+	cmd := &cobra.Command{
+		Use:   "model_server",
+		Short: "Start the model server (uvicorn with hot-reload)",
+		Long: `Start the model server using uvicorn with hot-reload.
+
+Examples:
+  ods backend model_server
+  ods backend model_server --port 9001`,
+		Run: func(cmd *cobra.Command, args []string) {
+			runBackendService("model_server", "model_server.main:app", port, opts)
+		},
+	}
+
+	cmd.Flags().StringVar(&port, "port", "9000", "Port to listen on")
+
+	return cmd
+}
+
+func runBackendService(name, module, port string, opts *BackendOptions) {
+	root, err := paths.GitRoot()
+	if err != nil {
+		log.Fatalf("Failed to find git root: %v", err)
+	}
+
+	envFile := ensureBackendEnvFile(root)
+	fileVars := loadBackendEnvFile(envFile)
+
+	eeDefaults := eeEnvDefaults(opts.NoEE)
+	fileVars = append(fileVars, eeDefaults...)
+
+	backendDir := filepath.Join(root, "backend")
+
+	uvicornArgs := []string{
+		"run", "uvicorn", module,
+		"--reload",
+		"--port", port,
+	}
+	log.Infof("Starting %s on port %s...", name, port)
+	if !opts.NoEE {
+		log.Info("Enterprise Edition enabled (use --no-ee to disable)")
+	}
+	log.Debugf("Running in %s: uv %v", backendDir, uvicornArgs)
+
+	mergedEnv := mergeEnv(os.Environ(), fileVars)
+	log.Debugf("Applied %d env vars from %s (shell takes precedence)", len(fileVars), envFile)
+
+	svcCmd := exec.Command("uv", uvicornArgs...)
+	svcCmd.Dir = backendDir
+	svcCmd.Stdout = os.Stdout
+	svcCmd.Stderr = os.Stderr
+	svcCmd.Stdin = os.Stdin
+	svcCmd.Env = mergedEnv
+
+	if err := svcCmd.Run(); err != nil {
+		var exitErr *exec.ExitError
+		if errors.As(err, &exitErr) {
+			if code := exitErr.ExitCode(); code != -1 {
+				os.Exit(code)
+			}
+		}
+		log.Fatalf("Failed to run %s: %v", name, err)
+	}
+}
+
+// eeEnvDefaults returns env entries for EE and license enforcement settings.
+// These are appended to the file vars so they act as defaults — shell env
+// and .env file values still take precedence via mergeEnv.
+func eeEnvDefaults(noEE bool) []string {
+	if noEE {
+		return []string{
+			"ENABLE_PAID_ENTERPRISE_EDITION_FEATURES=false",
+		}
+	}
+	return []string{
+		"ENABLE_PAID_ENTERPRISE_EDITION_FEATURES=true",
+		"LICENSE_ENFORCEMENT_ENABLED=false",
+	}
+}
+
+// ensureBackendEnvFile copies env_template.txt to .env if .env doesn't exist.
+func ensureBackendEnvFile(root string) string {
+	vscodeDir := filepath.Join(root, ".vscode")
+	envFile := filepath.Join(vscodeDir, ".env")
+	templateFile := filepath.Join(vscodeDir, "env_template.txt")
+
+	if _, err := os.Stat(envFile); err != nil {
+		if !errors.Is(err, os.ErrNotExist) {
+			log.Fatalf("Failed to stat env file %s: %v", envFile, err)
+		}
+	} else {
+		log.Debugf("Using existing env file: %s", envFile)
+		return envFile
+	}
+
+	templateData, err := os.ReadFile(templateFile)
+	if err != nil {
+		log.Fatalf("Failed to read env template %s: %v", templateFile, err)
+	}
+
+	if err := os.MkdirAll(vscodeDir, 0755); err != nil {
+		log.Fatalf("Failed to create .vscode directory: %v", err)
+	}
+
+	if err := os.WriteFile(envFile, templateData, 0644); err != nil {
+		log.Fatalf("Failed to write env file %s: %v", envFile, err)
+	}
+
+	log.Infof("Created %s from template (review and fill in <REPLACE THIS> values)", envFile)
+	return envFile
+}
+
+// mergeEnv combines shell environment with file-based defaults. Shell values
+// take precedence — file entries are only added for keys not already present.
+func mergeEnv(shellEnv, fileVars []string) []string {
+	existing := make(map[string]bool, len(shellEnv))
+	for _, entry := range shellEnv {
+		if idx := strings.Index(entry, "="); idx > 0 {
+			existing[entry[:idx]] = true
+		}
+	}
+
+	merged := make([]string, len(shellEnv))
+	copy(merged, shellEnv)
+	for _, entry := range fileVars {
+		if idx := strings.Index(entry, "="); idx > 0 {
+			key := entry[:idx]
+			if !existing[key] {
+				merged = append(merged, entry)
+			} else {
+				log.Debugf("Env var %s already set in shell, skipping .env value", key)
+			}
+		}
+	}
+	return merged
+}
+
+// loadBackendEnvFile parses a .env file into KEY=VALUE entries suitable for
+// appending to os.Environ(). Blank lines and comments are skipped.
+func loadBackendEnvFile(path string) []string {
+	f, err := os.Open(path)
+	if err != nil {
+		log.Fatalf("Failed to open env file %s: %v", path, err)
+	}
+	defer func() { _ = f.Close() }()
+
+	var envVars []string
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		if idx := strings.Index(line, "="); idx > 0 {
+			key := strings.TrimSpace(line[:idx])
+			value := strings.TrimSpace(line[idx+1:])
+			value = strings.Trim(value, `"'`)
+			envVars = append(envVars, fmt.Sprintf("%s=%s", key, value))
+		}
+	}
+
+	if err := scanner.Err(); err != nil {
+		log.Fatalf("Failed to read env file %s: %v", path, err)
+	}
+
+	return envVars
+}
--- a/tools/ods/cmd/print_latest.go
+++ b/tools/ods/cmd/print_latest.go
@@ -2,7 +2,6 @@ package cmd

 import (
 	"fmt"
-
 	"github.com/jmelahman/tag/git"
 	"github.com/spf13/cobra"
 )
--- a/tools/ods/cmd/root.go
+++ b/tools/ods/cmd/root.go
@@ -41,6 +41,7 @@ func NewRootCommand() *cobra.Command {
 	cmd.PersistentFlags().BoolVar(&opts.Debug, "debug", false, "run in debug mode")

 	// Add subcommands
+	cmd.AddCommand(NewBackendCommand())
 	cmd.AddCommand(NewCheckLazyImportsCommand())
 	cmd.AddCommand(NewCherryPickCommand())
 	cmd.AddCommand(NewDBCommand())
--- a/uv.lock
+++ b/uv.lock
@@ -4443,7 +4443,7 @@ requires-dist = [
    { name = "numpy", marker = "extra == 'model-server'", specifier = "==2.4.1" },
    { name = "oauthlib", marker = "extra == 'backend'", specifier = "==3.2.2" },
    { name = "office365-rest-python-client", marker = "extra == 'backend'", specifier = "==2.6.2" },
-    { name = "onyx-devtools", marker = "extra == 'dev'", specifier = "==0.6.3" },
+    { name = "onyx-devtools", marker = "extra == 'dev'", specifier = "==0.7.0" },
    { name = "openai", specifier = "==2.14.0" },
    { name = "openapi-generator-cli", marker = "extra == 'dev'", specifier = "==7.17.0" },
    { name = "openinference-instrumentation", marker = "extra == 'backend'", specifier = "==0.1.42" },
@@ -4548,20 +4548,19 @@ requires-dist = [{ name = "onyx", extras = ["backend", "dev", "ee"], editable =

 [[package]]
 name = "onyx-devtools"
-version = "0.6.3"
+version = "0.7.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "fastapi" },
    { name = "openapi-generator-cli" },
 ]
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/84/e2/e7619722c3ccd18eb38100f776fb3dd6b4ae0fbbee09fca5af7c69a279b5/onyx_devtools-0.6.3-py3-none-any.whl", hash = "sha256:d3a5422945d9da12cafc185f64b39f6e727ee4cc92b37427deb7a38f9aad4966", size = 3945381, upload-time = "2026-03-05T20:39:25.896Z" },
-    { url = "https://files.pythonhosted.org/packages/f2/09/513d2dabedc1e54ad4376830fc9b34a3d9c164bdbcdedfcdbb8b8154dc5a/onyx_devtools-0.6.3-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:efe300e9f3a2e7ae75f88a4f9e0a5c4c471478296cb1615b6a1f03d247582e13", size = 3978761, upload-time = "2026-03-05T20:39:28.822Z" },
-    { url = "https://files.pythonhosted.org/packages/39/41/e757602a0de032d74ed01c7ee57f30e57728fb9cd4f922f50d2affda3889/onyx_devtools-0.6.3-py3-none-macosx_11_0_arm64.whl", hash = "sha256:594066eed3f917cfab5a8c7eac3d4a210df30259f2049f664787749709345e19", size = 3665378, upload-time = "2026-03-05T20:44:22.696Z" },
-    { url = "https://files.pythonhosted.org/packages/33/1c/c93b65d0b32e202596a2647922a75c7011cb982f899ddfcfd171f792c58f/onyx_devtools-0.6.3-py3-none-manylinux_2_17_aarch64.whl", hash = "sha256:384ef66030b55c0fd68b3898782b5b4b868ff3de119569dfc8544e2ce534b98a", size = 3540890, upload-time = "2026-03-05T20:39:28.886Z" },
-    { url = "https://files.pythonhosted.org/packages/f4/33/760eb656013f7f0cdff24570480d3dc4e52bbd8e6147ea1e8cf6fad7554f/onyx_devtools-0.6.3-py3-none-manylinux_2_17_x86_64.whl", hash = "sha256:82e218f3a49f64910c2c4c34d5dc12d1ea1520a27e0b0f6e4c0949ff9abaf0e1", size = 3945396, upload-time = "2026-03-05T20:39:34.323Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/eb/f54b3675c464df8a51194ff75afc97c2417659e3a209dc46948b47c28860/onyx_devtools-0.6.3-py3-none-win_amd64.whl", hash = "sha256:8af614ae7229290ef2417cb85270184a1e826ed9a3a34658da93851edb36df57", size = 4045936, upload-time = "2026-03-05T20:39:28.375Z" },
-    { url = "https://files.pythonhosted.org/packages/04/b8/5bee38e748f3d4b8ec935766224db1bbc1214c91092e5822c080fccd9130/onyx_devtools-0.6.3-py3-none-win_arm64.whl", hash = "sha256:717589db4b42528d33ae96f8006ee6aad3555034dcfee724705b6576be6a6ec4", size = 3608268, upload-time = "2026-03-05T20:39:28.731Z" },
+    { url = "https://files.pythonhosted.org/packages/22/9e/6957b11555da57d9e97092f4cd8ac09a86666264b0c9491838f4b27db5dc/onyx_devtools-0.7.0-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:ad962a168d46ea11dcde9fa3b37e4f12ec520b4a4cb4d49d8732de110d46c4b6", size = 3998057, upload-time = "2026-03-12T03:09:11.585Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/90/c72f3d06ba677012d77c77de36195b6a32a15c755c79ba0282be74e3c366/onyx_devtools-0.7.0-py3-none-macosx_11_0_arm64.whl", hash = "sha256:e46d252e2b048ff053b03519c3a875998780738d7c334eaa1c9a32ff445e3e1a", size = 3687753, upload-time = "2026-03-12T03:09:11.742Z" },
+    { url = "https://files.pythonhosted.org/packages/10/42/4e9fe36eccf9f76d67ba8f4ff6539196a09cd60351fb63f5865e1544cbfa/onyx_devtools-0.7.0-py3-none-manylinux_2_17_aarch64.whl", hash = "sha256:f280bc9320e1cc310e7d753a371009bfaab02cc0e0cfd78559663b15655b5a50", size = 3560144, upload-time = "2026-03-12T03:12:24.02Z" },
+    { url = "https://files.pythonhosted.org/packages/76/40/36dc12d99760b358c7f39b27361cb18fa9681ffe194107f982d0e1a74016/onyx_devtools-0.7.0-py3-none-manylinux_2_17_x86_64.whl", hash = "sha256:e31df751c7540ae7e70a7fe8e1153c79c31c2254af6aa4c72c0dd54fa381d2ab", size = 3964387, upload-time = "2026-03-12T03:09:11.356Z" },
+    { url = "https://files.pythonhosted.org/packages/34/18/74744230c3820a5a7687335507ca5f1dbebab2c5325805041c1cd5703e6a/onyx_devtools-0.7.0-py3-none-win_amd64.whl", hash = "sha256:541bfd347c2d5b11e7f63ab5001d2594df91d215ad9d07b1562f5e715700f7e6", size = 4068030, upload-time = "2026-03-12T03:09:12.98Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/78/1320436607d3ffcb321ba7b064556c020ea15843a7e7d903fbb7529a71f5/onyx_devtools-0.7.0-py3-none-win_arm64.whl", hash = "sha256:83016330a9d39712431916cc25b2fb2cfcaa0112a55cc4f919d545da3a8974f9", size = 3626409, upload-time = "2026-03-12T03:09:10.222Z" },
 ]

 [[package]]
@@ -4740,70 +4739,70 @@ wheels = [

 [[package]]
 name = "orjson"
-version = "3.11.4"
+version = "3.11.6"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/c6/fe/ed708782d6709cc60eb4c2d8a361a440661f74134675c72990f2c48c785f/orjson-3.11.4.tar.gz", hash = "sha256:39485f4ab4c9b30a3943cfe99e1a213c4776fb69e8abd68f66b83d5a0b0fdc6d", size = 5945188, upload-time = "2025-10-24T15:50:38.027Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/70/a3/4e09c61a5f0c521cba0bb433639610ae037437669f1a4cbc93799e731d78/orjson-3.11.6.tar.gz", hash = "sha256:0a54c72259f35299fd033042367df781c2f66d10252955ca1efb7db309b954cb", size = 6175856, upload-time = "2026-01-29T15:13:07.942Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/63/1d/1ea6005fffb56715fd48f632611e163d1604e8316a5bad2288bee9a1c9eb/orjson-3.11.4-cp311-cp311-macosx_10_15_x86_64.macosx_11_0_arm64.macosx_10_15_universal2.whl", hash = "sha256:5e59d23cd93ada23ec59a96f215139753fbfe3a4d989549bcb390f8c00370b39", size = 243498, upload-time = "2025-10-24T15:48:48.101Z" },
-    { url = "https://files.pythonhosted.org/packages/37/d7/ffed10c7da677f2a9da307d491b9eb1d0125b0307019c4ad3d665fd31f4f/orjson-3.11.4-cp311-cp311-macosx_15_0_arm64.whl", hash = "sha256:5c3aedecfc1beb988c27c79d52ebefab93b6c3921dbec361167e6559aba2d36d", size = 128961, upload-time = "2025-10-24T15:48:49.571Z" },
-    { url = "https://files.pythonhosted.org/packages/a2/96/3e4d10a18866d1368f73c8c44b7fe37cc8a15c32f2a7620be3877d4c55a3/orjson-3.11.4-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:da9e5301f1c2caa2a9a4a303480d79c9ad73560b2e7761de742ab39fe59d9175", size = 130321, upload-time = "2025-10-24T15:48:50.713Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/1f/465f66e93f434f968dd74d5b623eb62c657bdba2332f5a8be9f118bb74c7/orjson-3.11.4-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:8873812c164a90a79f65368f8f96817e59e35d0cc02786a5356f0e2abed78040", size = 129207, upload-time = "2025-10-24T15:48:52.193Z" },
-    { url = "https://files.pythonhosted.org/packages/28/43/d1e94837543321c119dff277ae8e348562fe8c0fafbb648ef7cb0c67e521/orjson-3.11.4-cp311-cp311-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:5d7feb0741ebb15204e748f26c9638e6665a5fa93c37a2c73d64f1669b0ddc63", size = 136323, upload-time = "2025-10-24T15:48:54.806Z" },
-    { url = "https://files.pythonhosted.org/packages/bf/04/93303776c8890e422a5847dd012b4853cdd88206b8bbd3edc292c90102d1/orjson-3.11.4-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:01ee5487fefee21e6910da4c2ee9eef005bee568a0879834df86f888d2ffbdd9", size = 137440, upload-time = "2025-10-24T15:48:56.326Z" },
-    { url = "https://files.pythonhosted.org/packages/1e/ef/75519d039e5ae6b0f34d0336854d55544ba903e21bf56c83adc51cd8bf82/orjson-3.11.4-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:3d40d46f348c0321df01507f92b95a377240c4ec31985225a6668f10e2676f9a", size = 136680, upload-time = "2025-10-24T15:48:57.476Z" },
-    { url = "https://files.pythonhosted.org/packages/b5/18/bf8581eaae0b941b44efe14fee7b7862c3382fbc9a0842132cfc7cf5ecf4/orjson-3.11.4-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:95713e5fc8af84d8edc75b785d2386f653b63d62b16d681687746734b4dfc0be", size = 136160, upload-time = "2025-10-24T15:48:59.631Z" },
-    { url = "https://files.pythonhosted.org/packages/c4/35/a6d582766d351f87fc0a22ad740a641b0a8e6fc47515e8614d2e4790ae10/orjson-3.11.4-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:ad73ede24f9083614d6c4ca9a85fe70e33be7bf047ec586ee2363bc7418fe4d7", size = 140318, upload-time = "2025-10-24T15:49:00.834Z" },
-    { url = "https://files.pythonhosted.org/packages/76/b3/5a4801803ab2e2e2d703bce1a56540d9f99a9143fbec7bf63d225044fef8/orjson-3.11.4-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:842289889de515421f3f224ef9c1f1efb199a32d76d8d2ca2706fa8afe749549", size = 406330, upload-time = "2025-10-24T15:49:02.327Z" },
-    { url = "https://files.pythonhosted.org/packages/80/55/a8f682f64833e3a649f620eafefee175cbfeb9854fc5b710b90c3bca45df/orjson-3.11.4-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:3b2427ed5791619851c52a1261b45c233930977e7de8cf36de05636c708fa905", size = 149580, upload-time = "2025-10-24T15:49:03.517Z" },
-    { url = "https://files.pythonhosted.org/packages/ad/e4/c132fa0c67afbb3eb88274fa98df9ac1f631a675e7877037c611805a4413/orjson-3.11.4-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:3c36e524af1d29982e9b190573677ea02781456b2e537d5840e4538a5ec41907", size = 139846, upload-time = "2025-10-24T15:49:04.761Z" },
-    { url = "https://files.pythonhosted.org/packages/54/06/dc3491489efd651fef99c5908e13951abd1aead1257c67f16135f95ce209/orjson-3.11.4-cp311-cp311-win32.whl", hash = "sha256:87255b88756eab4a68ec61837ca754e5d10fa8bc47dc57f75cedfeaec358d54c", size = 135781, upload-time = "2025-10-24T15:49:05.969Z" },
-    { url = "https://files.pythonhosted.org/packages/79/b7/5e5e8d77bd4ea02a6ac54c42c818afb01dd31961be8a574eb79f1d2cfb1e/orjson-3.11.4-cp311-cp311-win_amd64.whl", hash = "sha256:e2d5d5d798aba9a0e1fede8d853fa899ce2cb930ec0857365f700dffc2c7af6a", size = 131391, upload-time = "2025-10-24T15:49:07.355Z" },
-    { url = "https://files.pythonhosted.org/packages/0f/dc/9484127cc1aa213be398ed735f5f270eedcb0c0977303a6f6ddc46b60204/orjson-3.11.4-cp311-cp311-win_arm64.whl", hash = "sha256:6bb6bb41b14c95d4f2702bce9975fda4516f1db48e500102fc4d8119032ff045", size = 126252, upload-time = "2025-10-24T15:49:08.869Z" },
-    { url = "https://files.pythonhosted.org/packages/63/51/6b556192a04595b93e277a9ff71cd0cc06c21a7df98bcce5963fa0f5e36f/orjson-3.11.4-cp312-cp312-macosx_10_15_x86_64.macosx_11_0_arm64.macosx_10_15_universal2.whl", hash = "sha256:d4371de39319d05d3f482f372720b841c841b52f5385bd99c61ed69d55d9ab50", size = 243571, upload-time = "2025-10-24T15:49:10.008Z" },
-    { url = "https://files.pythonhosted.org/packages/1c/2c/2602392ddf2601d538ff11848b98621cd465d1a1ceb9db9e8043181f2f7b/orjson-3.11.4-cp312-cp312-macosx_15_0_arm64.whl", hash = "sha256:e41fd3b3cac850eaae78232f37325ed7d7436e11c471246b87b2cd294ec94853", size = 128891, upload-time = "2025-10-24T15:49:11.297Z" },
-    { url = "https://files.pythonhosted.org/packages/4e/47/bf85dcf95f7a3a12bf223394a4f849430acd82633848d52def09fa3f46ad/orjson-3.11.4-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:600e0e9ca042878c7fdf189cf1b028fe2c1418cc9195f6cb9824eb6ed99cb938", size = 130137, upload-time = "2025-10-24T15:49:12.544Z" },
-    { url = "https://files.pythonhosted.org/packages/b4/4d/a0cb31007f3ab6f1fd2a1b17057c7c349bc2baf8921a85c0180cc7be8011/orjson-3.11.4-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:7bbf9b333f1568ef5da42bc96e18bf30fd7f8d54e9ae066d711056add508e415", size = 129152, upload-time = "2025-10-24T15:49:13.754Z" },
-    { url = "https://files.pythonhosted.org/packages/f7/ef/2811def7ce3d8576b19e3929fff8f8f0d44bc5eb2e0fdecb2e6e6cc6c720/orjson-3.11.4-cp312-cp312-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:4806363144bb6e7297b8e95870e78d30a649fdc4e23fc84daa80c8ebd366ce44", size = 136834, upload-time = "2025-10-24T15:49:15.307Z" },
-    { url = "https://files.pythonhosted.org/packages/00/d4/9aee9e54f1809cec8ed5abd9bc31e8a9631d19460e3b8470145d25140106/orjson-3.11.4-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ad355e8308493f527d41154e9053b86a5be892b3b359a5c6d5d95cda23601cb2", size = 137519, upload-time = "2025-10-24T15:49:16.557Z" },
-    { url = "https://files.pythonhosted.org/packages/db/ea/67bfdb5465d5679e8ae8d68c11753aaf4f47e3e7264bad66dc2f2249e643/orjson-3.11.4-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:c8a7517482667fb9f0ff1b2f16fe5829296ed7a655d04d68cd9711a4d8a4e708", size = 136749, upload-time = "2025-10-24T15:49:17.796Z" },
-    { url = "https://files.pythonhosted.org/packages/01/7e/62517dddcfce6d53a39543cd74d0dccfcbdf53967017c58af68822100272/orjson-3.11.4-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:97eb5942c7395a171cbfecc4ef6701fc3c403e762194683772df4c54cfbb2210", size = 136325, upload-time = "2025-10-24T15:49:19.347Z" },
-    { url = "https://files.pythonhosted.org/packages/18/ae/40516739f99ab4c7ec3aaa5cc242d341fcb03a45d89edeeaabc5f69cb2cf/orjson-3.11.4-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:149d95d5e018bdd822e3f38c103b1a7c91f88d38a88aada5c4e9b3a73a244241", size = 140204, upload-time = "2025-10-24T15:49:20.545Z" },
-    { url = "https://files.pythonhosted.org/packages/82/18/ff5734365623a8916e3a4037fcef1cd1782bfc14cf0992afe7940c5320bf/orjson-3.11.4-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:624f3951181eb46fc47dea3d221554e98784c823e7069edb5dbd0dc826ac909b", size = 406242, upload-time = "2025-10-24T15:49:21.884Z" },
-    { url = "https://files.pythonhosted.org/packages/e1/43/96436041f0a0c8c8deca6a05ebeaf529bf1de04839f93ac5e7c479807aec/orjson-3.11.4-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:03bfa548cf35e3f8b3a96c4e8e41f753c686ff3d8e182ce275b1751deddab58c", size = 150013, upload-time = "2025-10-24T15:49:23.185Z" },
-    { url = "https://files.pythonhosted.org/packages/1b/48/78302d98423ed8780479a1e682b9aecb869e8404545d999d34fa486e573e/orjson-3.11.4-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:525021896afef44a68148f6ed8a8bf8375553d6066c7f48537657f64823565b9", size = 139951, upload-time = "2025-10-24T15:49:24.428Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/7b/ad613fdcdaa812f075ec0875143c3d37f8654457d2af17703905425981bf/orjson-3.11.4-cp312-cp312-win32.whl", hash = "sha256:b58430396687ce0f7d9eeb3dd47761ca7d8fda8e9eb92b3077a7a353a75efefa", size = 136049, upload-time = "2025-10-24T15:49:25.973Z" },
-    { url = "https://files.pythonhosted.org/packages/b9/3c/9cf47c3ff5f39b8350fb21ba65d789b6a1129d4cbb3033ba36c8a9023520/orjson-3.11.4-cp312-cp312-win_amd64.whl", hash = "sha256:c6dbf422894e1e3c80a177133c0dda260f81428f9de16d61041949f6a2e5c140", size = 131461, upload-time = "2025-10-24T15:49:27.259Z" },
-    { url = "https://files.pythonhosted.org/packages/c6/3b/e2425f61e5825dc5b08c2a5a2b3af387eaaca22a12b9c8c01504f8614c36/orjson-3.11.4-cp312-cp312-win_arm64.whl", hash = "sha256:d38d2bc06d6415852224fcc9c0bfa834c25431e466dc319f0edd56cca81aa96e", size = 126167, upload-time = "2025-10-24T15:49:28.511Z" },
-    { url = "https://files.pythonhosted.org/packages/23/15/c52aa7112006b0f3d6180386c3a46ae057f932ab3425bc6f6ac50431cca1/orjson-3.11.4-cp313-cp313-macosx_10_15_x86_64.macosx_11_0_arm64.macosx_10_15_universal2.whl", hash = "sha256:2d6737d0e616a6e053c8b4acc9eccea6b6cce078533666f32d140e4f85002534", size = 243525, upload-time = "2025-10-24T15:49:29.737Z" },
-    { url = "https://files.pythonhosted.org/packages/ec/38/05340734c33b933fd114f161f25a04e651b0c7c33ab95e9416ade5cb44b8/orjson-3.11.4-cp313-cp313-macosx_15_0_arm64.whl", hash = "sha256:afb14052690aa328cc118a8e09f07c651d301a72e44920b887c519b313d892ff", size = 128871, upload-time = "2025-10-24T15:49:31.109Z" },
-    { url = "https://files.pythonhosted.org/packages/55/b9/ae8d34899ff0c012039b5a7cb96a389b2476e917733294e498586b45472d/orjson-3.11.4-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:38aa9e65c591febb1b0aed8da4d469eba239d434c218562df179885c94e1a3ad", size = 130055, upload-time = "2025-10-24T15:49:33.382Z" },
-    { url = "https://files.pythonhosted.org/packages/33/aa/6346dd5073730451bee3681d901e3c337e7ec17342fb79659ec9794fc023/orjson-3.11.4-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:f2cf4dfaf9163b0728d061bebc1e08631875c51cd30bf47cb9e3293bfbd7dcd5", size = 129061, upload-time = "2025-10-24T15:49:34.935Z" },
-    { url = "https://files.pythonhosted.org/packages/39/e4/8eea51598f66a6c853c380979912d17ec510e8e66b280d968602e680b942/orjson-3.11.4-cp313-cp313-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:89216ff3dfdde0e4070932e126320a1752c9d9a758d6a32ec54b3b9334991a6a", size = 136541, upload-time = "2025-10-24T15:49:36.923Z" },
-    { url = "https://files.pythonhosted.org/packages/9a/47/cb8c654fa9adcc60e99580e17c32b9e633290e6239a99efa6b885aba9dbc/orjson-3.11.4-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:9daa26ca8e97fae0ce8aa5d80606ef8f7914e9b129b6b5df9104266f764ce436", size = 137535, upload-time = "2025-10-24T15:49:38.307Z" },
-    { url = "https://files.pythonhosted.org/packages/43/92/04b8cc5c2b729f3437ee013ce14a60ab3d3001465d95c184758f19362f23/orjson-3.11.4-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:5c8b2769dc31883c44a9cd126560327767f848eb95f99c36c9932f51090bfce9", size = 136703, upload-time = "2025-10-24T15:49:40.795Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/fd/d0733fcb9086b8be4ebcfcda2d0312865d17d0d9884378b7cffb29d0763f/orjson-3.11.4-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:1469d254b9884f984026bd9b0fa5bbab477a4bfe558bba6848086f6d43eb5e73", size = 136293, upload-time = "2025-10-24T15:49:42.347Z" },
-    { url = "https://files.pythonhosted.org/packages/c2/d7/3c5514e806837c210492d72ae30ccf050ce3f940f45bf085bab272699ef4/orjson-3.11.4-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:68e44722541983614e37117209a194e8c3ad07838ccb3127d96863c95ec7f1e0", size = 140131, upload-time = "2025-10-24T15:49:43.638Z" },
-    { url = "https://files.pythonhosted.org/packages/9c/dd/ba9d32a53207babf65bd510ac4d0faaa818bd0df9a9c6f472fe7c254f2e3/orjson-3.11.4-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:8e7805fda9672c12be2f22ae124dcd7b03928d6c197544fe12174b86553f3196", size = 406164, upload-time = "2025-10-24T15:49:45.498Z" },
-    { url = "https://files.pythonhosted.org/packages/8e/f9/f68ad68f4af7c7bde57cd514eaa2c785e500477a8bc8f834838eb696a685/orjson-3.11.4-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:04b69c14615fb4434ab867bf6f38b2d649f6f300af30a6705397e895f7aec67a", size = 149859, upload-time = "2025-10-24T15:49:46.981Z" },
-    { url = "https://files.pythonhosted.org/packages/b6/d2/7f847761d0c26818395b3d6b21fb6bc2305d94612a35b0a30eae65a22728/orjson-3.11.4-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:639c3735b8ae7f970066930e58cf0ed39a852d417c24acd4a25fc0b3da3c39a6", size = 139926, upload-time = "2025-10-24T15:49:48.321Z" },
-    { url = "https://files.pythonhosted.org/packages/9f/37/acd14b12dc62db9a0e1d12386271b8661faae270b22492580d5258808975/orjson-3.11.4-cp313-cp313-win32.whl", hash = "sha256:6c13879c0d2964335491463302a6ca5ad98105fc5db3565499dcb80b1b4bd839", size = 136007, upload-time = "2025-10-24T15:49:49.938Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/a9/967be009ddf0a1fffd7a67de9c36656b28c763659ef91352acc02cbe364c/orjson-3.11.4-cp313-cp313-win_amd64.whl", hash = "sha256:09bf242a4af98732db9f9a1ec57ca2604848e16f132e3f72edfd3c5c96de009a", size = 131314, upload-time = "2025-10-24T15:49:51.248Z" },
-    { url = "https://files.pythonhosted.org/packages/cb/db/399abd6950fbd94ce125cb8cd1a968def95174792e127b0642781e040ed4/orjson-3.11.4-cp313-cp313-win_arm64.whl", hash = "sha256:a85f0adf63319d6c1ba06fb0dbf997fced64a01179cf17939a6caca662bf92de", size = 126152, upload-time = "2025-10-24T15:49:52.922Z" },
-    { url = "https://files.pythonhosted.org/packages/25/e3/54ff63c093cc1697e758e4fceb53164dd2661a7d1bcd522260ba09f54533/orjson-3.11.4-cp314-cp314-macosx_10_15_x86_64.macosx_11_0_arm64.macosx_10_15_universal2.whl", hash = "sha256:42d43a1f552be1a112af0b21c10a5f553983c2a0938d2bbb8ecd8bc9fb572803", size = 243501, upload-time = "2025-10-24T15:49:54.288Z" },
-    { url = "https://files.pythonhosted.org/packages/ac/7d/e2d1076ed2e8e0ae9badca65bf7ef22710f93887b29eaa37f09850604e09/orjson-3.11.4-cp314-cp314-macosx_15_0_arm64.whl", hash = "sha256:26a20f3fbc6c7ff2cb8e89c4c5897762c9d88cf37330c6a117312365d6781d54", size = 128862, upload-time = "2025-10-24T15:49:55.961Z" },
-    { url = "https://files.pythonhosted.org/packages/9f/37/ca2eb40b90621faddfa9517dfe96e25f5ae4d8057a7c0cdd613c17e07b2c/orjson-3.11.4-cp314-cp314-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:6e3f20be9048941c7ffa8fc523ccbd17f82e24df1549d1d1fe9317712d19938e", size = 130047, upload-time = "2025-10-24T15:49:57.406Z" },
-    { url = "https://files.pythonhosted.org/packages/c7/62/1021ed35a1f2bad9040f05fa4cc4f9893410df0ba3eaa323ccf899b1c90a/orjson-3.11.4-cp314-cp314-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:aac364c758dc87a52e68e349924d7e4ded348dedff553889e4d9f22f74785316", size = 129073, upload-time = "2025-10-24T15:49:58.782Z" },
-    { url = "https://files.pythonhosted.org/packages/e8/3f/f84d966ec2a6fd5f73b1a707e7cd876813422ae4bf9f0145c55c9c6a0f57/orjson-3.11.4-cp314-cp314-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:d5c54a6d76e3d741dcc3f2707f8eeb9ba2a791d3adbf18f900219b62942803b1", size = 136597, upload-time = "2025-10-24T15:50:00.12Z" },
-    { url = "https://files.pythonhosted.org/packages/32/78/4fa0aeca65ee82bbabb49e055bd03fa4edea33f7c080c5c7b9601661ef72/orjson-3.11.4-cp314-cp314-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:f28485bdca8617b79d44627f5fb04336897041dfd9fa66d383a49d09d86798bc", size = 137515, upload-time = "2025-10-24T15:50:01.57Z" },
-    { url = "https://files.pythonhosted.org/packages/c1/9d/0c102e26e7fde40c4c98470796d050a2ec1953897e2c8ab0cb95b0759fa2/orjson-3.11.4-cp314-cp314-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:bfc2a484cad3585e4ba61985a6062a4c2ed5c7925db6d39f1fa267c9d166487f", size = 136703, upload-time = "2025-10-24T15:50:02.944Z" },
-    { url = "https://files.pythonhosted.org/packages/df/ac/2de7188705b4cdfaf0b6c97d2f7849c17d2003232f6e70df98602173f788/orjson-3.11.4-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:e34dbd508cb91c54f9c9788923daca129fe5b55c5b4eebe713bf5ed3791280cf", size = 136311, upload-time = "2025-10-24T15:50:04.441Z" },
-    { url = "https://files.pythonhosted.org/packages/e0/52/847fcd1a98407154e944feeb12e3b4d487a0e264c40191fb44d1269cbaa1/orjson-3.11.4-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:b13c478fa413d4b4ee606ec8e11c3b2e52683a640b006bb586b3041c2ca5f606", size = 140127, upload-time = "2025-10-24T15:50:07.398Z" },
-    { url = "https://files.pythonhosted.org/packages/c1/ae/21d208f58bdb847dd4d0d9407e2929862561841baa22bdab7aea10ca088e/orjson-3.11.4-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:724ca721ecc8a831b319dcd72cfa370cc380db0bf94537f08f7edd0a7d4e1780", size = 406201, upload-time = "2025-10-24T15:50:08.796Z" },
-    { url = "https://files.pythonhosted.org/packages/8d/55/0789d6de386c8366059db098a628e2ad8798069e94409b0d8935934cbcb9/orjson-3.11.4-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:977c393f2e44845ce1b540e19a786e9643221b3323dae190668a98672d43fb23", size = 149872, upload-time = "2025-10-24T15:50:10.234Z" },
-    { url = "https://files.pythonhosted.org/packages/cc/1d/7ff81ea23310e086c17b41d78a72270d9de04481e6113dbe2ac19118f7fb/orjson-3.11.4-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:1e539e382cf46edec157ad66b0b0872a90d829a6b71f17cb633d6c160a223155", size = 139931, upload-time = "2025-10-24T15:50:11.623Z" },
-    { url = "https://files.pythonhosted.org/packages/77/92/25b886252c50ed64be68c937b562b2f2333b45afe72d53d719e46a565a50/orjson-3.11.4-cp314-cp314-win32.whl", hash = "sha256:d63076d625babab9db5e7836118bdfa086e60f37d8a174194ae720161eb12394", size = 136065, upload-time = "2025-10-24T15:50:13.025Z" },
-    { url = "https://files.pythonhosted.org/packages/63/b8/718eecf0bb7e9d64e4956afaafd23db9f04c776d445f59fe94f54bdae8f0/orjson-3.11.4-cp314-cp314-win_amd64.whl", hash = "sha256:0a54d6635fa3aaa438ae32e8570b9f0de36f3f6562c308d2a2a452e8b0592db1", size = 131310, upload-time = "2025-10-24T15:50:14.46Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/bf/def5e25d4d8bfce296a9a7c8248109bf58622c21618b590678f945a2c59c/orjson-3.11.4-cp314-cp314-win_arm64.whl", hash = "sha256:78b999999039db3cf58f6d230f524f04f75f129ba3d1ca2ed121f8657e575d3d", size = 126151, upload-time = "2025-10-24T15:50:15.878Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/fd/d6b0a36854179b93ed77839f107c4089d91cccc9f9ba1b752b6e3bac5f34/orjson-3.11.6-cp311-cp311-macosx_10_15_x86_64.macosx_11_0_arm64.macosx_10_15_universal2.whl", hash = "sha256:e259e85a81d76d9665f03d6129e09e4435531870de5961ddcd0bf6e3a7fde7d7", size = 250029, upload-time = "2026-01-29T15:11:35.942Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/bb/22902619826641cf3b627c24aab62e2ad6b571bdd1d34733abb0dd57f67a/orjson-3.11.6-cp311-cp311-macosx_15_0_arm64.whl", hash = "sha256:52263949f41b4a4822c6b1353bcc5ee2f7109d53a3b493501d3369d6d0e7937a", size = 134518, upload-time = "2026-01-29T15:11:37.347Z" },
+    { url = "https://files.pythonhosted.org/packages/72/90/7a818da4bba1de711a9653c420749c0ac95ef8f8651cbc1dca551f462fe0/orjson-3.11.6-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:6439e742fa7834a24698d358a27346bb203bff356ae0402e7f5df8f749c621a8", size = 137917, upload-time = "2026-01-29T15:11:38.511Z" },
+    { url = "https://files.pythonhosted.org/packages/59/0f/02846c1cac8e205cb3822dd8aa8f9114acda216f41fd1999ace6b543418d/orjson-3.11.6-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:b81ffd68f084b4e993e3867acb554a049fa7787cc8710bbcc1e26965580d99be", size = 134923, upload-time = "2026-01-29T15:11:39.711Z" },
+    { url = "https://files.pythonhosted.org/packages/94/cf/aeaf683001b474bb3c3c757073a4231dfdfe8467fceaefa5bfd40902c99f/orjson-3.11.6-cp311-cp311-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:a5a5468e5e60f7ef6d7f9044b06c8f94a3c56ba528c6e4f7f06ae95164b595ec", size = 140752, upload-time = "2026-01-29T15:11:41.347Z" },
+    { url = "https://files.pythonhosted.org/packages/fc/fe/dad52d8315a65f084044a0819d74c4c9daf9ebe0681d30f525b0d29a31f0/orjson-3.11.6-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:72c5005eb45bd2535632d4f3bec7ad392832cfc46b62a3021da3b48a67734b45", size = 144201, upload-time = "2026-01-29T15:11:42.537Z" },
+    { url = "https://files.pythonhosted.org/packages/36/bc/ab070dd421565b831801077f1e390c4d4af8bfcecafc110336680a33866b/orjson-3.11.6-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:0b14dd49f3462b014455a28a4d810d3549bf990567653eb43765cd847df09145", size = 142380, upload-time = "2026-01-29T15:11:44.309Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/d8/4b581c725c3a308717f28bf45a9fdac210bca08b67e8430143699413ff06/orjson-3.11.6-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6e0bb2c1ea30ef302f0f89f9bf3e7f9ab5e2af29dc9f80eb87aa99788e4e2d65", size = 145582, upload-time = "2026-01-29T15:11:45.506Z" },
+    { url = "https://files.pythonhosted.org/packages/5b/a2/09aab99b39f9a7f175ea8fa29adb9933a3d01e7d5d603cdee7f1c40c8da2/orjson-3.11.6-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:825e0a85d189533c6bff7e2fc417a28f6fcea53d27125c4551979aecd6c9a197", size = 147270, upload-time = "2026-01-29T15:11:46.782Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/2f/5ef8eaf7829dc50da3bf497c7775b21ee88437bc8c41f959aa3504ca6631/orjson-3.11.6-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:b04575417a26530637f6ab4b1f7b4f666eb0433491091da4de38611f97f2fcf3", size = 421222, upload-time = "2026-01-29T15:11:48.106Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/b0/dd6b941294c2b5b13da5fdc7e749e58d0c55a5114ab37497155e83050e95/orjson-3.11.6-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:b83eb2e40e8c4da6d6b340ee6b1d6125f5195eb1b0ebb7eac23c6d9d4f92d224", size = 155562, upload-time = "2026-01-29T15:11:49.408Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/09/43924331a847476ae2f9a16bd6d3c9dab301265006212ba0d3d7fd58763a/orjson-3.11.6-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:1f42da604ee65a6b87eef858c913ce3e5777872b19321d11e6fc6d21de89b64f", size = 147432, upload-time = "2026-01-29T15:11:50.635Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/e9/d9865961081816909f6b49d880749dbbd88425afd7c5bbce0549e2290d77/orjson-3.11.6-cp311-cp311-win32.whl", hash = "sha256:5ae45df804f2d344cffb36c43fdf03c82fb6cd247f5faa41e21891b40dfbf733", size = 139623, upload-time = "2026-01-29T15:11:51.82Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/f9/6836edb92f76eec1082919101eb1145d2f9c33c8f2c5e6fa399b82a2aaa8/orjson-3.11.6-cp311-cp311-win_amd64.whl", hash = "sha256:f4295948d65ace0a2d8f2c4ccc429668b7eb8af547578ec882e16bf79b0050b2", size = 136647, upload-time = "2026-01-29T15:11:53.454Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/0c/4954082eea948c9ae52ee0bcbaa2f99da3216a71bcc314ab129bde22e565/orjson-3.11.6-cp311-cp311-win_arm64.whl", hash = "sha256:314e9c45e0b81b547e3a1cfa3df3e07a815821b3dac9fe8cb75014071d0c16a4", size = 135327, upload-time = "2026-01-29T15:11:56.616Z" },
+    { url = "https://files.pythonhosted.org/packages/14/ba/759f2879f41910b7e5e0cdbd9cf82a4f017c527fb0e972e9869ca7fe4c8e/orjson-3.11.6-cp312-cp312-macosx_10_15_x86_64.macosx_11_0_arm64.macosx_10_15_universal2.whl", hash = "sha256:6f03f30cd8953f75f2a439070c743c7336d10ee940da918d71c6f3556af3ddcf", size = 249988, upload-time = "2026-01-29T15:11:58.294Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/70/54cecb929e6c8b10104fcf580b0cc7dc551aa193e83787dd6f3daba28bb5/orjson-3.11.6-cp312-cp312-macosx_15_0_arm64.whl", hash = "sha256:af44baae65ef386ad971469a8557a0673bb042b0b9fd4397becd9c2dfaa02588", size = 134445, upload-time = "2026-01-29T15:11:59.819Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/6f/ec0309154457b9ba1ad05f11faa4441f76037152f75e1ac577db3ce7ca96/orjson-3.11.6-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c310a48542094e4f7dbb6ac076880994986dda8ca9186a58c3cb70a3514d3231", size = 137708, upload-time = "2026-01-29T15:12:01.488Z" },
+    { url = "https://files.pythonhosted.org/packages/20/52/3c71b80840f8bab9cb26417302707b7716b7d25f863f3a541bcfa232fe6e/orjson-3.11.6-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:d8dfa7a5d387f15ecad94cb6b2d2d5f4aeea64efd8d526bfc03c9812d01e1cc0", size = 134798, upload-time = "2026-01-29T15:12:02.705Z" },
+    { url = "https://files.pythonhosted.org/packages/30/51/b490a43b22ff736282360bd02e6bded455cf31dfc3224e01cd39f919bbd2/orjson-3.11.6-cp312-cp312-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:ba8daee3e999411b50f8b50dbb0a3071dd1845f3f9a1a0a6fa6de86d1689d84d", size = 140839, upload-time = "2026-01-29T15:12:03.956Z" },
+    { url = "https://files.pythonhosted.org/packages/95/bc/4bcfe4280c1bc63c5291bb96f98298845b6355da2226d3400e17e7b51e53/orjson-3.11.6-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:f89d104c974eafd7436d7a5fdbc57f7a1e776789959a2f4f1b2eab5c62a339f4", size = 144080, upload-time = "2026-01-29T15:12:05.151Z" },
+    { url = "https://files.pythonhosted.org/packages/01/74/22970f9ead9ab1f1b5f8c227a6c3aa8d71cd2c5acd005868a1d44f2362fa/orjson-3.11.6-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:b2e2e2456788ca5ea75616c40da06fc885a7dc0389780e8a41bf7c5389ba257b", size = 142435, upload-time = "2026-01-29T15:12:06.641Z" },
+    { url = "https://files.pythonhosted.org/packages/29/34/d564aff85847ab92c82ee43a7a203683566c2fca0723a5f50aebbe759603/orjson-3.11.6-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2a42efebc45afabb1448001e90458c4020d5c64fbac8a8dc4045b777db76cb5a", size = 145631, upload-time = "2026-01-29T15:12:08.351Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/ef/016957a3890752c4aa2368326ea69fa53cdc1fdae0a94a542b6410dbdf52/orjson-3.11.6-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:71b7cbef8471324966c3738c90ba38775563ef01b512feb5ad4805682188d1b9", size = 147058, upload-time = "2026-01-29T15:12:10.023Z" },
+    { url = "https://files.pythonhosted.org/packages/56/cc/9a899c3972085645b3225569f91a30e221f441e5dc8126e6d060b971c252/orjson-3.11.6-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:f8515e5910f454fe9a8e13c2bb9dc4bae4c1836313e967e72eb8a4ad874f0248", size = 421161, upload-time = "2026-01-29T15:12:11.308Z" },
+    { url = "https://files.pythonhosted.org/packages/21/a8/767d3fbd6d9b8fdee76974db40619399355fd49bf91a6dd2c4b6909ccf05/orjson-3.11.6-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:300360edf27c8c9bf7047345a94fddf3a8b8922df0ff69d71d854a170cb375cf", size = 155757, upload-time = "2026-01-29T15:12:12.776Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/0b/205cd69ac87e2272e13ef3f5f03a3d4657e317e38c1b08aaa2ef97060bbc/orjson-3.11.6-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:caaed4dad39e271adfadc106fab634d173b2bb23d9cf7e67bd645f879175ebfc", size = 147446, upload-time = "2026-01-29T15:12:14.166Z" },
+    { url = "https://files.pythonhosted.org/packages/de/c5/dd9f22aa9f27c54c7d05cc32f4580c9ac9b6f13811eeb81d6c4c3f50d6b1/orjson-3.11.6-cp312-cp312-win32.whl", hash = "sha256:955368c11808c89793e847830e1b1007503a5923ddadc108547d3b77df761044", size = 139717, upload-time = "2026-01-29T15:12:15.7Z" },
+    { url = "https://files.pythonhosted.org/packages/23/a1/e62fc50d904486970315a1654b8cfb5832eb46abb18cd5405118e7e1fc79/orjson-3.11.6-cp312-cp312-win_amd64.whl", hash = "sha256:2c68de30131481150073d90a5d227a4a421982f42c025ecdfb66157f9579e06f", size = 136711, upload-time = "2026-01-29T15:12:17.055Z" },
+    { url = "https://files.pythonhosted.org/packages/04/3d/b4fefad8bdf91e0fe212eb04975aeb36ea92997269d68857efcc7eb1dda3/orjson-3.11.6-cp312-cp312-win_arm64.whl", hash = "sha256:65dfa096f4e3a5e02834b681f539a87fbe85adc82001383c0db907557f666bfc", size = 135212, upload-time = "2026-01-29T15:12:18.3Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/45/d9c71c8c321277bc1ceebf599bc55ba826ae538b7c61f287e9a7e71bd589/orjson-3.11.6-cp313-cp313-macosx_10_15_x86_64.macosx_11_0_arm64.macosx_10_15_universal2.whl", hash = "sha256:e4ae1670caabb598a88d385798692ce2a1b2f078971b3329cfb85253c6097f5b", size = 249828, upload-time = "2026-01-29T15:12:20.14Z" },
+    { url = "https://files.pythonhosted.org/packages/ac/7e/4afcf4cfa9c2f93846d70eee9c53c3c0123286edcbeb530b7e9bd2aea1b2/orjson-3.11.6-cp313-cp313-macosx_15_0_arm64.whl", hash = "sha256:2c6b81f47b13dac2caa5d20fbc953c75eb802543abf48403a4703ed3bff225f0", size = 134339, upload-time = "2026-01-29T15:12:22.01Z" },
+    { url = "https://files.pythonhosted.org/packages/40/10/6d2b8a064c8d2411d3d0ea6ab43125fae70152aef6bea77bb50fa54d4097/orjson-3.11.6-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:647d6d034e463764e86670644bdcaf8e68b076e6e74783383b01085ae9ab334f", size = 137662, upload-time = "2026-01-29T15:12:23.307Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/50/5804ea7d586baf83ee88969eefda97a24f9a5bdba0727f73e16305175b26/orjson-3.11.6-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:8523b9cc4ef174ae52414f7699e95ee657c16aa18b3c3c285d48d7966cce9081", size = 134626, upload-time = "2026-01-29T15:12:25.099Z" },
+    { url = "https://files.pythonhosted.org/packages/9e/2e/f0492ed43e376722bb4afd648e06cc1e627fc7ec8ff55f6ee739277813ea/orjson-3.11.6-cp313-cp313-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:313dfd7184cde50c733fc0d5c8c0e2f09017b573afd11dc36bd7476b30b4cb17", size = 140873, upload-time = "2026-01-29T15:12:26.369Z" },
+    { url = "https://files.pythonhosted.org/packages/10/15/6f874857463421794a303a39ac5494786ad46a4ab46d92bda6705d78c5aa/orjson-3.11.6-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:905ee036064ff1e1fd1fb800055ac477cdcb547a78c22c1bc2bbf8d5d1a6fb42", size = 144044, upload-time = "2026-01-29T15:12:28.082Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/c7/b7223a3a70f1d0cc2d86953825de45f33877ee1b124a91ca1f79aa6e643f/orjson-3.11.6-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:ce374cb98411356ba906914441fc993f271a7a666d838d8de0e0900dd4a4bc12", size = 142396, upload-time = "2026-01-29T15:12:30.529Z" },
+    { url = "https://files.pythonhosted.org/packages/87/e3/aa1b6d3ad3cd80f10394134f73ae92a1d11fdbe974c34aa199cc18bb5fcf/orjson-3.11.6-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:cded072b9f65fcfd188aead45efa5bd528ba552add619b3ad2a81f67400ec450", size = 145600, upload-time = "2026-01-29T15:12:31.848Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/cf/e4aac5a46cbd39d7e769ef8650efa851dfce22df1ba97ae2b33efe893b12/orjson-3.11.6-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:7ab85bdbc138e1f73a234db6bb2e4cc1f0fcec8f4bd2bd2430e957a01aadf746", size = 146967, upload-time = "2026-01-29T15:12:33.203Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/04/975b86a4bcf6cfeda47aad15956d52fbeda280811206e9967380fa9355c8/orjson-3.11.6-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:351b96b614e3c37a27b8ab048239ebc1e0be76cc17481a430d70a77fb95d3844", size = 421003, upload-time = "2026-01-29T15:12:35.097Z" },
+    { url = "https://files.pythonhosted.org/packages/28/d1/0369d0baf40eea5ff2300cebfe209883b2473ab4aa4c4974c8bd5ee42bb2/orjson-3.11.6-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:f9959c85576beae5cdcaaf39510b15105f1ee8b70d5dacd90152617f57be8c83", size = 155695, upload-time = "2026-01-29T15:12:36.589Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/1f/d10c6d6ae26ff1d7c3eea6fd048280ef2e796d4fb260c5424fd021f68ecf/orjson-3.11.6-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:75682d62b1b16b61a30716d7a2ec1f4c36195de4a1c61f6665aedd947b93a5d5", size = 147392, upload-time = "2026-01-29T15:12:37.876Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/43/7479921c174441a0aa5277c313732e20713c0969ac303be9f03d88d3db5d/orjson-3.11.6-cp313-cp313-win32.whl", hash = "sha256:40dc277999c2ef227dcc13072be879b4cfd325502daeb5c35ed768f706f2bf30", size = 139718, upload-time = "2026-01-29T15:12:39.274Z" },
+    { url = "https://files.pythonhosted.org/packages/88/bc/9ffe7dfbf8454bc4e75bb8bf3a405ed9e0598df1d3535bb4adcd46be07d0/orjson-3.11.6-cp313-cp313-win_amd64.whl", hash = "sha256:f0f6e9f8ff7905660bc3c8a54cd4a675aa98f7f175cf00a59815e2ff42c0d916", size = 136635, upload-time = "2026-01-29T15:12:40.593Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/7e/51fa90b451470447ea5023b20d83331ec741ae28d1e6d8ed547c24e7de14/orjson-3.11.6-cp313-cp313-win_arm64.whl", hash = "sha256:1608999478664de848e5900ce41f25c4ecdfc4beacbc632b6fd55e1a586e5d38", size = 135175, upload-time = "2026-01-29T15:12:41.997Z" },
+    { url = "https://files.pythonhosted.org/packages/31/9f/46ca908abaeeec7560638ff20276ab327b980d73b3cc2f5b205b4a1c60b3/orjson-3.11.6-cp314-cp314-macosx_10_15_x86_64.macosx_11_0_arm64.macosx_10_15_universal2.whl", hash = "sha256:6026db2692041d2a23fe2545606df591687787825ad5821971ef0974f2c47630", size = 249823, upload-time = "2026-01-29T15:12:43.332Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/78/ca478089818d18c9cd04f79c43f74ddd031b63c70fa2a946eb5e85414623/orjson-3.11.6-cp314-cp314-macosx_15_0_arm64.whl", hash = "sha256:132b0ab2e20c73afa85cf142e547511feb3d2f5b7943468984658f3952b467d4", size = 134328, upload-time = "2026-01-29T15:12:45.171Z" },
+    { url = "https://files.pythonhosted.org/packages/39/5e/cbb9d830ed4e47f4375ad8eef8e4fff1bf1328437732c3809054fc4e80be/orjson-3.11.6-cp314-cp314-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:b376fb05f20a96ec117d47987dd3b39265c635725bda40661b4c5b73b77b5fde", size = 137651, upload-time = "2026-01-29T15:12:46.602Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/3a/35df6558c5bc3a65ce0961aefee7f8364e59af78749fc796ea255bfa0cf5/orjson-3.11.6-cp314-cp314-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:954dae4e080574672a1dfcf2a840eddef0f27bd89b0e94903dd0824e9c1db060", size = 134596, upload-time = "2026-01-29T15:12:47.95Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/8e/3d32dd7b7f26a19cc4512d6ed0ae3429567c71feef720fe699ff43c5bc9e/orjson-3.11.6-cp314-cp314-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:fe515bb89d59e1e4b48637a964f480b35c0a2676de24e65e55310f6016cca7ce", size = 140923, upload-time = "2026-01-29T15:12:49.333Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/9c/1efbf5c99b3304f25d6f0d493a8d1492ee98693637c10ce65d57be839d7b/orjson-3.11.6-cp314-cp314-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:380f9709c275917af28feb086813923251e11ee10687257cd7f1ea188bcd4485", size = 144068, upload-time = "2026-01-29T15:12:50.927Z" },
+    { url = "https://files.pythonhosted.org/packages/82/83/0d19eeb5be797de217303bbb55dde58dba26f996ed905d301d98fd2d4637/orjson-3.11.6-cp314-cp314-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:a8173e0d3f6081e7034c51cf984036d02f6bab2a2126de5a759d79f8e5a140e7", size = 142493, upload-time = "2026-01-29T15:12:52.432Z" },
+    { url = "https://files.pythonhosted.org/packages/32/a7/573fec3df4dc8fc259b7770dc6c0656f91adce6e19330c78d23f87945d1e/orjson-3.11.6-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6dddf9ba706294906c56ef5150a958317b09aa3a8a48df1c52ccf22ec1907eac", size = 145616, upload-time = "2026-01-29T15:12:53.903Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/0e/23551b16f21690f7fd5122e3cf40fdca5d77052a434d0071990f97f5fe2f/orjson-3.11.6-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:cbae5c34588dc79938dffb0b6fbe8c531f4dc8a6ad7f39759a9eb5d2da405ef2", size = 146951, upload-time = "2026-01-29T15:12:55.698Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/63/5e6c8f39805c39123a18e412434ea364349ee0012548d08aa586e2bd6aa9/orjson-3.11.6-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:f75c318640acbddc419733b57f8a07515e587a939d8f54363654041fd1f4e465", size = 421024, upload-time = "2026-01-29T15:12:57.434Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/4d/724975cf0087f6550bd01fd62203418afc0ea33fd099aed318c5bcc52df8/orjson-3.11.6-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:e0ab8d13aa2a3e98b4a43487c9205b2c92c38c054b4237777484d503357c8437", size = 155774, upload-time = "2026-01-29T15:12:59.397Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/a3/f4c4e3f46b55db29e0a5f20493b924fc791092d9a03ff2068c9fe6c1002f/orjson-3.11.6-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:f884c7fb1020d44612bd7ac0db0babba0e2f78b68d9a650c7959bf99c783773f", size = 147393, upload-time = "2026-01-29T15:13:00.769Z" },
+    { url = "https://files.pythonhosted.org/packages/ee/86/6f5529dd27230966171ee126cecb237ed08e9f05f6102bfaf63e5b32277d/orjson-3.11.6-cp314-cp314-win32.whl", hash = "sha256:8d1035d1b25732ec9f971e833a3e299d2b1a330236f75e6fd945ad982c76aaf3", size = 139760, upload-time = "2026-01-29T15:13:02.173Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/b5/91ae7037b2894a6b5002fb33f4fbccec98424a928469835c3837fbb22a9b/orjson-3.11.6-cp314-cp314-win_amd64.whl", hash = "sha256:931607a8865d21682bb72de54231655c86df1870502d2962dbfd12c82890d077", size = 136633, upload-time = "2026-01-29T15:13:04.267Z" },
+    { url = "https://files.pythonhosted.org/packages/55/74/f473a3ec7a0a7ebc825ca8e3c86763f7d039f379860c81ba12dcdd456547/orjson-3.11.6-cp314-cp314-win_arm64.whl", hash = "sha256:fe71f6b283f4f1832204ab8235ce07adad145052614f77c876fcf0dac97bc06f", size = 135168, upload-time = "2026-01-29T15:13:05.932Z" },
 ]

 [[package]]
@@ -7233,21 +7232,19 @@ wheels = [

 [[package]]
 name = "tornado"
-version = "6.5.2"
+version = "6.5.5"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/09/ce/1eb500eae19f4648281bb2186927bb062d2438c2e5093d1360391afd2f90/tornado-6.5.2.tar.gz", hash = "sha256:ab53c8f9a0fa351e2c0741284e06c7a45da86afb544133201c5cc8578eb076a0", size = 510821, upload-time = "2025-08-08T18:27:00.78Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/f8/f1/3173dfa4a18db4a9b03e5d55325559dab51ee653763bb8745a75af491286/tornado-6.5.5.tar.gz", hash = "sha256:192b8f3ea91bd7f1f50c06955416ed76c6b72f96779b962f07f911b91e8d30e9", size = 516006, upload-time = "2026-03-10T21:31:02.067Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/f6/48/6a7529df2c9cc12efd2e8f5dd219516184d703b34c06786809670df5b3bd/tornado-6.5.2-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:2436822940d37cde62771cff8774f4f00b3c8024fe482e16ca8387b8a2724db6", size = 442563, upload-time = "2025-08-08T18:26:42.945Z" },
-    { url = "https://files.pythonhosted.org/packages/f2/b5/9b575a0ed3e50b00c40b08cbce82eb618229091d09f6d14bce80fc01cb0b/tornado-6.5.2-cp39-abi3-macosx_10_9_x86_64.whl", hash = "sha256:583a52c7aa94ee046854ba81d9ebb6c81ec0fd30386d96f7640c96dad45a03ef", size = 440729, upload-time = "2025-08-08T18:26:44.473Z" },
-    { url = "https://files.pythonhosted.org/packages/1b/4e/619174f52b120efcf23633c817fd3fed867c30bff785e2cd5a53a70e483c/tornado-6.5.2-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:b0fe179f28d597deab2842b86ed4060deec7388f1fd9c1b4a41adf8af058907e", size = 444295, upload-time = "2025-08-08T18:26:46.021Z" },
-    { url = "https://files.pythonhosted.org/packages/95/fa/87b41709552bbd393c85dd18e4e3499dcd8983f66e7972926db8d96aa065/tornado-6.5.2-cp39-abi3-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:b186e85d1e3536d69583d2298423744740986018e393d0321df7340e71898882", size = 443644, upload-time = "2025-08-08T18:26:47.625Z" },
-    { url = "https://files.pythonhosted.org/packages/f9/41/fb15f06e33d7430ca89420283a8762a4e6b8025b800ea51796ab5e6d9559/tornado-6.5.2-cp39-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:e792706668c87709709c18b353da1f7662317b563ff69f00bab83595940c7108", size = 443878, upload-time = "2025-08-08T18:26:50.599Z" },
-    { url = "https://files.pythonhosted.org/packages/11/92/fe6d57da897776ad2e01e279170ea8ae726755b045fe5ac73b75357a5a3f/tornado-6.5.2-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:06ceb1300fd70cb20e43b1ad8aaee0266e69e7ced38fa910ad2e03285009ce7c", size = 444549, upload-time = "2025-08-08T18:26:51.864Z" },
-    { url = "https://files.pythonhosted.org/packages/9b/02/c8f4f6c9204526daf3d760f4aa555a7a33ad0e60843eac025ccfd6ff4a93/tornado-6.5.2-cp39-abi3-musllinux_1_2_i686.whl", hash = "sha256:74db443e0f5251be86cbf37929f84d8c20c27a355dd452a5cfa2aada0d001ec4", size = 443973, upload-time = "2025-08-08T18:26:53.625Z" },
-    { url = "https://files.pythonhosted.org/packages/ae/2d/f5f5707b655ce2317190183868cd0f6822a1121b4baeae509ceb9590d0bd/tornado-6.5.2-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:b5e735ab2889d7ed33b32a459cac490eda71a1ba6857b0118de476ab6c366c04", size = 443954, upload-time = "2025-08-08T18:26:55.072Z" },
-    { url = "https://files.pythonhosted.org/packages/e8/59/593bd0f40f7355806bf6573b47b8c22f8e1374c9b6fd03114bd6b7a3dcfd/tornado-6.5.2-cp39-abi3-win32.whl", hash = "sha256:c6f29e94d9b37a95013bb669616352ddb82e3bfe8326fccee50583caebc8a5f0", size = 445023, upload-time = "2025-08-08T18:26:56.677Z" },
-    { url = "https://files.pythonhosted.org/packages/c7/2a/f609b420c2f564a748a2d80ebfb2ee02a73ca80223af712fca591386cafb/tornado-6.5.2-cp39-abi3-win_amd64.whl", hash = "sha256:e56a5af51cc30dd2cae649429af65ca2f6571da29504a07995175df14c18f35f", size = 445427, upload-time = "2025-08-08T18:26:57.91Z" },
-    { url = "https://files.pythonhosted.org/packages/5e/4f/e1f65e8f8c76d73658b33d33b81eed4322fb5085350e4328d5c956f0c8f9/tornado-6.5.2-cp39-abi3-win_arm64.whl", hash = "sha256:d6c33dc3672e3a1f3618eb63b7ef4683a7688e7b9e6e8f0d9aa5726360a004af", size = 444456, upload-time = "2025-08-08T18:26:59.207Z" },
+    { url = "https://files.pythonhosted.org/packages/59/8c/77f5097695f4dd8255ecbd08b2a1ed8ba8b953d337804dd7080f199e12bf/tornado-6.5.5-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:487dc9cc380e29f58c7ab88f9e27cdeef04b2140862e5076a66fb6bb68bb1bfa", size = 445983, upload-time = "2026-03-10T21:30:44.28Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/5e/7625b76cd10f98f1516c36ce0346de62061156352353ef2da44e5c21523c/tornado-6.5.5-cp39-abi3-macosx_10_9_x86_64.whl", hash = "sha256:65a7f1d46d4bb41df1ac99f5fcb685fb25c7e61613742d5108b010975a9a6521", size = 444246, upload-time = "2026-03-10T21:30:46.571Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/04/7b5705d5b3c0fab088f434f9c83edac1573830ca49ccf29fb83bf7178eec/tornado-6.5.5-cp39-abi3-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:e74c92e8e65086b338fd56333fb9a68b9f6f2fe7ad532645a290a464bcf46be5", size = 447229, upload-time = "2026-03-10T21:30:48.273Z" },
+    { url = "https://files.pythonhosted.org/packages/34/01/74e034a30ef59afb4097ef8659515e96a39d910b712a89af76f5e4e1f93c/tornado-6.5.5-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:435319e9e340276428bbdb4e7fa732c2d399386d1de5686cb331ec8eee754f07", size = 448192, upload-time = "2026-03-10T21:30:51.22Z" },
+    { url = "https://files.pythonhosted.org/packages/be/00/fe9e02c5a96429fce1a1d15a517f5d8444f9c412e0bb9eadfbe3b0fc55bf/tornado-6.5.5-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:3f54aa540bdbfee7b9eb268ead60e7d199de5021facd276819c193c0fb28ea4e", size = 448039, upload-time = "2026-03-10T21:30:53.52Z" },
+    { url = "https://files.pythonhosted.org/packages/82/9e/656ee4cec0398b1d18d0f1eb6372c41c6b889722641d84948351ae19556d/tornado-6.5.5-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:36abed1754faeb80fbd6e64db2758091e1320f6bba74a4cf8c09cd18ccce8aca", size = 447445, upload-time = "2026-03-10T21:30:55.541Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/76/4921c00511f88af86a33de770d64141170f1cfd9c00311aea689949e274e/tornado-6.5.5-cp39-abi3-win32.whl", hash = "sha256:dd3eafaaeec1c7f2f8fdcd5f964e8907ad788fe8a5a32c4426fbbdda621223b7", size = 448582, upload-time = "2026-03-10T21:30:57.142Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/23/f6c6112a04d28eed765e374435fb1a9198f73e1ec4b4024184f21faeb1ad/tornado-6.5.5-cp39-abi3-win_amd64.whl", hash = "sha256:6443a794ba961a9f619b1ae926a2e900ac20c34483eea67be4ed8f1e58d3ef7b", size = 448990, upload-time = "2026-03-10T21:30:58.857Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/c8/876602cbc96469911f0939f703453c1157b0c826ecb05bdd32e023397d4e/tornado-6.5.5-cp39-abi3-win_arm64.whl", hash = "sha256:2c9a876e094109333f888539ddb2de4361743e5d21eece20688e3e351e4990a6", size = 448016, upload-time = "2026-03-10T21:31:00.43Z" },
 ]

 [[package]]
--- a/web/jest.config.js
+++ b/web/jest.config.js
@@ -53,6 +53,8 @@ const sharedConfig = {
        // Testing & Mocking
        "msw",
        "until-async",
+        // Language Detection
+        "linguist-languages",
        // Markdown & Syntax Highlighting
        "react-markdown",
        "remark-.*", // All remark packages
@@ -143,6 +145,7 @@ module.exports = {
        "**/src/app/**/utils/*.test.ts",
        "**/src/app/**/hooks/*.test.ts", // Pure packet processor tests
        "**/src/refresh-components/**/*.test.ts",
+        "**/src/refresh-pages/**/*.test.ts",
        "**/src/sections/**/*.test.ts",
        "**/src/components/**/*.test.ts",
        // Add more patterns here as you add more unit tests
--- a/web/lib/opal/src/components/buttons/open-button/components.tsx
+++ b/web/lib/opal/src/components/buttons/open-button/components.tsx
@@ -55,8 +55,11 @@ type OpenButtonContentProps =
      children?: string;
    };

-type OpenButtonProps = Omit<InteractiveStatefulProps, "variant"> &
-  OpenButtonContentProps & {
+type OpenButtonVariant = "select-light" | "select-heavy" | "select-tinted";
+
+type OpenButtonProps = Omit<InteractiveStatefulProps, "variant"> & {
+  variant?: OpenButtonVariant;
+} & OpenButtonContentProps & {
    /**
     * Size preset — controls gap, text size, and Container height/rounding.
     */
@@ -65,6 +68,13 @@ type OpenButtonProps = Omit<InteractiveStatefulProps, "variant"> &
    /** Width preset. */
    width?: WidthVariant;

+    /**
+     * Content justify mode. When `"between"`, icon+label group left and
+     * chevron pushes to the right edge. Default keeps all items in a
+     * tight `gap-1` row.
+     */
+    justifyContent?: "between";
+
    /** Tooltip text shown on hover. */
    tooltip?: string;

@@ -82,9 +92,11 @@ function OpenButton({
  size = "lg",
  foldable,
  width,
+  justifyContent,
  tooltip,
  tooltipSide = "top",
  interaction,
+  variant = "select-heavy",
  ...statefulProps
 }: OpenButtonProps) {
  const { isDisabled } = useDisabled();
@@ -111,7 +123,7 @@ function OpenButton({

  const button = (
    <Interactive.Stateful
-      variant="select-heavy"
+      variant={variant}
      interaction={resolvedInteraction}
      {...statefulProps}
    >
@@ -125,19 +137,32 @@ function OpenButton({
      >
        <div
          className={cn(
-            "opal-button interactive-foreground flex flex-row items-center gap-1",
-            foldable && "interactive-foldable-host"
+            "opal-button interactive-foreground flex flex-row items-center",
+            justifyContent === "between" ? "w-full justify-between" : "gap-1",
+            foldable &&
+              justifyContent !== "between" &&
+              "interactive-foldable-host"
          )}
        >
-          {iconWrapper(Icon, size, !foldable && !!children)}
-
-          {foldable ? (
-            <Interactive.Foldable>
-              {labelEl}
+          {justifyContent === "between" ? (
+            <>
+              <span className="flex flex-row items-center gap-1">
+                {iconWrapper(Icon, size, !foldable && !!children)}
+                {labelEl}
+              </span>
              {iconWrapper(ChevronIcon, size, !!children)}
-            </Interactive.Foldable>
+            </>
+          ) : foldable ? (
+            <>
+              {iconWrapper(Icon, size, !foldable && !!children)}
+              <Interactive.Foldable>
+                {labelEl}
+                {iconWrapper(ChevronIcon, size, !!children)}
+              </Interactive.Foldable>
+            </>
          ) : (
            <>
+              {iconWrapper(Icon, size, !foldable && !!children)}
              {labelEl}
              {iconWrapper(ChevronIcon, size, !!children)}
            </>
--- a/web/lib/opal/src/core/interactive/stateful/components.tsx
+++ b/web/lib/opal/src/core/interactive/stateful/components.tsx
@@ -10,7 +10,11 @@ import type { WithoutStyles } from "@opal/types";
 // Types
 // ---------------------------------------------------------------------------

-type InteractiveStatefulVariant = "select-light" | "select-heavy" | "sidebar";
+type InteractiveStatefulVariant =
+  | "select-light"
+  | "select-heavy"
+  | "select-tinted"
+  | "sidebar";
 type InteractiveStatefulState = "empty" | "filled" | "selected";
 type InteractiveStatefulInteraction = "rest" | "hover" | "active";

--- a/web/lib/opal/src/core/interactive/stateful/styles.css
+++ b/web/lib/opal/src/core/interactive/stateful/styles.css
@@ -11,7 +11,7 @@
   Children read the variables with no independent transitions.

   State dimension: `data-interactive-state` = "empty" | "filled" | "selected"
-   Variant dimension: `data-interactive-variant` = "select-light" | "select-heavy" | "sidebar"
+   Variant dimension: `data-interactive-variant` = "select-light" | "select-heavy" | "select-tinted" | "sidebar"

   Interaction override: `data-interaction="hover"` and `data-interaction="active"`
   allow JS-controlled visual state overrides.
@@ -211,6 +211,103 @@
  --interactive-foreground-icon: var(--action-link-03);
 }

+/* ===========================================================================
+   Select-Tinted — like Select-Heavy but with a tinted rest background
+   =========================================================================== */
+
+/* ---------------------------------------------------------------------------
+   Select-Tinted — Empty
+   --------------------------------------------------------------------------- */
+.interactive[data-interactive-variant="select-tinted"][data-interactive-state="empty"] {
+  @apply bg-background-tint-01;
+  --interactive-foreground: var(--text-04);
+  --interactive-foreground-icon: var(--text-03);
+}
+.interactive[data-interactive-variant="select-tinted"][data-interactive-state="empty"]:hover:not(
+    [data-disabled]
+  ),
+.interactive[data-interactive-variant="select-tinted"][data-interactive-state="empty"][data-interaction="hover"]:not(
+    [data-disabled]
+  ) {
+  @apply bg-background-tint-02;
+  --interactive-foreground-icon: var(--text-04);
+}
+.interactive[data-interactive-variant="select-tinted"][data-interactive-state="empty"]:active:not(
+    [data-disabled]
+  ),
+.interactive[data-interactive-variant="select-tinted"][data-interactive-state="empty"][data-interaction="active"]:not(
+    [data-disabled]
+  ) {
+  @apply bg-background-neutral-00;
+  --interactive-foreground: var(--text-05);
+  --interactive-foreground-icon: var(--text-05);
+}
+.interactive[data-interactive-variant="select-tinted"][data-interactive-state="empty"][data-disabled] {
+  @apply bg-transparent;
+  --interactive-foreground: var(--text-01);
+  --interactive-foreground-icon: var(--text-01);
+}
+
+/* ---------------------------------------------------------------------------
+   Select-Tinted — Filled
+   --------------------------------------------------------------------------- */
+.interactive[data-interactive-variant="select-tinted"][data-interactive-state="filled"] {
+  @apply bg-background-tint-01;
+  --interactive-foreground: var(--action-link-05);
+  --interactive-foreground-icon: var(--action-link-05);
+}
+.interactive[data-interactive-variant="select-tinted"][data-interactive-state="filled"]:hover:not(
+    [data-disabled]
+  ),
+.interactive[data-interactive-variant="select-tinted"][data-interactive-state="filled"][data-interaction="hover"]:not(
+    [data-disabled]
+  ) {
+  @apply bg-background-tint-02;
+}
+.interactive[data-interactive-variant="select-tinted"][data-interactive-state="filled"]:active:not(
+    [data-disabled]
+  ),
+.interactive[data-interactive-variant="select-tinted"][data-interactive-state="filled"][data-interaction="active"]:not(
+    [data-disabled]
+  ) {
+  @apply bg-background-tint-00;
+}
+.interactive[data-interactive-variant="select-tinted"][data-interactive-state="filled"][data-disabled] {
+  @apply bg-transparent;
+  --interactive-foreground: var(--text-01);
+  --interactive-foreground-icon: var(--text-01);
+}
+
+/* ---------------------------------------------------------------------------
+   Select-Tinted — Selected
+   --------------------------------------------------------------------------- */
+.interactive[data-interactive-variant="select-tinted"][data-interactive-state="selected"] {
+  @apply bg-[var(--action-link-01)];
+  --interactive-foreground: var(--action-link-05);
+  --interactive-foreground-icon: var(--action-link-05);
+}
+.interactive[data-interactive-variant="select-tinted"][data-interactive-state="selected"]:hover:not(
+    [data-disabled]
+  ),
+.interactive[data-interactive-variant="select-tinted"][data-interactive-state="selected"][data-interaction="hover"]:not(
+    [data-disabled]
+  ) {
+  @apply bg-background-tint-02;
+}
+.interactive[data-interactive-variant="select-tinted"][data-interactive-state="selected"]:active:not(
+    [data-disabled]
+  ),
+.interactive[data-interactive-variant="select-tinted"][data-interactive-state="selected"][data-interaction="active"]:not(
+    [data-disabled]
+  ) {
+  @apply bg-background-tint-00;
+}
+.interactive[data-interactive-variant="select-tinted"][data-interactive-state="selected"][data-disabled] {
+  @apply bg-transparent;
+  --interactive-foreground: var(--action-link-03);
+  --interactive-foreground-icon: var(--action-link-03);
+}
+
 /* ===========================================================================
   Sidebar
   =========================================================================== */
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -59,6 +59,7 @@
        "lowlight": "^3.3.0",
        "lucide-react": "^0.454.0",
        "mdast-util-find-and-replace": "^3.0.1",
+        "mime": "^4.1.0",
        "motion": "^12.29.0",
        "next": "16.1.6",
        "next-themes": "^0.4.4",
@@ -13883,6 +13884,21 @@
        "url": "https://github.com/sponsors/jonschlinkert"
      }
    },
+    "node_modules/mime": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/mime/-/mime-4.1.0.tgz",
+      "integrity": "sha512-X5ju04+cAzsojXKes0B/S4tcYtFAJ6tTMuSPBEn9CPGlrWr8Fiw7qYeLT0XyH80HSoAoqWCaz+MWKh22P7G1cw==",
+      "funding": [
+        "https://github.com/sponsors/broofa"
+      ],
+      "license": "MIT",
+      "bin": {
+        "mime": "bin/cli.js"
+      },
+      "engines": {
+        "node": ">=16"
+      }
+    },
    "node_modules/mime-db": {
      "version": "1.52.0",
      "license": "MIT",
--- a/web/package.json
+++ b/web/package.json
@@ -77,6 +77,7 @@
    "lowlight": "^3.3.0",
    "lucide-react": "^0.454.0",
    "mdast-util-find-and-replace": "^3.0.1",
+    "mime": "^4.1.0",
    "motion": "^12.29.0",
    "next": "16.1.6",
    "next-themes": "^0.4.4",
--- a/web/src/app/layout.tsx
+++ b/web/src/app/layout.tsx
@@ -12,7 +12,7 @@ import {
  MODAL_ROOT_ID,
 } from "@/lib/constants";
 import { Metadata } from "next";
-import { buildClientUrl } from "@/lib/utilsSS";
+
 import { Inter } from "next/font/google";
 import { EnterpriseSettings, ApplicationStatus } from "@/interfaces/settings";
 import AppProvider from "@/providers/AppProvider";
@@ -45,14 +45,14 @@ const hankenGrotesk = Hanken_Grotesk({
 });

 export async function generateMetadata(): Promise<Metadata> {
-  let logoLocation = buildClientUrl("/onyx.ico");
+  let logoLocation = "/onyx.ico";
  let enterpriseSettings: EnterpriseSettings | null = null;
  if (SERVER_SIDE_ONLY__PAID_ENTERPRISE_FEATURES_ENABLED) {
    enterpriseSettings = await (await fetchEnterpriseSettingsSS()).json();
    logoLocation =
      enterpriseSettings && enterpriseSettings.use_custom_logo
        ? "/api/enterprise-settings/logo"
-        : buildClientUrl("/onyx.ico");
+        : "/onyx.ico";
  }

  return {
--- a/web/src/components/chat/MinimalMarkdown.tsx
+++ b/web/src/components/chat/MinimalMarkdown.tsx
@@ -11,14 +11,13 @@ import rehypeHighlight from "rehype-highlight";
 import remarkMath from "remark-math";
 import rehypeKatex from "rehype-katex";
 import "katex/dist/katex.min.css";
-import { transformLinkUri } from "@/lib/utils";
+import { cn, transformLinkUri } from "@/lib/utils";

 type MinimalMarkdownComponentOverrides = Partial<Components>;

 interface MinimalMarkdownProps {
  content: string;
  className?: string;
-  style?: CSSProperties;
  showHeader?: boolean;
  /**
   * Override specific markdown renderers.
@@ -30,7 +29,6 @@ interface MinimalMarkdownProps {
 export default function MinimalMarkdown({
  content,
  className = "",
-  style,
  showHeader = true,
  components,
 }: MinimalMarkdownProps) {
@@ -63,19 +61,17 @@ export default function MinimalMarkdown({
  }, [content, components, showHeader]);

  return (
-    <div style={style || {}} className={`${className}`}>
-      <ReactMarkdown
-        className="prose dark:prose-invert max-w-full text-sm break-words"
-        components={markdownComponents}
-        rehypePlugins={[rehypeHighlight, rehypeKatex]}
-        remarkPlugins={[
-          remarkGfm,
-          [remarkMath, { singleDollarTextMath: false }],
-        ]}
-        urlTransform={transformLinkUri}
-      >
-        {content}
-      </ReactMarkdown>
-    </div>
+    <ReactMarkdown
+      className={cn(
+        "prose dark:prose-invert max-w-full text-sm break-words",
+        className
+      )}
+      components={markdownComponents}
+      rehypePlugins={[rehypeHighlight, rehypeKatex]}
+      remarkPlugins={[remarkGfm, [remarkMath, { singleDollarTextMath: false }]]}
+      urlTransform={transformLinkUri}
+    >
+      {content}
+    </ReactMarkdown>
  );
 }
--- a/web/src/hooks/useAdminUsers.ts
+++ b/web/src/hooks/useAdminUsers.ts
@@ -0,0 +1,123 @@
+"use client";
+
+import { useCallback } from "react";
+import useSWR from "swr";
+import { errorHandlingFetcher } from "@/lib/fetcher";
+import { NEXT_PUBLIC_CLOUD_ENABLED } from "@/lib/constants";
+import { UserStatus } from "@/lib/types";
+import type { UserRole, InvitedUserSnapshot } from "@/lib/types";
+import type {
+  UserRow,
+  UserGroupInfo,
+} from "@/refresh-pages/admin/UsersPage/interfaces";
+
+// ---------------------------------------------------------------------------
+// Backend response shape (GET /manage/users/accepted/all)
+// ---------------------------------------------------------------------------
+
+interface FullUserSnapshot {
+  id: string;
+  email: string;
+  role: UserRole;
+  is_active: boolean;
+  password_configured: boolean;
+  personal_name: string | null;
+  created_at: string;
+  updated_at: string;
+  groups: UserGroupInfo[];
+  is_scim_synced: boolean;
+}
+
+// ---------------------------------------------------------------------------
+// Converters
+// ---------------------------------------------------------------------------
+
+function toUserRow(snapshot: FullUserSnapshot): UserRow {
+  return {
+    id: snapshot.id,
+    email: snapshot.email,
+    role: snapshot.role,
+    status: snapshot.is_active ? UserStatus.ACTIVE : UserStatus.INACTIVE,
+    is_active: snapshot.is_active,
+    is_scim_synced: snapshot.is_scim_synced,
+    personal_name: snapshot.personal_name,
+    created_at: snapshot.created_at,
+    updated_at: snapshot.updated_at,
+    groups: snapshot.groups,
+  };
+}
+
+function emailToUserRow(
+  email: string,
+  status: UserStatus.INVITED | UserStatus.REQUESTED
+): UserRow {
+  return {
+    id: null,
+    email,
+    role: null,
+    status,
+    is_active: false,
+    is_scim_synced: false,
+    personal_name: null,
+    created_at: null,
+    updated_at: null,
+    groups: [],
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Hook
+// ---------------------------------------------------------------------------
+
+export default function useAdminUsers() {
+  const {
+    data: acceptedData,
+    isLoading: acceptedLoading,
+    error: acceptedError,
+    mutate: acceptedMutate,
+  } = useSWR<FullUserSnapshot[]>(
+    "/api/manage/users/accepted/all",
+    errorHandlingFetcher
+  );
+
+  const {
+    data: invitedData,
+    isLoading: invitedLoading,
+    error: invitedError,
+    mutate: invitedMutate,
+  } = useSWR<InvitedUserSnapshot[]>(
+    "/api/manage/users/invited",
+    errorHandlingFetcher
+  );
+
+  const {
+    data: requestedData,
+    isLoading: requestedLoading,
+    error: requestedError,
+    mutate: requestedMutate,
+  } = useSWR<InvitedUserSnapshot[]>(
+    NEXT_PUBLIC_CLOUD_ENABLED ? "/api/tenants/users/pending" : null,
+    errorHandlingFetcher
+  );
+
+  const acceptedRows = (acceptedData ?? []).map(toUserRow);
+  const invitedRows = (invitedData ?? []).map((u) =>
+    emailToUserRow(u.email, UserStatus.INVITED)
+  );
+  const requestedRows = (requestedData ?? []).map((u) =>
+    emailToUserRow(u.email, UserStatus.REQUESTED)
+  );
+
+  const users = [...invitedRows, ...requestedRows, ...acceptedRows];
+
+  const isLoading = acceptedLoading || invitedLoading || requestedLoading;
+  const error = acceptedError ?? invitedError ?? requestedError;
+
+  const refresh = useCallback(() => {
+    acceptedMutate();
+    invitedMutate();
+    requestedMutate();
+  }, [acceptedMutate, invitedMutate, requestedMutate]);
+
+  return { users, isLoading, error, refresh };
+}
--- a/web/src/hooks/useUserCounts.ts
+++ b/web/src/hooks/useUserCounts.ts
@@ -4,23 +4,28 @@ import useSWR from "swr";
 import { errorHandlingFetcher } from "@/lib/fetcher";
 import type { InvitedUserSnapshot } from "@/lib/types";
 import { NEXT_PUBLIC_CLOUD_ENABLED } from "@/lib/constants";
+import type { StatusCountMap } from "@/refresh-pages/admin/UsersPage/interfaces";

-type PaginatedCountResponse = {
-  total_items: number;
+type UserCountsResponse = {
+  role_counts: Record<string, number>;
+  status_counts: Record<string, number>;
 };

 type UserCounts = {
  activeCount: number | null;
  invitedCount: number | null;
  pendingCount: number | null;
+  roleCounts: Record<string, number>;
+  statusCounts: StatusCountMap;
+  refreshCounts: () => void;
 };

 export default function useUserCounts(): UserCounts {
-  // Active user count — lightweight fetch (page_size=1 to minimize payload)
-  const { data: activeData } = useSWR<PaginatedCountResponse>(
-    "/api/manage/users/accepted?page_num=0&page_size=1",
-    errorHandlingFetcher
-  );
+  const { data: countsData, mutate: refreshCounts } =
+    useSWR<UserCountsResponse>(
+      "/api/manage/users/counts",
+      errorHandlingFetcher
+    );

  const { data: invitedUsers } = useSWR<InvitedUserSnapshot[]>(
    "/api/manage/users/invited",
@@ -32,9 +37,20 @@ export default function useUserCounts(): UserCounts {
    errorHandlingFetcher
  );

+  const activeCount = countsData?.status_counts?.active ?? null;
+  const inactiveCount = countsData?.status_counts?.inactive ?? null;
+
  return {
-    activeCount: activeData?.total_items ?? null,
+    activeCount,
    invitedCount: invitedUsers?.length ?? null,
    pendingCount: pendingUsers?.length ?? null,
+    roleCounts: countsData?.role_counts ?? {},
+    statusCounts: {
+      ...(activeCount !== null ? { active: activeCount } : {}),
+      ...(inactiveCount !== null ? { inactive: inactiveCount } : {}),
+      ...(invitedUsers ? { invited: invitedUsers.length } : {}),
+      ...(pendingUsers ? { requested: pendingUsers.length } : {}),
+    } satisfies StatusCountMap,
+    refreshCounts,
  };
 }
--- a/web/src/lib/languages.test.ts
+++ b/web/src/lib/languages.test.ts
@@ -0,0 +1,102 @@
+import {
+  getCodeLanguage,
+  getDataLanguage,
+  getLanguageByMime,
+  isMarkdownFile,
+} from "./languages";
+
+describe("getCodeLanguage", () => {
+  it.each([
+    ["app.py", "python"],
+    ["index.ts", "typescript"],
+    ["main.go", "go"],
+    ["style.css", "css"],
+    ["page.html", "html"],
+    ["App.vue", "vue"],
+    ["lib.rs", "rust"],
+    ["main.cpp", "c++"],
+    ["util.c", "c"],
+    ["script.js", "javascript"],
+  ])("%s → %s", (filename, expected) => {
+    expect(getCodeLanguage(filename)).toBe(expected);
+  });
+
+  it.each([
+    [".h", "c"],
+    [".inc", "php"],
+    [".m", "objective-c"],
+    [".re", "reason"],
+  ])("override: %s → %s", (ext, expected) => {
+    expect(getCodeLanguage(`file${ext}`)).toBe(expected);
+  });
+
+  it("resolves by exact filename when there is no extension", () => {
+    expect(getCodeLanguage("Dockerfile")).toBe("dockerfile");
+    expect(getCodeLanguage("Makefile")).toBe("makefile");
+  });
+
+  it("is case-insensitive for filenames", () => {
+    expect(getCodeLanguage("INDEX.JS")).toBe("javascript");
+    expect(getCodeLanguage("dockerfile")).toBe("dockerfile");
+  });
+
+  it("returns null for unknown extensions", () => {
+    expect(getCodeLanguage("file.xyz123")).toBeNull();
+  });
+
+  it("excludes markdown extensions", () => {
+    expect(getCodeLanguage("README.md")).toBeNull();
+    expect(getCodeLanguage("notes.markdown")).toBeNull();
+  });
+});
+
+describe("getDataLanguage", () => {
+  it.each([
+    ["config.json", "json"],
+    ["config.yaml", "yaml"],
+    ["config.yml", "yaml"],
+    ["config.toml", "toml"],
+    ["data.xml", "xml"],
+    ["data.csv", "csv"],
+  ])("%s → %s", (filename, expected) => {
+    expect(getDataLanguage(filename)).toBe(expected);
+  });
+
+  it("returns null for code files", () => {
+    expect(getDataLanguage("app.py")).toBeNull();
+    expect(getDataLanguage("header.h")).toBeNull();
+    expect(getDataLanguage("view.m")).toBeNull();
+    expect(getDataLanguage("component.re")).toBeNull();
+  });
+});
+
+describe("isMarkdownFile", () => {
+  it("recognises markdown extensions", () => {
+    expect(isMarkdownFile("README.md")).toBe(true);
+    expect(isMarkdownFile("doc.markdown")).toBe(true);
+  });
+
+  it("is case-insensitive", () => {
+    expect(isMarkdownFile("NOTES.MD")).toBe(true);
+  });
+
+  it("rejects non-markdown files", () => {
+    expect(isMarkdownFile("app.py")).toBe(false);
+    expect(isMarkdownFile("data.json")).toBe(false);
+  });
+});
+
+describe("getLanguageByMime", () => {
+  it("resolves known MIME types", () => {
+    expect(getLanguageByMime("text/x-python")).toBe("python");
+    expect(getLanguageByMime("text/javascript")).toBe("javascript");
+  });
+
+  it("strips parameters before matching", () => {
+    expect(getLanguageByMime("text/x-python; charset=utf-8")).toBe("python");
+  });
+
+  it("returns null for unknown MIME types", () => {
+    expect(getLanguageByMime("application/x-unknown-thing")).toBeNull();
+  });
+});
--- a/web/src/lib/languages.ts
+++ b/web/src/lib/languages.ts
@@ -7,6 +7,7 @@ interface LinguistLanguage {
  type: string;
  extensions?: string[];
  filenames?: string[];
+  codemirrorMimeType?: string;
 }

 interface LanguageMaps {
@@ -14,7 +15,23 @@ interface LanguageMaps {
  filenames: Map<string, string>;
 }

-const allLanguages = Object.values(languages) as LinguistLanguage[];
+// Explicit winners for extensions claimed by multiple linguist-languages entries
+// where the "most extensions" heuristic below picks the wrong language.
+const EXTENSION_OVERRIDES: Record<string, string> = {
+  ".h": "c",
+  ".inc": "php",
+  ".m": "objective-c",
+  ".re": "reason",
+  ".rs": "rust",
+};
+
+// Sort so that languages with more extensions (i.e. more general-purpose) win
+// when multiple languages claim the same extension (e.g. Ecmarkup vs HTML both
+// claim .html — HTML should win because it's the canonical language for that
+// extension). Known mis-rankings are patched by EXTENSION_OVERRIDES above.
+const allLanguages = (Object.values(languages) as LinguistLanguage[]).sort(
+  (a, b) => (b.extensions?.length ?? 0) - (a.extensions?.length ?? 0)
+);

 // Collect extensions that linguist-languages assigns to "Markdown" so we can
 // exclude them from the code-language map
@@ -25,14 +42,22 @@ const markdownExtensions = new Set(
 );

 function buildLanguageMaps(
-  type: string,
+  types: string[],
  excludedExtensions?: Set<string>
 ): LanguageMaps {
+  const typeSet = new Set(types);
  const extensions = new Map<string, string>();
  const filenames = new Map<string, string>();

+  if (typeSet.has("programming") || typeSet.has("markup")) {
+    for (const [ext, lang] of Object.entries(EXTENSION_OVERRIDES)) {
+      if (excludedExtensions?.has(ext.toLowerCase())) continue;
+      extensions.set(ext, lang);
+    }
+  }
+
  for (const lang of allLanguages) {
-    if (lang.type !== type) continue;
+    if (!typeSet.has(lang.type)) continue;

    const name = lang.name.toLowerCase();
    for (const ext of lang.extensions ?? []) {
@@ -57,13 +82,17 @@ function lookupLanguage(name: string, maps: LanguageMaps): string | null {
  return (ext && maps.extensions.get(ext)) ?? maps.filenames.get(lower) ?? null;
 }

-const codeMaps = buildLanguageMaps("programming", markdownExtensions);
-const dataMaps = buildLanguageMaps("data");
+const codeMaps = buildLanguageMaps(
+  ["programming", "markup"],
+  markdownExtensions
+);
+const dataMaps = buildLanguageMaps(["data"]);

 /**
 * Returns the language name for a given file name, or null if it's not a
- * recognised code file. Looks up by extension first, then by exact filename
- * (e.g. "Dockerfile", "Makefile"). Runs in O(1).
+ * recognised code or markup file (programming + markup types from
+ * linguist-languages, e.g. Python, HTML, CSS, Vue). Looks up by extension
+ * first, then by exact filename (e.g. "Dockerfile", "Makefile"). Runs in O(1).
 */
 export function getCodeLanguage(name: string): string | null {
  return lookupLanguage(name, codeMaps);
@@ -86,3 +115,20 @@ export function isMarkdownFile(name: string): boolean {
  const ext = name.toLowerCase().match(LANGUAGE_EXT_PATTERN)?.[0];
  return !!ext && markdownExtensions.has(ext);
 }
+
+const mimeToLanguage = new Map<string, string>();
+for (const lang of allLanguages) {
+  if (lang.codemirrorMimeType && !mimeToLanguage.has(lang.codemirrorMimeType)) {
+    mimeToLanguage.set(lang.codemirrorMimeType, lang.name.toLowerCase());
+  }
+}
+
+/**
+ * Returns the language name for a given MIME type using the codemirrorMimeType
+ * field from linguist-languages (~297 entries). Returns null if unrecognised.
+ */
+export function getLanguageByMime(mime: string): string | null {
+  const base = mime.split(";")[0];
+  if (!base) return null;
+  return mimeToLanguage.get(base.trim().toLowerCase()) ?? null;
+}
--- a/web/src/lib/types.ts
+++ b/web/src/lib/types.ts
@@ -68,6 +68,20 @@ export const USER_ROLE_LABELS: Record<UserRole, string> = {
  [UserRole.SLACK_USER]: "Slack User",
 };

+export enum UserStatus {
+  ACTIVE = "active",
+  INACTIVE = "inactive",
+  INVITED = "invited",
+  REQUESTED = "requested",
+}
+
+export const USER_STATUS_LABELS: Record<UserStatus, string> = {
+  [UserStatus.ACTIVE]: "Active",
+  [UserStatus.INACTIVE]: "Inactive",
+  [UserStatus.INVITED]: "Invite Pending",
+  [UserStatus.REQUESTED]: "Requested",
+};
+
 export const INVALID_ROLE_HOVER_TEXT: Partial<Record<UserRole, string>> = {
  [UserRole.BASIC]: "Basic users can't perform any admin actions",
  [UserRole.ADMIN]: "Admin users can perform all admin actions",
--- a/web/src/refresh-components/Chip.tsx
+++ b/web/src/refresh-components/Chip.tsx
@@ -6,6 +6,8 @@ import type { IconProps } from "@opal/types";
 export interface ChipProps {
  children?: string;
  icon?: React.FunctionComponent<IconProps>;
+  /** Icon rendered after the label (e.g. a warning indicator) */
+  rightIcon?: React.FunctionComponent<IconProps>;
  onRemove?: () => void;
  smallLabel?: boolean;
 }
@@ -24,6 +26,7 @@ export interface ChipProps {
 export default function Chip({
  children,
  icon: Icon,
+  rightIcon: RightIcon,
  onRemove,
  smallLabel = true,
 }: ChipProps) {
@@ -35,6 +38,7 @@ export default function Chip({
          {children}
        </Text>
      )}
+      {RightIcon && <RightIcon size={14} className="text-text-03" />}
      {onRemove && (
        <Button
          onClick={(e) => {
--- a/web/src/refresh-components/ScrollIndicatorDiv.tsx
+++ b/web/src/refresh-components/ScrollIndicatorDiv.tsx
@@ -6,10 +6,42 @@ import { cn } from "@/lib/utils";
 // Throttle interval for scroll events (~60fps)
 const SCROLL_THROTTLE_MS = 16;

+/**
+ * A scrollable container that shows gradient or shadow indicators when
+ * content overflows above or below the visible area.
+ *
+ * HEIGHT CONSTRAINT REQUIREMENT
+ *
+ * This component relies on its inner scroll container having a smaller
+ * clientHeight than its scrollHeight. For that to happen, the entire
+ * ancestor chain must constrain height via flex sizing (flex-1 min-h-0),
+ * NOT via percentage heights (h-full).
+ *
+ * height: 100% resolves to "auto" when the containing block's height is
+ * determined by flex layout (flex-auto, flex-1) rather than an explicit
+ * height property — this is per the CSS spec. When that happens, the
+ * container grows to fit its content and scrollHeight === clientHeight,
+ * making scroll indicators invisible.
+ *
+ * Correct pattern: every ancestor up to the nearest fixed-height boundary
+ * must form an unbroken flex column chain using "flex-1 min-h-0":
+ *
+ *   fixed-height-ancestor  (e.g. h-[500px])
+ *     flex flex-col flex-1 min-h-0   <-- use flex-1, NOT h-full
+ *       ScrollIndicatorDiv
+ *         ...tall content...
+ *
+ * Common mistakes:
+ *  - Using h-full instead of flex-1 min-h-0 anywhere in the chain.
+ *  - Placing this inside a parent with overflow-y: auto (e.g. Modal.Body),
+ *    which becomes the scroll container instead of this component's inner div.
+ */
 export interface ScrollIndicatorDivProps
  extends React.HTMLAttributes<HTMLDivElement> {
  // Mask/Shadow options
  disableIndicators?: boolean;
+  disableTopIndicator?: boolean;
+  disableBottomIndicator?: boolean;
  backgroundColor?: string;
  indicatorHeight?: string;

@@ -22,6 +54,8 @@ export interface ScrollIndicatorDivProps

 export default function ScrollIndicatorDiv({
  disableIndicators = false,
+  disableTopIndicator = false,
+  disableBottomIndicator = false,
  backgroundColor = "var(--background-tint-02)",
  indicatorHeight = "3rem",
  variant = "gradient",
@@ -77,13 +111,19 @@ export default function ScrollIndicatorDiv({
    // Update on scroll (throttled)
    container.addEventListener("scroll", handleScroll, { passive: true });

-    // Update on resize (in case content changes)
+    // Update when the container itself resizes
    const resizeObserver = new ResizeObserver(updateScrollIndicators);
    resizeObserver.observe(container);

+    // Update when descendants change (e.g. syntax highlighting mutates the
+    // DOM after initial render, which changes scrollHeight without firing
+    // resize or scroll events on the container).
+    const mutationObserver = new MutationObserver(handleScroll);
+
    return () => {
      container.removeEventListener("scroll", handleScroll);
      resizeObserver.disconnect();
+      mutationObserver.disconnect();
      if (throttleTimeoutRef.current) {
        clearTimeout(throttleTimeoutRef.current);
      }
@@ -120,7 +160,7 @@ export default function ScrollIndicatorDiv({
  return (
    <div className="relative flex-1 min-h-0 overflow-y-hidden flex flex-col w-full">
      {/* Top indicator */}
-      {!disableIndicators && showTopIndicator && (
+      {!disableIndicators && !disableTopIndicator && showTopIndicator && (
        <div
          className="absolute top-0 left-0 right-0 z-[20] pointer-events-none transition-opacity duration-200"
          style={getIndicatorStyle("top")}
@@ -141,7 +181,7 @@ export default function ScrollIndicatorDiv({
      </div>

      {/* Bottom indicator */}
-      {!disableIndicators && showBottomIndicator && (
+      {!disableIndicators && !disableBottomIndicator && showBottomIndicator && (
        <div
          className="absolute bottom-0 left-0 right-0 z-[20] pointer-events-none transition-opacity duration-200"
          style={getIndicatorStyle("bottom")}
--- a/web/src/refresh-components/inputs/InputChipField.tsx
+++ b/web/src/refresh-components/inputs/InputChipField.tsx
@@ -9,11 +9,14 @@ import {
  Variants,
  wrapperClasses,
 } from "@/refresh-components/inputs/styles";
+import { SvgAlertTriangle } from "@opal/icons";
 import type { IconProps } from "@opal/types";

 export interface ChipItem {
  id: string;
  label: string;
+  /** When true the chip shows a warning icon */
+  error?: boolean;
 }

 export interface InputChipFieldProps {
@@ -29,6 +32,8 @@ export interface InputChipFieldProps {
  variant?: Variants;
  icon?: React.FunctionComponent<IconProps>;
  className?: string;
+  /** "inline" renders chips and input in one row; "stacked" puts chips above the input */
+  layout?: "inline" | "stacked";
 }

 /**
@@ -61,6 +66,7 @@ function InputChipField({
  variant = "primary",
  icon: Icon,
  className,
+  layout = "inline",
 }: InputChipFieldProps) {
  const inputRef = React.useRef<HTMLInputElement>(null);

@@ -85,25 +91,32 @@ function InputChipField({
    }
  }

-  return (
-    <div
-      className={cn(
-        "flex flex-row items-center flex-wrap gap-1 p-1.5 rounded-08 cursor-text w-full",
-        wrapperClasses[variant],
-        className
-      )}
-      onClick={() => inputRef.current?.focus()}
-    >
+  const chipElements =
+    chips.length > 0
+      ? chips.map((chip) => (
+          <Chip
+            key={chip.id}
+            onRemove={disabled ? undefined : () => onRemoveChip(chip.id)}
+            rightIcon={
+              chip.error
+                ? (props) => (
+                    <SvgAlertTriangle
+                      {...props}
+                      className="text-status-warning-text"
+                    />
+                  )
+                : undefined
+            }
+            smallLabel={layout === "stacked"}
+          >
+            {chip.label}
+          </Chip>
+        ))
+      : null;
+
+  const inputElement = (
+    <>
      {Icon && <Icon size={16} className="text-text-04 shrink-0" />}
-      {chips.map((chip) => (
-        <Chip
-          key={chip.id}
-          onRemove={disabled ? undefined : () => onRemoveChip(chip.id)}
-          smallLabel={false}
-        >
-          {chip.label}
-        </Chip>
-      ))}
      <input
        ref={inputRef}
        type="text"
@@ -118,6 +131,36 @@ function InputChipField({
          textClasses[variant]
        )}
      />
+    </>
+  );
+
+  return (
+    <div
+      className={cn(
+        "flex p-1.5 rounded-08 cursor-text w-full",
+        layout === "stacked"
+          ? "flex-col gap-1"
+          : "flex-row flex-wrap items-center gap-1",
+        wrapperClasses[variant],
+        className
+      )}
+      onClick={() => inputRef.current?.focus()}
+    >
+      {layout === "stacked" ? (
+        <>
+          {chipElements && (
+            <div className="flex flex-row items-center flex-wrap gap-1">
+              {chipElements}
+            </div>
+          )}
+          <div className="flex flex-row items-center gap-1">{inputElement}</div>
+        </>
+      ) : (
+        <>
+          {chipElements}
+          {inputElement}
+        </>
+      )}
    </div>
  );
 }
--- a/web/src/refresh-components/inputs/InputComboBox/InputComboBox.test.tsx
+++ b/web/src/refresh-components/inputs/InputComboBox/InputComboBox.test.tsx
@@ -118,6 +118,21 @@ describe("InputComboBox", () => {
      expect(screen.queryByRole("listbox")).not.toBeInTheDocument();
    });

+    test("shows all options on focus when a value is already selected", () => {
+      render(
+        <InputComboBox
+          placeholder="Select"
+          value="apple"
+          options={mockOptions}
+        />
+      );
+      const input = screen.getByDisplayValue("Apple");
+      fireEvent.focus(input);
+
+      const options = screen.getAllByRole("option");
+      expect(options.length).toBe(3);
+    });
+
    test("closes dropdown on tab", async () => {
      const user = setupUser();
      render(
--- a/web/src/refresh-components/inputs/InputComboBox/InputComboBox.tsx
+++ b/web/src/refresh-components/inputs/InputComboBox/InputComboBox.tsx
@@ -322,24 +322,32 @@ const InputComboBox = ({

  const handleFocus = useCallback(() => {
    if (hasOptions) {
+      setInputValue("");
      setIsOpen(true);
-      setHighlightedIndex(-1); // Start with no highlight on focus
-      setIsKeyboardNav(false); // Start with mouse mode
+      setHighlightedIndex(-1);
+      setIsKeyboardNav(false);
    }
-  }, [hasOptions, setIsOpen, setHighlightedIndex, setIsKeyboardNav]);
+  }, [
+    hasOptions,
+    setInputValue,
+    setIsOpen,
+    setHighlightedIndex,
+    setIsKeyboardNav,
+  ]);

  const toggleDropdown = useCallback(() => {
    if (!disabled && hasOptions) {
      setIsOpen((prev) => {
        const newOpen = !prev;
        if (newOpen) {
-          setHighlightedIndex(-1); // Reset highlight when opening
+          setInputValue("");
+          setHighlightedIndex(-1);
        }
        return newOpen;
      });
      inputRef.current?.focus();
    }
-  }, [disabled, hasOptions, setIsOpen, setHighlightedIndex]);
+  }, [disabled, hasOptions, setIsOpen, setInputValue, setHighlightedIndex]);

  const autoId = useId();
  const fieldId = fieldContext?.baseId || name || `combo-box-${autoId}`;
--- a/web/src/refresh-components/inputs/InputComboBox/hooks.ts
+++ b/web/src/refresh-components/inputs/InputComboBox/hooks.ts
@@ -20,21 +20,26 @@ export function useComboBoxState({ value, options }: UseComboBoxStateProps) {
  const [highlightedIndex, setHighlightedIndex] = useState(-1);
  const [isKeyboardNav, setIsKeyboardNav] = useState(false);

-  // State synchronization logic
-  // Only sync when the dropdown is closed or when value changes significantly
+  // Sync inputValue with the external value prop.
+  // When the dropdown is closed, always reflect the controlled value.
+  // When the dropdown is open, only sync if the *value prop itself* changes
+  // (e.g. parent programmatically updates it), not when inputValue changes
+  // (e.g. user clears the field on focus to browse all options).
  useEffect(() => {
-    // If dropdown is closed, always sync with prop value
    if (!isOpen) {
      setInputValue(value);
-    } else {
-      // If dropdown is open, only sync if the new value is an exact match with an option
-      // This prevents interference when user is typing
+    }
+  }, [value, isOpen]);
+
+  useEffect(() => {
+    if (isOpen) {
      const isExactOptionMatch = options.some((opt) => opt.value === value);
-      if (isExactOptionMatch && inputValue !== value) {
+      if (isExactOptionMatch) {
        setInputValue(value);
      }
    }
-  }, [value, isOpen, options, inputValue]);
+    // Only react to value prop changes while open, not inputValue changes
+  }, [value]);

  // Reset highlight and keyboard nav when closing dropdown
  useEffect(() => {
--- a/web/src/refresh-components/inputs/InputSelect.tsx
+++ b/web/src/refresh-components/inputs/InputSelect.tsx
@@ -2,7 +2,7 @@

 import * as React from "react";
 import * as SelectPrimitive from "@radix-ui/react-select";
-import { cn, noProp } from "@/lib/utils";
+import { cn } from "@/lib/utils";
 import LineItem, { LineItemProps } from "@/refresh-components/buttons/LineItem";
 import Text from "@/refresh-components/texts/Text";
 import type { IconProps } from "@opal/types";
@@ -298,7 +298,10 @@ function InputSelectContent({
        )}
        sideOffset={4}
        position="popper"
-        onMouseDown={noProp()}
+        onMouseDown={(e) => {
+          e.stopPropagation();
+          e.preventDefault();
+        }}
        {...props}
      >
        <SelectPrimitive.Viewport className="flex flex-col gap-1">
--- a/web/src/refresh-components/table/TableQualifier.tsx
+++ b/web/src/refresh-components/table/TableQualifier.tsx
@@ -114,11 +114,16 @@ function TableQualifier({
        return (
          <div
            className={cn(
-              "flex items-center justify-center rounded-full bg-text-05",
+              "flex items-center justify-center rounded-full bg-background-neutral-inverted-00",
              resolvedSize === "regular" ? "h-7 w-7" : "h-6 w-6"
            )}
          >
-            <Text secondaryAction textLight05 className="select-none uppercase">
+            <Text
+              inverted
+              secondaryAction
+              text05
+              className="select-none uppercase"
+            >
              {initials}
            </Text>
          </div>
--- a/web/src/refresh-pages/admin/UsersPage.tsx
+++ b/web/src/refresh-pages/admin/UsersPage.tsx
@@ -1,13 +1,18 @@
 "use client";

+import { useState } from "react";
 import { SvgUser, SvgUserPlus } from "@opal/icons";
 import { Button } from "@opal/components";
 import * as SettingsLayouts from "@/layouts/settings-layouts";
 import { useScimToken } from "@/hooks/useScimToken";
 import { usePaidEnterpriseFeaturesEnabled } from "@/components/settings/usePaidEnterpriseFeaturesEnabled";
 import useUserCounts from "@/hooks/useUserCounts";
+import { UserStatus } from "@/lib/types";
+import type { StatusFilter } from "./UsersPage/interfaces";

 import UsersSummary from "./UsersPage/UsersSummary";
+import UsersTable from "./UsersPage/UsersTable";
+import InviteUsersModal from "./UsersPage/InviteUsersModal";

 // ---------------------------------------------------------------------------
 // Users page content
@@ -19,7 +24,18 @@ function UsersContent() {
  const { data: scimToken } = useScimToken();
  const showScim = isEe && !!scimToken;

-  const { activeCount, invitedCount, pendingCount } = useUserCounts();
+  const { activeCount, invitedCount, pendingCount, roleCounts, statusCounts } =
+    useUserCounts();
+
+  const [selectedStatuses, setSelectedStatuses] = useState<StatusFilter>([]);
+
+  const toggleStatus = (target: UserStatus) => {
+    setSelectedStatuses((prev) =>
+      prev.includes(target)
+        ? prev.filter((s) => s !== target)
+        : [...prev, target]
+    );
+  };

  return (
    <>
@@ -28,9 +44,17 @@ function UsersContent() {
        pendingInvites={invitedCount}
        requests={pendingCount}
        showScim={showScim}
+        onFilterActive={() => toggleStatus(UserStatus.ACTIVE)}
+        onFilterInvites={() => toggleStatus(UserStatus.INVITED)}
+        onFilterRequests={() => toggleStatus(UserStatus.REQUESTED)}
      />

-      {/* Table and filters will be added in subsequent PRs */}
+      <UsersTable
+        selectedStatuses={selectedStatuses}
+        onStatusesChange={setSelectedStatuses}
+        roleCounts={roleCounts}
+        statusCounts={statusCounts}
+      />
    </>
  );
 }
@@ -40,19 +64,24 @@ function UsersContent() {
 // ---------------------------------------------------------------------------

 export default function UsersPage() {
+  const [inviteOpen, setInviteOpen] = useState(false);
+
  return (
    <SettingsLayouts.Root width="lg">
      <SettingsLayouts.Header
        title="Users & Requests"
        icon={SvgUser}
        rightChildren={
-          // TODO (ENG-3806): Wire up invite modal
-          <Button icon={SvgUserPlus}>Invite Users</Button>
+          <Button icon={SvgUserPlus} onClick={() => setInviteOpen(true)}>
+            Invite Users
+          </Button>
        }
      />
      <SettingsLayouts.Body>
        <UsersContent />
      </SettingsLayouts.Body>
+
+      <InviteUsersModal open={inviteOpen} onOpenChange={setInviteOpen} />
    </SettingsLayouts.Root>
  );
 }
--- a/web/src/refresh-pages/admin/UsersPage/InviteUsersModal.tsx
+++ b/web/src/refresh-pages/admin/UsersPage/InviteUsersModal.tsx
@@ -0,0 +1,178 @@
+"use client";
+
+import { useState, useCallback } from "react";
+import { Button } from "@opal/components";
+import { SvgUsers } from "@opal/icons";
+import { Disabled } from "@opal/core";
+import Modal, { BasicModalFooter } from "@/refresh-components/Modal";
+import InputChipField from "@/refresh-components/inputs/InputChipField";
+import type { ChipItem } from "@/refresh-components/inputs/InputChipField";
+import { toast } from "@/hooks/useToast";
+import { inviteUsers } from "./svc";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+
+interface InviteUsersModalProps {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+}
+
+// ---------------------------------------------------------------------------
+// Component
+// ---------------------------------------------------------------------------
+
+export default function InviteUsersModal({
+  open,
+  onOpenChange,
+}: InviteUsersModalProps) {
+  const [chips, setChips] = useState<ChipItem[]>([]);
+  const [inputValue, setInputValue] = useState("");
+  const [isSubmitting, setIsSubmitting] = useState(false);
+
+  /** Parse a comma-separated string into de-duped ChipItems */
+  function parseEmails(value: string, existing: ChipItem[]): ChipItem[] {
+    const entries = value
+      .split(",")
+      .map((e) => e.trim().toLowerCase())
+      .filter(Boolean);
+
+    const newChips: ChipItem[] = [];
+    for (const email of entries) {
+      const alreadyAdded =
+        existing.some((c) => c.label === email) ||
+        newChips.some((c) => c.label === email);
+      if (!alreadyAdded) {
+        newChips.push({
+          id: email,
+          label: email,
+          error: !EMAIL_REGEX.test(email),
+        });
+      }
+    }
+    return newChips;
+  }
+
+  function addEmail(value: string) {
+    const newChips = parseEmails(value, chips);
+    if (newChips.length > 0) {
+      setChips((prev) => [...prev, ...newChips]);
+    }
+    setInputValue("");
+  }
+
+  function removeChip(id: string) {
+    setChips((prev) => prev.filter((c) => c.id !== id));
+  }
+
+  const handleClose = useCallback(() => {
+    onOpenChange(false);
+    // Reset state after close animation
+    setTimeout(() => {
+      setChips([]);
+      setInputValue("");
+      setIsSubmitting(false);
+    }, 200);
+  }, [onOpenChange]);
+
+  /** Intercept backdrop/ESC closes so state is always reset */
+  const handleOpenChange = useCallback(
+    (next: boolean) => {
+      if (!next) {
+        if (!isSubmitting) handleClose();
+      } else {
+        onOpenChange(next);
+      }
+    },
+    [handleClose, isSubmitting, onOpenChange]
+  );
+
+  async function handleInvite() {
+    // Flush any pending text in the input into chips synchronously
+    const pending = inputValue.trim();
+    const allChips = pending
+      ? [...chips, ...parseEmails(pending, chips)]
+      : chips;
+
+    if (pending) {
+      setChips(allChips);
+      setInputValue("");
+    }
+
+    const validEmails = allChips.filter((c) => !c.error).map((c) => c.label);
+
+    if (validEmails.length === 0) {
+      toast.error("Please add at least one valid email address");
+      return;
+    }
+
+    setIsSubmitting(true);
+    try {
+      await inviteUsers(validEmails);
+      toast.success(
+        `Invited ${validEmails.length} user${validEmails.length > 1 ? "s" : ""}`
+      );
+      handleClose();
+    } catch (err) {
+      toast.error(
+        err instanceof Error ? err.message : "Failed to invite users"
+      );
+    } finally {
+      setIsSubmitting(false);
+    }
+  }
+
+  return (
+    <Modal open={open} onOpenChange={handleOpenChange}>
+      <Modal.Content width="sm" height="fit">
+        <Modal.Header
+          icon={SvgUsers}
+          title="Invite Users"
+          onClose={isSubmitting ? undefined : handleClose}
+        />
+
+        <Modal.Body>
+          <InputChipField
+            chips={chips}
+            onRemoveChip={removeChip}
+            onAdd={addEmail}
+            value={inputValue}
+            onChange={setInputValue}
+            placeholder="Add emails to invite, comma separated"
+            layout="stacked"
+          />
+        </Modal.Body>
+
+        <Modal.Footer>
+          <BasicModalFooter
+            cancel={
+              <Disabled disabled={isSubmitting}>
+                <Button prominence="tertiary" onClick={handleClose}>
+                  Cancel
+                </Button>
+              </Disabled>
+            }
+            submit={
+              <Disabled
+                disabled={
+                  isSubmitting ||
+                  chips.length === 0 ||
+                  chips.every((c) => c.error)
+                }
+              >
+                <Button onClick={handleInvite}>Invite</Button>
+              </Disabled>
+            }
+          />
+        </Modal.Footer>
+      </Modal.Content>
+    </Modal>
+  );
+}
--- a/web/src/refresh-pages/admin/UsersPage/UserFilters.tsx
+++ b/web/src/refresh-pages/admin/UsersPage/UserFilters.tsx
@@ -0,0 +1,296 @@
+"use client";
+
+import { useState } from "react";
+import { SvgCheck, SvgSlack, SvgUser, SvgUsers } from "@opal/icons";
+import type { IconFunctionComponent } from "@opal/types";
+import FilterButton from "@/refresh-components/buttons/FilterButton";
+import Popover from "@/refresh-components/Popover";
+import InputTypeIn from "@/refresh-components/inputs/InputTypeIn";
+import LineItem from "@/refresh-components/buttons/LineItem";
+import Text from "@/refresh-components/texts/Text";
+import Separator from "@/refresh-components/Separator";
+import {
+  UserRole,
+  UserStatus,
+  USER_ROLE_LABELS,
+  USER_STATUS_LABELS,
+} from "@/lib/types";
+import { NEXT_PUBLIC_CLOUD_ENABLED } from "@/lib/constants";
+import type { GroupOption, StatusFilter, StatusCountMap } from "./interfaces";
+
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+
+interface UserFiltersProps {
+  selectedRoles: UserRole[];
+  onRolesChange: (roles: UserRole[]) => void;
+  selectedGroups: number[];
+  onGroupsChange: (groupIds: number[]) => void;
+  groups: GroupOption[];
+  selectedStatuses: StatusFilter;
+  onStatusesChange: (statuses: StatusFilter) => void;
+  roleCounts: Record<string, number>;
+  statusCounts: StatusCountMap;
+}
+
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+
+const FILTERABLE_ROLES = Object.entries(USER_ROLE_LABELS).filter(
+  ([role]) => role !== UserRole.EXT_PERM_USER
+) as [UserRole, string][];
+
+const FILTERABLE_STATUSES = (
+  Object.entries(USER_STATUS_LABELS) as [UserStatus, string][]
+).filter(
+  ([value]) => value !== UserStatus.REQUESTED || NEXT_PUBLIC_CLOUD_ENABLED
+);
+
+const ROLE_ICONS: Partial<Record<UserRole, IconFunctionComponent>> = {
+  [UserRole.SLACK_USER]: SvgSlack,
+};
+
+/** Map UserStatus enum values to the keys returned by the counts endpoint. */
+const STATUS_COUNT_KEY: Record<UserStatus, keyof StatusCountMap> = {
+  [UserStatus.ACTIVE]: "active",
+  [UserStatus.INACTIVE]: "inactive",
+  [UserStatus.INVITED]: "invited",
+  [UserStatus.REQUESTED]: "requested",
+};
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function CountBadge({ count }: { count: number | undefined }) {
+  return (
+    <Text as="span" secondaryBody text03>
+      {count ?? 0}
+    </Text>
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Component
+// ---------------------------------------------------------------------------
+
+export default function UserFilters({
+  selectedRoles,
+  onRolesChange,
+  selectedGroups,
+  onGroupsChange,
+  groups,
+  selectedStatuses,
+  onStatusesChange,
+  roleCounts,
+  statusCounts,
+}: UserFiltersProps) {
+  const hasRoleFilter = selectedRoles.length > 0;
+  const hasGroupFilter = selectedGroups.length > 0;
+  const hasStatusFilter = selectedStatuses.length > 0;
+  const [groupSearch, setGroupSearch] = useState("");
+  const [groupPopoverOpen, setGroupPopoverOpen] = useState(false);
+
+  const toggleRole = (role: UserRole) => {
+    if (selectedRoles.includes(role)) {
+      onRolesChange(selectedRoles.filter((r) => r !== role));
+    } else {
+      onRolesChange([...selectedRoles, role]);
+    }
+  };
+
+  const roleLabel = hasRoleFilter
+    ? FILTERABLE_ROLES.filter(([role]) => selectedRoles.includes(role))
+        .map(([, label]) => label)
+        .slice(0, 2)
+        .join(", ") +
+      (selectedRoles.length > 2 ? `, +${selectedRoles.length - 2}` : "")
+    : "All Account Types";
+
+  const toggleGroup = (groupId: number) => {
+    if (selectedGroups.includes(groupId)) {
+      onGroupsChange(selectedGroups.filter((id) => id !== groupId));
+    } else {
+      onGroupsChange([...selectedGroups, groupId]);
+    }
+  };
+
+  const groupLabel = hasGroupFilter
+    ? groups
+        .filter((g) => selectedGroups.includes(g.id))
+        .map((g) => g.name)
+        .slice(0, 2)
+        .join(", ") +
+      (selectedGroups.length > 2 ? `, +${selectedGroups.length - 2}` : "")
+    : "All Groups";
+
+  const toggleStatus = (status: UserStatus) => {
+    if (selectedStatuses.includes(status)) {
+      onStatusesChange(selectedStatuses.filter((s) => s !== status));
+    } else {
+      onStatusesChange([...selectedStatuses, status]);
+    }
+  };
+
+  const statusLabel = hasStatusFilter
+    ? FILTERABLE_STATUSES.filter(([status]) =>
+        selectedStatuses.includes(status)
+      )
+        .map(([, label]) => label)
+        .slice(0, 2)
+        .join(", ") +
+      (selectedStatuses.length > 2 ? `, +${selectedStatuses.length - 2}` : "")
+    : "All Status";
+
+  const filteredGroups = groupSearch
+    ? groups.filter((g) =>
+        g.name.toLowerCase().includes(groupSearch.toLowerCase())
+      )
+    : groups;
+
+  return (
+    <div className="flex gap-2">
+      {/* Role filter */}
+      <Popover>
+        <Popover.Trigger asChild>
+          <FilterButton
+            leftIcon={SvgUsers}
+            active={hasRoleFilter}
+            onClear={() => onRolesChange([])}
+          >
+            {roleLabel}
+          </FilterButton>
+        </Popover.Trigger>
+        <Popover.Content align="start">
+          <div className="flex flex-col gap-1 p-1 min-w-[200px]">
+            <LineItem
+              icon={SvgUsers}
+              selected={!hasRoleFilter}
+              onClick={() => onRolesChange([])}
+            >
+              All Account Types
+            </LineItem>
+            <Separator noPadding />
+            {FILTERABLE_ROLES.map(([role, label]) => {
+              const isSelected = selectedRoles.includes(role);
+              const roleIcon = ROLE_ICONS[role] ?? SvgUser;
+              return (
+                <LineItem
+                  key={role}
+                  icon={isSelected ? SvgCheck : roleIcon}
+                  selected={isSelected}
+                  onClick={() => toggleRole(role)}
+                  rightChildren={<CountBadge count={roleCounts[role]} />}
+                >
+                  {label}
+                </LineItem>
+              );
+            })}
+          </div>
+        </Popover.Content>
+      </Popover>
+
+      {/* Groups filter */}
+      <Popover
+        open={groupPopoverOpen}
+        onOpenChange={(open) => {
+          setGroupPopoverOpen(open);
+          if (!open) setGroupSearch("");
+        }}
+      >
+        <Popover.Trigger asChild>
+          <FilterButton
+            leftIcon={SvgUsers}
+            active={hasGroupFilter}
+            onClear={() => onGroupsChange([])}
+          >
+            {groupLabel}
+          </FilterButton>
+        </Popover.Trigger>
+        <Popover.Content align="start">
+          <div className="flex flex-col gap-1 p-1 min-w-[200px]">
+            <div className="px-1 pt-1">
+              <InputTypeIn
+                value={groupSearch}
+                onChange={(e) => setGroupSearch(e.target.value)}
+                placeholder="Search groups..."
+                leftSearchIcon
+              />
+            </div>
+            <LineItem
+              icon={SvgUsers}
+              selected={!hasGroupFilter}
+              onClick={() => onGroupsChange([])}
+            >
+              All Groups
+            </LineItem>
+            <Separator noPadding />
+            <div className="flex flex-col gap-1 max-h-[240px] overflow-y-auto">
+              {filteredGroups.map((group) => {
+                const isSelected = selectedGroups.includes(group.id);
+                return (
+                  <LineItem
+                    key={group.id}
+                    icon={isSelected ? SvgCheck : undefined}
+                    selected={isSelected}
+                    onClick={() => toggleGroup(group.id)}
+                    rightChildren={<CountBadge count={group.memberCount} />}
+                  >
+                    {group.name}
+                  </LineItem>
+                );
+              })}
+              {filteredGroups.length === 0 && (
+                <Text as="span" secondaryBody text03 className="px-2 py-1.5">
+                  No groups found
+                </Text>
+              )}
+            </div>
+          </div>
+        </Popover.Content>
+      </Popover>
+
+      {/* Status filter */}
+      <Popover>
+        <Popover.Trigger asChild>
+          <FilterButton
+            leftIcon={SvgUsers}
+            active={hasStatusFilter}
+            onClear={() => onStatusesChange([])}
+          >
+            {statusLabel}
+          </FilterButton>
+        </Popover.Trigger>
+        <Popover.Content align="start">
+          <div className="flex flex-col gap-1 p-1 min-w-[200px]">
+            <LineItem
+              icon={!hasStatusFilter ? SvgCheck : undefined}
+              selected={!hasStatusFilter}
+              onClick={() => onStatusesChange([])}
+            >
+              All Status
+            </LineItem>
+            <Separator noPadding />
+            {FILTERABLE_STATUSES.map(([status, label]) => {
+              const isSelected = selectedStatuses.includes(status);
+              const countKey = STATUS_COUNT_KEY[status];
+              return (
+                <LineItem
+                  key={status}
+                  icon={isSelected ? SvgCheck : undefined}
+                  selected={isSelected}
+                  onClick={() => toggleStatus(status)}
+                  rightChildren={<CountBadge count={statusCounts[countKey]} />}
+                >
+                  {label}
+                </LineItem>
+              );
+            })}
+          </div>
+        </Popover.Content>
+      </Popover>
+    </div>
+  );
+}
--- a/web/src/refresh-pages/admin/UsersPage/UserRoleCell.tsx
+++ b/web/src/refresh-pages/admin/UsersPage/UserRoleCell.tsx
@@ -0,0 +1,133 @@
+"use client";
+
+import { useState, useRef } from "react";
+import { UserRole, USER_ROLE_LABELS } from "@/lib/types";
+import { usePaidEnterpriseFeaturesEnabled } from "@/components/settings/usePaidEnterpriseFeaturesEnabled";
+import { OpenButton } from "@opal/components";
+import { Disabled } from "@opal/core";
+import {
+  SvgCheck,
+  SvgGlobe,
+  SvgUser,
+  SvgSlack,
+  SvgUserManage,
+} from "@opal/icons";
+import type { IconFunctionComponent } from "@opal/types";
+import Text from "@/refresh-components/texts/Text";
+import Popover from "@/refresh-components/Popover";
+import LineItem from "@/refresh-components/buttons/LineItem";
+import { toast } from "@/hooks/useToast";
+import { setUserRole } from "./svc";
+import type { UserRow } from "./interfaces";
+
+const ROLE_ICONS: Partial<Record<UserRole, IconFunctionComponent>> = {
+  [UserRole.ADMIN]: SvgUserManage,
+  [UserRole.GLOBAL_CURATOR]: SvgGlobe,
+  [UserRole.SLACK_USER]: SvgSlack,
+};
+
+const SELECTABLE_ROLES = [
+  UserRole.ADMIN,
+  UserRole.GLOBAL_CURATOR,
+  UserRole.BASIC,
+] as const;
+
+interface UserRoleCellProps {
+  user: UserRow;
+  onMutate: () => void;
+}
+
+export default function UserRoleCell({ user, onMutate }: UserRoleCellProps) {
+  const [isUpdating, setIsUpdating] = useState(false);
+  const [open, setOpen] = useState(false);
+  const isPaidEnterpriseFeaturesEnabled = usePaidEnterpriseFeaturesEnabled();
+  const isUpdatingRef = useRef(false);
+
+  if (!user.role) {
+    return (
+      <Text as="span" secondaryBody text03>
+        —
+      </Text>
+    );
+  }
+
+  if (user.is_scim_synced) {
+    return (
+      <div className="flex items-center gap-1.5">
+        <Text as="span" mainUiBody text03>
+          {USER_ROLE_LABELS[user.role] ?? user.role}
+        </Text>
+      </div>
+    );
+  }
+
+  const applyRole = async (newRole: UserRole) => {
+    if (isUpdatingRef.current) return;
+    isUpdatingRef.current = true;
+    setIsUpdating(true);
+    try {
+      await setUserRole(user.email, newRole);
+      toast.success("Role updated");
+      onMutate();
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : "Failed to update role");
+      onMutate();
+    } finally {
+      setIsUpdating(false);
+      isUpdatingRef.current = false;
+    }
+  };
+
+  const handleSelect = (role: UserRole) => {
+    if (role === user.role) {
+      setOpen(false);
+      return;
+    }
+    setOpen(false);
+    void applyRole(role);
+  };
+
+  const currentIcon = ROLE_ICONS[user.role] ?? SvgUser;
+
+  return (
+    <Disabled disabled={isUpdating}>
+      <Popover open={open} onOpenChange={setOpen}>
+        <Popover.Trigger asChild>
+          <OpenButton
+            icon={currentIcon}
+            variant="select-tinted"
+            width="full"
+            justifyContent="between"
+          >
+            {USER_ROLE_LABELS[user.role]}
+          </OpenButton>
+        </Popover.Trigger>
+        <Popover.Content align="start">
+          <div className="flex flex-col gap-1 p-1 min-w-[160px]">
+            {SELECTABLE_ROLES.map((role) => {
+              if (
+                role === UserRole.GLOBAL_CURATOR &&
+                !isPaidEnterpriseFeaturesEnabled
+              ) {
+                return null;
+              }
+              const isSelected = user.role === role;
+              const icon = ROLE_ICONS[role] ?? SvgUser;
+              return (
+                <LineItem
+                  key={role}
+                  icon={isSelected ? SvgCheck : icon}
+                  selected={isSelected}
+                  emphasized={isSelected}
+                  onClick={() => handleSelect(role)}
+                >
+                  {USER_ROLE_LABELS[role]}
+                </LineItem>
+              );
+            })}
+          </div>
+        </Popover.Content>
+      </Popover>
+    </Disabled>
+  );
+}
--- a/web/src/refresh-pages/admin/UsersPage/UserRowActions.tsx
+++ b/web/src/refresh-pages/admin/UsersPage/UserRowActions.tsx
@@ -0,0 +1,210 @@
+"use client";
+
+import { useState } from "react";
+import { Button } from "@opal/components";
+import { SvgMoreHorizontal, SvgXCircle, SvgTrash, SvgCheck } from "@opal/icons";
+import { Disabled } from "@opal/core";
+import Popover from "@/refresh-components/Popover";
+import ConfirmationModalLayout from "@/refresh-components/layouts/ConfirmationModalLayout";
+import Text from "@/refresh-components/texts/Text";
+import { UserStatus } from "@/lib/types";
+import { toast } from "@/hooks/useToast";
+import { deactivateUser, activateUser, deleteUser } from "./svc";
+import type { UserRow } from "./interfaces";
+
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+
+type ModalType = "deactivate" | "activate" | "delete" | null;
+
+interface UserRowActionsProps {
+  user: UserRow;
+  onMutate: () => void;
+}
+
+// ---------------------------------------------------------------------------
+// Component
+// ---------------------------------------------------------------------------
+
+export default function UserRowActions({
+  user,
+  onMutate,
+}: UserRowActionsProps) {
+  const [modal, setModal] = useState<ModalType>(null);
+  const [popoverOpen, setPopoverOpen] = useState(false);
+  const [isSubmitting, setIsSubmitting] = useState(false);
+
+  async function handleAction(
+    action: () => Promise<void>,
+    successMessage: string
+  ) {
+    setIsSubmitting(true);
+    try {
+      await action();
+      onMutate();
+      toast.success(successMessage);
+      setModal(null);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : "An error occurred");
+    } finally {
+      setIsSubmitting(false);
+    }
+  }
+
+  // Only show actions for accepted users (active or inactive).
+  // Invited/requested users have no row actions in this PR.
+  if (
+    user.status !== UserStatus.ACTIVE &&
+    user.status !== UserStatus.INACTIVE
+  ) {
+    return null;
+  }
+
+  // SCIM-managed users cannot be modified from the UI — changes would be
+  // overwritten on the next IdP sync.
+  if (user.is_scim_synced) {
+    return null;
+  }
+
+  return (
+    <>
+      <Popover open={popoverOpen} onOpenChange={setPopoverOpen}>
+        <Popover.Trigger asChild>
+          <Button prominence="tertiary" icon={SvgMoreHorizontal} />
+        </Popover.Trigger>
+        <Popover.Content align="end">
+          <div className="flex flex-col gap-0.5 p-1">
+            {user.status === UserStatus.ACTIVE ? (
+              <Button
+                prominence="tertiary"
+                icon={SvgXCircle}
+                onClick={() => {
+                  setPopoverOpen(false);
+                  setModal("deactivate");
+                }}
+              >
+                Deactivate User
+              </Button>
+            ) : (
+              <>
+                <Button
+                  prominence="tertiary"
+                  icon={SvgCheck}
+                  onClick={() => {
+                    setPopoverOpen(false);
+                    setModal("activate");
+                  }}
+                >
+                  Activate User
+                </Button>
+                <Button
+                  prominence="tertiary"
+                  variant="danger"
+                  icon={SvgTrash}
+                  onClick={() => {
+                    setPopoverOpen(false);
+                    setModal("delete");
+                  }}
+                >
+                  Delete User
+                </Button>
+              </>
+            )}
+          </div>
+        </Popover.Content>
+      </Popover>
+
+      {modal === "deactivate" && (
+        <ConfirmationModalLayout
+          icon={SvgXCircle}
+          title="Deactivate User"
+          onClose={isSubmitting ? undefined : () => setModal(null)}
+          submit={
+            <Disabled disabled={isSubmitting}>
+              <Button
+                variant="danger"
+                onClick={async () => {
+                  await handleAction(
+                    () => deactivateUser(user.email),
+                    "User deactivated"
+                  );
+                }}
+              >
+                Deactivate
+              </Button>
+            </Disabled>
+          }
+        >
+          <Text as="p" text03>
+            <Text as="span" text05>
+              {user.email}
+            </Text>{" "}
+            will immediately lose access to Onyx. Their sessions and agents will
+            be preserved. You can reactivate this account later.
+          </Text>
+        </ConfirmationModalLayout>
+      )}
+
+      {modal === "activate" && (
+        <ConfirmationModalLayout
+          icon={SvgCheck}
+          title="Activate User"
+          onClose={isSubmitting ? undefined : () => setModal(null)}
+          submit={
+            <Disabled disabled={isSubmitting}>
+              <Button
+                onClick={async () => {
+                  await handleAction(
+                    () => activateUser(user.email),
+                    "User activated"
+                  );
+                }}
+              >
+                Activate
+              </Button>
+            </Disabled>
+          }
+        >
+          <Text as="p" text03>
+            <Text as="span" text05>
+              {user.email}
+            </Text>{" "}
+            will regain access to Onyx.
+          </Text>
+        </ConfirmationModalLayout>
+      )}
+
+      {modal === "delete" && (
+        <ConfirmationModalLayout
+          icon={SvgTrash}
+          title="Delete User"
+          onClose={isSubmitting ? undefined : () => setModal(null)}
+          submit={
+            <Disabled disabled={isSubmitting}>
+              <Button
+                variant="danger"
+                onClick={async () => {
+                  await handleAction(
+                    () => deleteUser(user.email),
+                    "User deleted"
+                  );
+                }}
+              >
+                Delete
+              </Button>
+            </Disabled>
+          }
+        >
+          <Text as="p" text03>
+            <Text as="span" text05>
+              {user.email}
+            </Text>{" "}
+            will be permanently removed from Onyx. All of their session history
+            will be deleted. This cannot be undone.
+          </Text>
+        </ConfirmationModalLayout>
+      )}
+    </>
+  );
+}
--- a/web/src/refresh-pages/admin/UsersPage/UsersSummary.tsx
+++ b/web/src/refresh-pages/admin/UsersPage/UsersSummary.tsx
@@ -1,4 +1,4 @@
-import { SvgArrowUpRight, SvgUserSync } from "@opal/icons";
+import { SvgArrowUpRight, SvgFilter, SvgUserSync } from "@opal/icons";
 import { ContentAction } from "@opal/layouts";
 import { Button } from "@opal/components";
 import { Section } from "@/layouts/general-layouts";
@@ -14,19 +14,33 @@ import { ADMIN_PATHS } from "@/lib/admin-routes";
 type StatCellProps = {
  value: number | null;
  label: string;
+  onFilter?: () => void;
 };

-function StatCell({ value, label }: StatCellProps) {
+function StatCell({ value, label, onFilter }: StatCellProps) {
  const display = value === null ? "\u2014" : value.toLocaleString();

  return (
-    <div className="flex flex-col items-start gap-0.5 w-full p-2">
+    <div
+      className={`group/stat relative flex flex-col items-start gap-0.5 w-full p-2 rounded-08 transition-colors ${
+        onFilter ? "cursor-pointer hover:bg-background-tint-02" : ""
+      }`}
+      onClick={onFilter}
+    >
      <Text as="span" mainUiAction text04>
        {display}
      </Text>
      <Text as="span" secondaryBody text03>
        {label}
      </Text>
+      {onFilter && (
+        <div className="absolute right-2 top-2 flex items-center gap-1 opacity-0 group-hover/stat:opacity-100 transition-opacity">
+          <Text as="span" secondaryBody text03>
+            Filter
+          </Text>
+          <SvgFilter size={16} className="text-text-03" />
+        </div>
+      )}
    </div>
  );
 }
@@ -66,6 +80,9 @@ type UsersSummaryProps = {
  pendingInvites: number | null;
  requests: number | null;
  showScim: boolean;
+  onFilterActive?: () => void;
+  onFilterInvites?: () => void;
+  onFilterRequests?: () => void;
 };

 export default function UsersSummary({
@@ -73,9 +90,36 @@ export default function UsersSummary({
  pendingInvites,
  requests,
  showScim,
+  onFilterActive,
+  onFilterInvites,
+  onFilterRequests,
 }: UsersSummaryProps) {
  const showRequests = requests !== null && requests > 0;

+  const statsCard = (
+    <Card padding={0.5}>
+      <Section flexDirection="row" gap={0}>
+        <StatCell
+          value={activeUsers}
+          label="active users"
+          onFilter={onFilterActive}
+        />
+        <StatCell
+          value={pendingInvites}
+          label="pending invites"
+          onFilter={onFilterInvites}
+        />
+        {showRequests && (
+          <StatCell
+            value={requests}
+            label="requests to join"
+            onFilter={onFilterRequests}
+          />
+        )}
+      </Section>
+    </Card>
+  );
+
  if (showScim) {
    return (
      <Section
@@ -84,15 +128,7 @@ export default function UsersSummary({
        alignItems="stretch"
        gap={0.5}
      >
-        <Card padding={0.5}>
-          <Section flexDirection="row" gap={0}>
-            <StatCell value={activeUsers} label="active users" />
-            <StatCell value={pendingInvites} label="pending invites" />
-            {showRequests && (
-              <StatCell value={requests} label="requests to join" />
-            )}
-          </Section>
-        </Card>
+        {statsCard}
        <ScimCard />
      </Section>
    );
@@ -102,14 +138,26 @@ export default function UsersSummary({
  return (
    <Section flexDirection="row" gap={0.5}>
      <Card padding={0.5}>
-        <StatCell value={activeUsers} label="active users" />
+        <StatCell
+          value={activeUsers}
+          label="active users"
+          onFilter={onFilterActive}
+        />
      </Card>
      <Card padding={0.5}>
-        <StatCell value={pendingInvites} label="pending invites" />
+        <StatCell
+          value={pendingInvites}
+          label="pending invites"
+          onFilter={onFilterInvites}
+        />
      </Card>
      {showRequests && (
        <Card padding={0.5}>
-          <StatCell value={requests} label="requests to join" />
+          <StatCell
+            value={requests}
+            label="requests to join"
+            onFilter={onFilterRequests}
+          />
        </Card>
      )}
    </Section>
--- a/web/src/refresh-pages/admin/UsersPage/UsersTable.tsx
+++ b/web/src/refresh-pages/admin/UsersPage/UsersTable.tsx
@@ -0,0 +1,262 @@
+"use client";
+
+import { useMemo, useState } from "react";
+import DataTable from "@/refresh-components/table/DataTable";
+import { createTableColumns } from "@/refresh-components/table/columns";
+import { Content } from "@opal/layouts";
+import SvgNoResult from "@opal/illustrations/no-result";
+import { IllustrationContent } from "@opal/layouts";
+import SimpleLoader from "@/refresh-components/loaders/SimpleLoader";
+import { UserRole, UserStatus, USER_STATUS_LABELS } from "@/lib/types";
+import { timeAgo } from "@/lib/time";
+import Text from "@/refresh-components/texts/Text";
+import InputTypeIn from "@/refresh-components/inputs/InputTypeIn";
+import useAdminUsers from "@/hooks/useAdminUsers";
+import useGroups from "@/hooks/useGroups";
+import UserFilters from "./UserFilters";
+import UserRowActions from "./UserRowActions";
+import UserRoleCell from "./UserRoleCell";
+import type {
+  UserRow,
+  UserGroupInfo,
+  GroupOption,
+  StatusFilter,
+  StatusCountMap,
+} from "./interfaces";
+import { getInitials } from "./utils";
+
+// ---------------------------------------------------------------------------
+// Column renderers
+// ---------------------------------------------------------------------------
+
+function renderNameColumn(email: string, row: UserRow) {
+  return (
+    <Content
+      sizePreset="main-ui"
+      variant="section"
+      title={row.personal_name ?? email}
+      description={row.personal_name ? email : undefined}
+    />
+  );
+}
+
+function renderGroupsColumn(groups: UserGroupInfo[]) {
+  if (!groups.length) {
+    return (
+      <Text as="span" secondaryBody text03>
+        {"\u2014"}
+      </Text>
+    );
+  }
+  const visible = groups.slice(0, 2);
+  const overflow = groups.length - visible.length;
+  return (
+    <div className="flex items-center gap-1 flex-nowrap overflow-hidden min-w-0">
+      {visible.map((g) => (
+        <span
+          key={g.id}
+          className="inline-flex items-center flex-shrink-0 rounded-md bg-background-tint-02 px-2 py-0.5 whitespace-nowrap"
+        >
+          <Text as="span" secondaryBody text03>
+            {g.name}
+          </Text>
+        </span>
+      ))}
+      {overflow > 0 && (
+        <Text as="span" secondaryBody text03>
+          +{overflow}
+        </Text>
+      )}
+    </div>
+  );
+}
+
+function renderStatusColumn(value: UserStatus, row: UserRow) {
+  return (
+    <div className="flex flex-col">
+      <Text as="span" mainUiBody text03>
+        {USER_STATUS_LABELS[value] ?? value}
+      </Text>
+      {row.is_scim_synced && (
+        <Text as="span" secondaryBody text03>
+          SCIM synced
+        </Text>
+      )}
+    </div>
+  );
+}
+
+function renderLastUpdatedColumn(value: string | null) {
+  return (
+    <Text as="span" secondaryBody text03>
+      {timeAgo(value) ?? "\u2014"}
+    </Text>
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Columns
+// ---------------------------------------------------------------------------
+
+const tc = createTableColumns<UserRow>();
+
+function buildColumns(onMutate: () => void) {
+  return [
+    tc.qualifier({
+      content: "avatar-user",
+      getInitials: (row) => getInitials(row.personal_name, row.email),
+      selectable: false,
+    }),
+    tc.column("email", {
+      header: "Name",
+      weight: 22,
+      minWidth: 140,
+      cell: renderNameColumn,
+    }),
+    tc.column("groups", {
+      header: "Groups",
+      weight: 24,
+      minWidth: 200,
+      enableSorting: false,
+      cell: renderGroupsColumn,
+    }),
+    tc.column("role", {
+      header: "Account Type",
+      weight: 16,
+      minWidth: 180,
+      cell: (_value, row) => <UserRoleCell user={row} onMutate={onMutate} />,
+    }),
+    tc.column("status", {
+      header: "Status",
+      weight: 14,
+      minWidth: 100,
+      cell: renderStatusColumn,
+    }),
+    tc.column("updated_at", {
+      header: "Last Updated",
+      weight: 14,
+      minWidth: 100,
+      cell: renderLastUpdatedColumn,
+    }),
+    tc.actions({
+      cell: (row) => <UserRowActions user={row} onMutate={onMutate} />,
+    }),
+  ];
+}
+
+// ---------------------------------------------------------------------------
+// Component
+// ---------------------------------------------------------------------------
+
+const PAGE_SIZE = 8;
+
+interface UsersTableProps {
+  selectedStatuses: StatusFilter;
+  onStatusesChange: (statuses: StatusFilter) => void;
+  roleCounts: Record<string, number>;
+  statusCounts: StatusCountMap;
+}
+
+export default function UsersTable({
+  selectedStatuses,
+  onStatusesChange,
+  roleCounts,
+  statusCounts,
+}: UsersTableProps) {
+  const [searchTerm, setSearchTerm] = useState("");
+  const [selectedRoles, setSelectedRoles] = useState<UserRole[]>([]);
+  const [selectedGroups, setSelectedGroups] = useState<number[]>([]);
+
+  const { data: allGroups } = useGroups();
+
+  const groupOptions: GroupOption[] = useMemo(
+    () =>
+      (allGroups ?? []).map((g) => ({
+        id: g.id,
+        name: g.name,
+        memberCount: g.users.length,
+      })),
+    [allGroups]
+  );
+
+  const { users, isLoading, error, refresh } = useAdminUsers();
+
+  const columns = useMemo(() => buildColumns(refresh), [refresh]);
+
+  // Client-side filtering
+  const filteredUsers = useMemo(() => {
+    let result = users;
+
+    if (selectedRoles.length > 0) {
+      result = result.filter(
+        (u) => u.role !== null && selectedRoles.includes(u.role)
+      );
+    }
+
+    if (selectedStatuses.length > 0) {
+      result = result.filter((u) => selectedStatuses.includes(u.status));
+    }
+
+    if (selectedGroups.length > 0) {
+      result = result.filter((u) =>
+        u.groups.some((g) => selectedGroups.includes(g.id))
+      );
+    }
+
+    return result;
+  }, [users, selectedRoles, selectedStatuses, selectedGroups]);
+
+  if (isLoading) {
+    return (
+      <div className="flex justify-center py-12">
+        <SimpleLoader className="h-6 w-6" />
+      </div>
+    );
+  }
+
+  if (error) {
+    return (
+      <Text as="p" secondaryBody text03>
+        Failed to load users. Please try refreshing the page.
+      </Text>
+    );
+  }
+
+  return (
+    <div className="flex flex-col gap-3">
+      <InputTypeIn
+        value={searchTerm}
+        onChange={(e) => setSearchTerm(e.target.value)}
+        placeholder="Search users..."
+        leftSearchIcon
+      />
+      <UserFilters
+        selectedRoles={selectedRoles}
+        onRolesChange={setSelectedRoles}
+        selectedGroups={selectedGroups}
+        onGroupsChange={setSelectedGroups}
+        groups={groupOptions}
+        selectedStatuses={selectedStatuses}
+        onStatusesChange={onStatusesChange}
+        roleCounts={roleCounts}
+        statusCounts={statusCounts}
+      />
+      {filteredUsers.length === 0 ? (
+        <IllustrationContent
+          illustration={SvgNoResult}
+          title="No users found"
+          description="No users match the current filters."
+        />
+      ) : (
+        <DataTable
+          data={filteredUsers}
+          columns={columns}
+          getRowId={(row) => row.id ?? row.email}
+          pageSize={PAGE_SIZE}
+          searchTerm={searchTerm}
+          footer={{ mode: "summary" }}
+        />
+      )}
+    </div>
+  );
+}
--- a/web/src/refresh-pages/admin/UsersPage/interfaces.ts
+++ b/web/src/refresh-pages/admin/UsersPage/interfaces.ts
@@ -0,0 +1,36 @@
+import type { UserRole, UserStatus } from "@/lib/types";
+
+export interface UserGroupInfo {
+  id: number;
+  name: string;
+}
+
+export interface UserRow {
+  id: string | null;
+  email: string;
+  role: UserRole | null;
+  status: UserStatus;
+  is_active: boolean;
+  is_scim_synced: boolean;
+  personal_name: string | null;
+  created_at: string | null;
+  updated_at: string | null;
+  groups: UserGroupInfo[];
+}
+
+export interface GroupOption {
+  id: number;
+  name: string;
+  memberCount?: number;
+}
+
+/** Empty array = no filter (show all). */
+export type StatusFilter = UserStatus[];
+
+/** Keys match the UserStatus-derived labels used in filter badges. */
+export type StatusCountMap = {
+  active?: number;
+  inactive?: number;
+  invited?: number;
+  requested?: number;
+};
--- a/web/src/refresh-pages/admin/UsersPage/svc.ts
+++ b/web/src/refresh-pages/admin/UsersPage/svc.ts
@@ -0,0 +1,71 @@
+import { UserRole } from "@/lib/types";
+
+async function parseErrorDetail(
+  res: Response,
+  fallback: string
+): Promise<string> {
+  try {
+    const body = await res.json();
+    return body?.detail ?? fallback;
+  } catch {
+    return fallback;
+  }
+}
+
+export async function deactivateUser(email: string): Promise<void> {
+  const res = await fetch("/api/manage/admin/deactivate-user", {
+    method: "PATCH",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ user_email: email }),
+  });
+  if (!res.ok) {
+    throw new Error(await parseErrorDetail(res, "Failed to deactivate user"));
+  }
+}
+
+export async function activateUser(email: string): Promise<void> {
+  const res = await fetch("/api/manage/admin/activate-user", {
+    method: "PATCH",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ user_email: email }),
+  });
+  if (!res.ok) {
+    throw new Error(await parseErrorDetail(res, "Failed to activate user"));
+  }
+}
+
+export async function deleteUser(email: string): Promise<void> {
+  const res = await fetch("/api/manage/admin/delete-user", {
+    method: "DELETE",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ user_email: email }),
+  });
+  if (!res.ok) {
+    throw new Error(await parseErrorDetail(res, "Failed to delete user"));
+  }
+}
+
+export async function setUserRole(
+  email: string,
+  newRole: UserRole
+): Promise<void> {
+  const res = await fetch("/api/manage/set-user-role", {
+    method: "PATCH",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ user_email: email, new_role: newRole }),
+  });
+  if (!res.ok) {
+    throw new Error(await parseErrorDetail(res, "Failed to update user role"));
+  }
+}
+
+export async function inviteUsers(emails: string[]): Promise<void> {
+  const res = await fetch("/api/manage/admin/users", {
+    method: "PUT",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ emails }),
+  });
+  if (!res.ok) {
+    throw new Error(await parseErrorDetail(res, "Failed to invite users"));
+  }
+}
--- a/web/src/refresh-pages/admin/UsersPage/utils.test.ts
+++ b/web/src/refresh-pages/admin/UsersPage/utils.test.ts
@@ -0,0 +1,43 @@
+import { getInitials } from "./utils";
+
+describe("getInitials", () => {
+  it("returns first letters of first two name parts", () => {
+    expect(getInitials("Alice Smith", "alice@example.com")).toBe("AS");
+  });
+
+  it("returns first two chars of a single-word name", () => {
+    expect(getInitials("Alice", "alice@example.com")).toBe("AL");
+  });
+
+  it("handles three-word names (uses first two)", () => {
+    expect(getInitials("Alice B. Smith", "alice@example.com")).toBe("AB");
+  });
+
+  it("falls back to email local part with dot separator", () => {
+    expect(getInitials(null, "alice.smith@example.com")).toBe("AS");
+  });
+
+  it("falls back to email local part with underscore separator", () => {
+    expect(getInitials(null, "alice_smith@example.com")).toBe("AS");
+  });
+
+  it("falls back to email local part with hyphen separator", () => {
+    expect(getInitials(null, "alice-smith@example.com")).toBe("AS");
+  });
+
+  it("uses first two chars of email local if no separator", () => {
+    expect(getInitials(null, "alice@example.com")).toBe("AL");
+  });
+
+  it("returns ? for empty email local part", () => {
+    expect(getInitials(null, "@example.com")).toBe("?");
+  });
+
+  it("uppercases the result", () => {
+    expect(getInitials("john doe", "jd@test.com")).toBe("JD");
+  });
+
+  it("trims whitespace from name", () => {
+    expect(getInitials("  Alice Smith  ", "a@test.com")).toBe("AS");
+  });
+});
--- a/web/src/refresh-pages/admin/UsersPage/utils.ts
+++ b/web/src/refresh-pages/admin/UsersPage/utils.ts
@@ -0,0 +1,23 @@
+/**
+ * Derive display initials from a user's name or email.
+ *
+ * - If a name is provided, uses the first letter of the first two words.
+ * - Falls back to the email local part, splitting on `.`, `_`, or `-`.
+ * - Returns at most 2 uppercase characters.
+ */
+export function getInitials(name: string | null, email: string): string {
+  if (name) {
+    const parts = name.trim().split(/\s+/);
+    if (parts.length >= 2) {
+      return ((parts[0]?.[0] ?? "") + (parts[1]?.[0] ?? "")).toUpperCase();
+    }
+    return name.slice(0, 2).toUpperCase();
+  }
+  const local = email.split("@")[0];
+  if (!local) return "?";
+  const parts = local.split(/[._-]/);
+  if (parts.length >= 2) {
+    return ((parts[0]?.[0] ?? "") + (parts[1]?.[0] ?? "")).toUpperCase();
+  }
+  return local.slice(0, 2).toUpperCase();
+}
--- a/web/src/sections/modals/PreviewModal/PreviewModal.tsx
+++ b/web/src/sections/modals/PreviewModal/PreviewModal.tsx
@@ -7,13 +7,14 @@ import Text from "@/refresh-components/texts/Text";
 import SimpleLoader from "@/refresh-components/loaders/SimpleLoader";
 import { cn } from "@/lib/utils";
 import { Section } from "@/layouts/general-layouts";
-import { getCodeLanguage, getDataLanguage } from "@/lib/languages";
+import mime from "mime";
+import {
+  getCodeLanguage,
+  getDataLanguage,
+  getLanguageByMime,
+} from "@/lib/languages";
 import { fetchChatFile } from "@/lib/chat/svc";
 import { PreviewContext } from "@/sections/modals/PreviewModal/interfaces";
-import {
-  getMimeLanguage,
-  resolveMimeType,
-} from "@/sections/modals/PreviewModal/mimeUtils";
 import { resolveVariant } from "@/sections/modals/PreviewModal/variants";

 interface PreviewModalProps {
@@ -41,7 +42,7 @@ export default function PreviewModal({
  const language = useMemo(
    () =>
      getCodeLanguage(presentingDocument.semantic_identifier || "") ||
-      getMimeLanguage(mimeType) ||
+      getLanguageByMime(mimeType) ||
      getDataLanguage(presentingDocument.semantic_identifier || "") ||
      "plaintext",
    [mimeType, presentingDocument.semantic_identifier]
@@ -86,7 +87,10 @@ export default function PreviewModal({

      const rawContentType =
        response.headers.get("Content-Type") || "application/octet-stream";
-      const resolvedMime = resolveMimeType(rawContentType, originalFileName);
+      const resolvedMime =
+        rawContentType === "application/octet-stream"
+          ? mime.getType(originalFileName) ?? rawContentType
+          : rawContentType;
      setMimeType(resolvedMime);

      const resolved = resolveVariant(
@@ -166,24 +170,24 @@ export default function PreviewModal({
          onClose={onClose}
        />

-        {/* Body + floating footer wrapper */}
-        <Modal.Body padding={0} gap={0}>
-          <Section padding={0} gap={0}>
-            {isLoading ? (
-              <Section>
-                <SimpleLoader className="h-8 w-8" />
-              </Section>
-            ) : loadError ? (
-              <Section padding={1}>
-                <Text text03 mainUiBody>
-                  {loadError}
-                </Text>
-              </Section>
-            ) : (
-              variant.renderContent(ctx)
-            )}
-          </Section>
-        </Modal.Body>
+        {/* Body — uses flex-1/min-h-0/overflow-hidden (not Modal.Body)
+            so that child ScrollIndicatorDivs become the actual scroll
+            container instead of the body stealing it via overflow-y-auto. */}
+        <div className="flex flex-col flex-1 min-h-0 overflow-hidden w-full bg-background-tint-01">
+          {isLoading ? (
+            <Section>
+              <SimpleLoader className="h-8 w-8" />
+            </Section>
+          ) : loadError ? (
+            <Section padding={1}>
+              <Text text03 mainUiBody>
+                {loadError}
+              </Text>
+            </Section>
+          ) : (
+            variant.renderContent(ctx)
+          )}
+        </div>

        {/* Floating footer */}
        {!isLoading && !loadError && (
@@ -194,8 +198,9 @@ export default function PreviewModal({
              "p-4 pointer-events-none w-full"
            )}
            style={{
-              background:
-                "linear-gradient(to top, var(--background-code-01) 40%, transparent)",
+              background: `linear-gradient(to top, var(--background-${
+                variant.codeBackground ? "code-01" : "tint-01"
+              }) 40%, transparent)`,
            }}
          >
            {/* Left slot */}
--- a/web/src/sections/modals/PreviewModal/interfaces.ts
+++ b/web/src/sections/modals/PreviewModal/interfaces.ts
@@ -19,6 +19,8 @@ export interface PreviewVariant
  matches: (semanticIdentifier: string | null, mimeType: string) => boolean;
  /** Whether the fetcher should read the blob as text. */
  needsTextContent: boolean;
+  /** Whether the variant renders on a code-style background (bg-background-code-01). */
+  codeBackground: boolean;
  /** String shown below the title in the modal header. */
  headerDescription: (ctx: PreviewContext) => string;
  /** Body content. */
--- a/web/src/sections/modals/PreviewModal/mimeUtils.ts
+++ b/web/src/sections/modals/PreviewModal/mimeUtils.ts
@@ -1,50 +0,0 @@
-const MIME_LANGUAGE_PREFIXES: Array<[prefix: string, language: string]> = [
-  ["application/json", "json"],
-  ["application/xml", "xml"],
-  ["text/xml", "xml"],
-  ["application/x-yaml", "yaml"],
-  ["application/yaml", "yaml"],
-  ["text/yaml", "yaml"],
-  ["text/x-yaml", "yaml"],
-];
-
-const OCTET_STREAM_EXTENSION_TO_MIME: Record<string, string> = {
-  ".md": "text/markdown",
-  ".markdown": "text/markdown",
-  ".txt": "text/plain",
-  ".log": "text/plain",
-  ".conf": "text/plain",
-  ".sql": "text/plain",
-  ".csv": "text/csv",
-  ".tsv": "text/tab-separated-values",
-  ".json": "application/json",
-  ".xml": "application/xml",
-  ".yml": "application/x-yaml",
-  ".yaml": "application/x-yaml",
-};
-
-export function getMimeLanguage(mimeType: string): string | null {
-  return (
-    MIME_LANGUAGE_PREFIXES.find(([prefix]) =>
-      mimeType.startsWith(prefix)
-    )?.[1] ?? null
-  );
-}
-
-export function resolveMimeType(mimeType: string, fileName: string): string {
-  if (mimeType !== "application/octet-stream") {
-    return mimeType;
-  }
-
-  const lowerFileName = fileName.toLowerCase();
-
-  for (const [extension, resolvedMime] of Object.entries(
-    OCTET_STREAM_EXTENSION_TO_MIME
-  )) {
-    if (lowerFileName.endsWith(extension)) {
-      return resolvedMime;
-    }
-  }
-
-  return mimeType;
-}
--- a/web/src/sections/modals/PreviewModal/variants/CodePreview.tsx
+++ b/web/src/sections/modals/PreviewModal/variants/CodePreview.tsx
@@ -1,22 +1,37 @@
 "use client";

 import MinimalMarkdown from "@/components/chat/MinimalMarkdown";
+import ScrollIndicatorDiv from "@/refresh-components/ScrollIndicatorDiv";
+import { cn } from "@/lib/utils";
 import "@/app/app/message/custom-code-styles.css";

 interface CodePreviewProps {
  content: string;
  language?: string | null;
+  normalize?: boolean;
 }

-export function CodePreview({ content, language }: CodePreviewProps) {
-  const normalizedContent = content.replace(/~~~/g, "\\~\\~\\~");
-  const fenceHeader = language ? `~~~${language}` : "~~~";
+export function CodePreview({
+  content,
+  language,
+  normalize,
+}: CodePreviewProps) {
+  // Wrap raw content in a fenced code block for syntax highlighting. Uses ~~~
+  // instead of ``` to avoid conflicts with backticks in the content. Any literal
+  // ~~~ sequences in the content are escaped so they don't accidentally close the fence.
+  const markdownContent = normalize
+    ? `~~~${language || ""}\n${content.replace(/~~~/g, "\\~\\~\\~")}\n~~~`
+    : content;

  return (
-    <MinimalMarkdown
-      content={`${fenceHeader}\n${normalizedContent}\n\n~~~`}
-      className="w-full h-full"
-      showHeader={false}
-    />
+    <ScrollIndicatorDiv
+      className={cn("p-4", normalize && "bg-background-code-01")}
+      backgroundColor={normalize ? "var(--background-code-01)" : undefined}
+      variant="shadow"
+      bottomSpacing="2rem"
+      disableBottomIndicator
+    >
+      <MinimalMarkdown content={markdownContent} showHeader={false} />
+    </ScrollIndicatorDiv>
  );
 }
--- a/web/src/sections/modals/PreviewModal/variants/codeVariant.tsx
+++ b/web/src/sections/modals/PreviewModal/variants/codeVariant.tsx
@@ -13,6 +13,7 @@ export const codeVariant: PreviewVariant = {
  width: "md",
  height: "lg",
  needsTextContent: true,
+  codeBackground: true,

  headerDescription: (ctx) =>
    ctx.fileContent
@@ -22,7 +23,7 @@ export const codeVariant: PreviewVariant = {
      : "",

  renderContent: (ctx) => (
-    <CodePreview content={ctx.fileContent} language={ctx.language} />
+    <CodePreview normalize content={ctx.fileContent} language={ctx.language} />
  ),

  renderFooterLeft: (ctx) => (
--- a/web/src/sections/modals/PreviewModal/variants/csvVariant.tsx
+++ b/web/src/sections/modals/PreviewModal/variants/csvVariant.tsx
@@ -34,6 +34,7 @@ export const csvVariant: PreviewVariant = {
  width: "lg",
  height: "full",
  needsTextContent: true,
+  codeBackground: false,
  headerDescription: (ctx) => {
    if (!ctx.fileContent) return "";
    const { rows } = parseCsv(ctx.fileContent);
--- a/web/src/sections/modals/PreviewModal/variants/dataVariant.tsx
+++ b/web/src/sections/modals/PreviewModal/variants/dataVariant.tsx
@@ -1,8 +1,7 @@
 import Text from "@/refresh-components/texts/Text";
 import { Section } from "@/layouts/general-layouts";
-import { getDataLanguage } from "@/lib/languages";
+import { getDataLanguage, getLanguageByMime } from "@/lib/languages";
 import { PreviewVariant } from "@/sections/modals/PreviewModal/interfaces";
-import { getMimeLanguage } from "@/sections/modals/PreviewModal/mimeUtils";
 import { CodePreview } from "@/sections/modals/PreviewModal/variants/CodePreview";
 import {
  CopyButton,
@@ -22,10 +21,11 @@ function formatContent(language: string, content: string): string {

 export const dataVariant: PreviewVariant = {
  matches: (name, mime) =>
-    !!getDataLanguage(name || "") || !!getMimeLanguage(mime),
+    !!getDataLanguage(name || "") || !!getLanguageByMime(mime),
  width: "md",
  height: "lg",
  needsTextContent: true,
+  codeBackground: true,

  headerDescription: (ctx) =>
    ctx.fileContent
@@ -36,7 +36,9 @@ export const dataVariant: PreviewVariant = {

  renderContent: (ctx) => {
    const formatted = formatContent(ctx.language, ctx.fileContent);
-    return <CodePreview content={formatted} language={ctx.language} />;
+    return (
+      <CodePreview normalize content={formatted} language={ctx.language} />
+    );
  },

  renderFooterLeft: (ctx) => (
--- a/web/src/sections/modals/PreviewModal/variants/docxVariant.tsx
+++ b/web/src/sections/modals/PreviewModal/variants/docxVariant.tsx
@@ -130,6 +130,7 @@ export const docxVariant: PreviewVariant = {
  width: "lg",
  height: "full",
  needsTextContent: false,
+  codeBackground: false,
  headerDescription: () => {
    if (lastDocxResult) {
      const count = lastDocxResult.wordCount;
--- a/web/src/sections/modals/PreviewModal/variants/imageVariant.tsx
+++ b/web/src/sections/modals/PreviewModal/variants/imageVariant.tsx
@@ -11,6 +11,7 @@ export const imageVariant: PreviewVariant = {
  width: "lg",
  height: "full",
  needsTextContent: false,
+  codeBackground: false,
  headerDescription: () => "",

  renderContent: (ctx) => (
--- a/web/src/sections/modals/PreviewModal/variants/index.ts
+++ b/web/src/sections/modals/PreviewModal/variants/index.ts
@@ -15,10 +15,10 @@ const PREVIEW_VARIANTS: PreviewVariant[] = [
  imageVariant,
  pdfVariant,
  csvVariant,
-  dataVariant,
-  textVariant,
  markdownVariant,
  docxVariant,
+  textVariant,
+  dataVariant,
 ];

 export function resolveVariant(
--- a/web/src/sections/modals/PreviewModal/variants/markdownVariant.tsx
+++ b/web/src/sections/modals/PreviewModal/variants/markdownVariant.tsx
@@ -1,8 +1,7 @@
-import MinimalMarkdown from "@/components/chat/MinimalMarkdown";
-import ScrollIndicatorDiv from "@/refresh-components/ScrollIndicatorDiv";
 import { Section } from "@/layouts/general-layouts";
 import { isMarkdownFile } from "@/lib/languages";
 import { PreviewVariant } from "@/sections/modals/PreviewModal/interfaces";
+import { CodePreview } from "@/sections/modals/PreviewModal/variants/CodePreview";
 import {
  CopyButton,
  DownloadButton,
@@ -23,15 +22,11 @@ export const markdownVariant: PreviewVariant = {
  width: "lg",
  height: "full",
  needsTextContent: true,
+  codeBackground: false,
  headerDescription: () => "",

  renderContent: (ctx) => (
-    <ScrollIndicatorDiv className="flex-1 min-h-0 p-4" variant="shadow">
-      <MinimalMarkdown
-        content={ctx.fileContent}
-        className="w-full pb-4 text-lg break-words"
-      />
-    </ScrollIndicatorDiv>
+    <CodePreview content={ctx.fileContent} language={ctx.language} />
  ),

  renderFooterLeft: () => null,
--- a/web/src/sections/modals/PreviewModal/variants/pdfVariant.tsx
+++ b/web/src/sections/modals/PreviewModal/variants/pdfVariant.tsx
@@ -7,6 +7,7 @@ export const pdfVariant: PreviewVariant = {
  width: "lg",
  height: "full",
  needsTextContent: false,
+  codeBackground: false,
  headerDescription: () => "",

  renderContent: (ctx) => (
--- a/web/src/sections/modals/PreviewModal/variants/textVariant.tsx
+++ b/web/src/sections/modals/PreviewModal/variants/textVariant.tsx
@@ -28,6 +28,7 @@ export const textVariant: PreviewVariant = {
  width: "md",
  height: "lg",
  needsTextContent: true,
+  codeBackground: true,
  headerDescription: (ctx) =>
    ctx.fileContent
      ? `${ctx.lineCount} ${ctx.lineCount === 1 ? "line" : "lines"} · ${
@@ -36,7 +37,7 @@ export const textVariant: PreviewVariant = {
      : "",

  renderContent: (ctx) => (
-    <CodePreview content={ctx.fileContent} language={ctx.language} />
+    <CodePreview normalize content={ctx.fileContent} language={ctx.language} />
  ),

  renderFooterLeft: (ctx) => (
--- a/web/src/sections/modals/PreviewModal/variants/unsupportedVariant.tsx
+++ b/web/src/sections/modals/PreviewModal/variants/unsupportedVariant.tsx
@@ -5,13 +5,14 @@ import { DownloadButton } from "@/sections/modals/PreviewModal/variants/shared";

 export const unsupportedVariant: PreviewVariant = {
  matches: () => true,
-  width: "lg",
+  width: "md",
  height: "full",
  needsTextContent: false,
+  codeBackground: false,
  headerDescription: () => "",

  renderContent: (ctx) => (
-    <div className="flex flex-col items-center justify-center flex-1 min-h-0 gap-4 p-6">
+    <div className="flex flex-col items-center justify-center flex-1 w-full min-h-0 gap-4 p-6">
      <Text as="p" text03 mainUiBody>
        This file format is not supported for preview.
      </Text>
--- a/web/tailwind-themes/tailwind.config.js
+++ b/web/tailwind-themes/tailwind.config.js
@@ -260,6 +260,7 @@ module.exports = {
        "code-string": "var(--code-string)",
        "code-number": "var(--code-number)",
        "code-definition": "var(--code-definition)",
+        "background-code-01": "var(--background-code-01)",

        // Shimmer colors for loading animations
        "shimmer-base": "var(--shimmer-base)",
Author	SHA1	Message	Date
Bo-Onyx	3e25853eb8	chore(hook): Add feature control	2026-03-12 19:28:48 -07:00
Jamison Lahman	a4a664fa2c	chore(fe): polish file previews more (#9259 ) Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>	2026-03-12 22:37:00 +00:00
dependabot[bot]	8a6e349741	chore(deps): bump orjson from 3.11.4 to 3.11.6 (#9315 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jamison Lahman <jamison@lahman.dev>	2026-03-12 22:17:56 +00:00
Nikolas Garza	11f8408558	feat(admin): add inline role editing in Users table - 7/9 (#9184 )	2026-03-12 14:33:57 -07:00
Jessica Singh	24de76ad28	chore(auth): deployment helm cleanup (#8588 ) Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>	2026-03-12 21:06:13 +00:00
Jamison Lahman	e264356eb5	feat(chat): support attaching more file types to chats (#9299 )	2026-03-12 20:57:54 +00:00
Nikolas Garza	c5c08c5da6	feat(admin): add invite users modal - 6/9 (#9181 )	2026-03-12 19:40:07 +00:00
Evan Lohn	78a9b386c7	chore: sharepoint error logs (#9309 )	2026-03-12 19:07:17 +00:00
Jamison Lahman	dbcbfc1629	fix(favicon): prefer relative path to favicon (#9307 )	2026-03-12 18:43:43 +00:00
Wenxi	fabbb00c49	refactor: sync craft latest builds with latest stable (#9279 )	2026-03-12 18:27:25 +00:00
Nikolas Garza	809dab5746	feat(admin): add row actions with confirmation modals - 5/9 (#9180 )	2026-03-12 17:46:12 +00:00
Wenxi	1649bed548	refactor: use ods latest-stable-tag to tag images in Docker Hub (#9281 ) Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>	2026-03-12 17:06:58 +00:00
Jamison Lahman	dd07b3cf27	fix(fe): prevent clicking `InputSelect` from selecting text (#9292 )	2026-03-12 09:32:06 -07:00
Nikolas Garza	c57ea65d42	fix(db): avoid SQLAlchemy sentinel mismatch in batch user insert (#9300 )	2026-03-12 06:56:45 +00:00
Nikolas Garza	c1ce180b72	feat(admin): add role, group, and status filters to Users table - 4/9 (#9179 )	2026-03-11 21:56:19 -07:00
Jamison Lahman	b5474dc127	chore(devtools): upgrade `ods`: 0.6.3->0.7.0 (#9297 )	2026-03-11 20:30:55 -07:00
Nikolas Garza	e1df3f533a	feat(admin): add Users table with DataTable and server-side pagination - 3/9 (#9178 )	2026-03-11 20:26:07 -07:00
Jamison Lahman	df5252db05	chore(devtools): `ods backend api` (#9295 ) Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>	2026-03-11 20:07:23 -07:00
Nikolas Garza	f01f210af8	fix(slackbot): resolve channel references and filter search by channel tags (#9256 )	2026-03-11 19:37:03 -07:00
Jamison Lahman	781219cf18	chore(models): rm `claude-3-5-sonnet-v2` metadata (#9285 )	2026-03-12 02:17:09 +00:00
Nikolas Garza	ca39da7de9	feat(admin): add user timestamps and enrich FullUserSnapshot - 2/9 (#9183 )	2026-03-11 19:07:45 -07:00
dependabot[bot]	abf76cd747	chore(deps): bump tornado from 6.5.2 to 6.5.5 (#9290 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jamison Lahman <jamison@lahman.dev>	2026-03-12 01:41:01 +00:00
Jamison Lahman	a78607f1b5	fix(fe): `InputComboBox` resets filter value on open (#9287 )	2026-03-12 01:06:02 +00:00